Asgeir S. Nilsen tenker litt

Android Orphans: Visualizing a Sad History of Support

2011-10-29T15:56:00.004+02:00

Michael Degusta tells a sad story in Android Orphans: Visualizing a Sad History of Support:

I went back and found every Android phone shipped in the United States up through the middle of last year. I then tracked down every update that was released for each device - be it a major OS upgrade or a minor support patch - as well as prices and release & discontinuation dates. I compared these dates & versions to the currently shipping version of Android at the time. The resulting picture isn’t pretty - well, not for Android users.

My iPhone 3G stopped being updated only a few months ago, and is now 1 major version behind. In fact, iPhones are the only devices I've ever owned that has had regular long term updates, even across major versions, for free.

A Lock Free Concurrent Circular Buffer With Multiple Independent Readers

2011-09-22T11:26:00.002+02:00

I wrote about a Lock Free Concurrent Circular Buffer about a year ago. This has now been updated to support multiple independent readers, so many consumers can get updates to this circular buffer.

It is still lock free, so the readers won't block. If you try to take() on a buffer with no updates a null is returned, and if you drain() a buffer with no updates you get an empty list.

The code is now on GitHub, so I recommend you give it a spin if you want a (simple) circular buffer. It does detect buffer wraparounds, but will in this case reset the reader to the end of the buffer, losing any intermediate updates. Tune your buffer size accordingly.

Take a look at the unit tests to get an idea on how to use this buffer.

Blogger has an official app for iPhone

2011-09-08T22:23:00.001+02:00

This blog post serves as proof that it works.

Seems to do okay, but does not have rich text.

Also the labels do not auto complete.

So it finally happened...

2011-09-06T21:08:00.000+02:00

From "Who do you trust to tell you who to trust?":

The big security news of the past few days is the story of the compromise of the DigiNotar Certificate Authority and the subsequent issuing of fraudulent SSL certificates, leading to actual Man in the Middle attacks against Gmail users in Iran.

and:

When the whole trust structure for SSL was devised, there were many people who worried that it gave too much power to certification authorities. In this instance we had one that suffered a security breach, but imagine if there were a corrupt one. With hundreds of trusted certification authorities, each with the power to issue certificates for any domain, the scope for abuse is substantial. I was one of those worriers.

It is easy to say that I don’t like the system, it is much much harder to present an alternative that works better and doesn’t burden users with the task of performing their own audits of certificates or authorities. There are a number of proposals out there, and discussion of them has certainly kicked off again over the past few days. My post here has already been long enough, so I will redirect readers to a post by Mike Caldwell who proposes an idea I haven’t seen before (as well as linking to other proposals).

Well, I told you so. Basically the use of TLS to ensure trusted domain names is not trustworthy. In my opinion this problem should be solved by the Domain Naming System, not by Transport Layer Security.

How to fix a NETGEAR WN802Tv2 after firmware upgrade

2010-09-17T10:23:00.002+02:00

For me, updating to the latest 3.1.3 firmware for the NETGEAR WN802Tv2 access point had an unfortunate side effect: the access point refused to accept any password for logging in…
Resetting to factory defaults did not work. There are a few threads on the NETGEAR forums about this as well, but the only resolution seemed to be to send the unit to NETGEAR.
However – after two days of hacking I have found a do-it-yourself solution:
1. Make sure you can connect to the web interface safely
This means resetting to factory defaults, use a cable directly between your computer and the access point, and set a static IP address for your computer in the 192.168.0.x range. NETGEAR supports recommends using the address 192.168.0.210 for reasons that I don’t know..
2. Go to the address http://192.168.0.233/recreate.php
The real purpose of this file is not known, but it has an interesting side effect: When you go to the access point home page afterwards, you get access to a partly functional interface. A lot of things don’t work, but one important piece did work for me: the firmware upgrade
3. Upload the 3.1.1 firmware image
If you don’t have the firmware image here you can get it from NETGEAR support at http://kb.netgear.com/app/answers/detail/a_id/12197
4. Restore config
If you have a backed up config file, you can upload it. Otherwise, just configure settings as normal.

Links for 2010-09-20 [del.icio.us]

2010-09-21T00:00:00-07:00

zsync
zsync is a file transfer program. It allows you to download a file from a remote server, where you have a copy of an older version of the file on your computer already. zsync downloads only the new parts of the file. It uses the same algorithm as rsync. However, where rsync is designed for synchronising data from one computer to another within an organisation, zsync is designed for file distribution, with one file on a server to be distributed to thousands of downloaders. zsync requires no special server software — just a web server to host the files — and imposes no extra load on the server, making it ideal for large scale file distribution.

Musikerne vinner, plateselskapene taper

2010-09-13T13:46:00.003+02:00

Dommedagsprofetien ser ut til å ha et relativt begrenset nedslagsfelt. Som Espen refererer i Tversover: Musikerne vinner, plateselskapene taper ser det ut til at artistene har kommet godt ut av digitaliseringen økonomisk sett:

Etter 10 år med digitalisering av musikk har den gjennomsnittlige musiker hatt en inntektsvekst på 66%. De eneste som taper på digital musikk, er de tradisjonelle plateselskapene. Det viser en masterstudie utført av Siviløkonomstudentene Richard Bjerkøe og Anders Sørbo ved Handelshøyskolen BI.

Det gjenstår å se hvordan inntektsmodellen til digitalt salg og streaming påvirker (påvirkes av) dette.

Password Reuse

2010-09-13T13:34:00.002+02:00

This is absolutely true. In most occasions it doesn't really matter how strong your password is, only that it's unique. My recommendation is that you use SuperGenPass to generate site specific passwords for you.

Why Java needs Oracle

2010-08-27T15:58:00.002+02:00

Chris Wong's Development Blog: Why Java needs Oracle:

For better or for worse, Oracle is now Java's champion and protector. The legal landscape is too dangerous out there for a major platform to be without one.

Links for 2010-09-11 [del.icio.us]

2010-09-12T00:00:00-07:00

Gearman
generic application framework to farm out work to other machines or processes that are better suited to do the work. It allows you to do work in parallel, to load balance processing, and to call functions between languages. It can be used in a variety of applications, from high-availability web sites to the transport of database replication events. In other words, it is the nervous system for how distributed processing communicates

Links for 2010-09-05 [del.icio.us]

2010-09-06T00:00:00-07:00

OOo4Kids
OpenOffice optimized for kids aged 7 to 12

Links for 2010-09-04 [del.icio.us]

2010-09-05T00:00:00-07:00

Javascript Crypto Library
Contains an SRP implementation.
Mim: the build system you always wanted

Links for 2010-08-28 [del.icio.us]

2010-08-29T00:00:00-07:00

Two uses for enum most people forget.
Utilize the static instances of enums in cases where not allowing any instances or having only one (singleton) instance is useful.

Links for 2010-08-20 [del.icio.us]

2010-08-21T00:00:00-07:00

greenfoot.org
Consider greenfoot as a combination between a framework for creating two-dimensional grid assignments in Java and an integrated development environment (class browser, editor, compiler, execution, etc.) suitable for novice programmers. While greenfoot supports the full Java language, it is especially useful for programming exercises that have a visual element. In greenfoot object visualisation and object interaction are the key elements
BlueJ - Teaching Java
The aim of BlueJ is to provide an easy-to-use teaching environment for the Java language that facilitates the teaching of Java to first year students. Special emphasis has been placed on visualisation and interaction techniques to create a highly interactive environment that encourages experimentation and exploration.
Handling a byte order mark in Java

Bugs in Apple’s App Release Process

2010-08-20T23:42:00.001+02:00

As an active iPhone apps user, I’ve quite often experienced an app having two, or even three, releases in rapid succession. More often than not to fix quite simple bugs or usability issues.

I’ve recently come to think that this is because of the App Store’s lack of beta releases – a feature-complete version released to a limited number of people, often an opt-in choice by users more eager to test new features.

These early releases have been paramount to web 2.0 services and Open Source software. Quoting Linus Torvalds, “given enough eyeballs, all bugs are shallow.”

The rigorous release process of Apple’s App Store prohibits this due to the all-in characteristic of a software release: When a new version is released it’s immediately available to everybody, and all previous versions disappear.

The consequence of this is that app vendors have two options:

Extensive testing of new releases, inhibiting a quick release cycle and being quite expensive, or
Releasing untested software to the general public and using your entire customer base as testers, regardless of their willingness to use incomplete software.

People opting in to beta releases have a higher threshold for bugs or usability issues, and provide competent feedback on shortcomings.

This is a quality benefit for everybody, including Apple’s app reviewers. The software they assess would in general have higher quality, and the assessment could be tiered based on whether it’s a general release or beta release.

What is your experience? How does the applications you develop or use deal with pre-release testing?

Links for 2010-08-07 [del.icio.us]

2010-08-08T00:00:00-07:00

POTD: bridge method injector
Evolve your classes without breaking compatibility

Digitalradio i Norge: DAB må feile

2010-08-01T23:44:00.001+02:00

Som du kanskje har fått med deg, pågår det en liten radiorevolusjon i Norge for tiden. På samme måte som TV-distribusjon ønskes det å digitalisere radiodistribusjon. Dette må få lov til å feile, av flere grunner:

For mange radiomottakere det er umulig å oppgradere

FM-mottakere er bygget inn i alt mulig: biler, telefoner, dusjkabinetter (??), hørselvern, lommeradioer, hjemmestereo, ghettoblastere og annet. For mange av disse er oppgradering umulig, og å erstatte produktet med et som er DAB-kapabelt meningsløst.

Det er totalt mellom 12 og 15 millioner FM-mottakere i Norge, kun 1,7% av disse kan motta DAB-signaler. Det selges fortsatt 700.000 FM-radioer hvert år.

Teknologisk sett er DAB feil svar

DAB bruker en digitaliseringsteknikk som er utdatert, og krever stor plass i eteren. Mottakere er også strømhungrige og lite utbredt på verdensbasis.

DAB påstås også å fjerne støy, men for mange oppleves det ikke sånn. Jeg har en DAB-mottaker hjemme som er langt mer følsom for antenneproblemer enn noen FM-radio jeg kjenner til.

Vi har allerede digitalradio

Sammen med det digitale bakkenettet har vi allerede fått digital distribusjon av radiokanaler. Er det virkelig verdifullt å sette opp parallell distribusjon?

Internett er et fullgodt alternativ

For samme pris som en DAB-radio kan man kjøpe en internett-radio. De fleste har internett hjemme allerede. Denne radioen gir tilgang til langt flere kanaler, og drar nytte av et distribusjonsnett som allerede eksisterer.

For mobil bruk er mobilt bredbånd løsningen. Flere og flere har mobilabonnementer med inkludert datatrafikk, og et stort antall radiokanaler er eksempelvis tilgjengelig som applikasjoner på iPhone, Android og Nokia.

Med MP3 eller MPEG-4 har vi fått svært effektive kodingssystemer for lyd som gjør at man får fullgod radiolyd over en relativt sett lav båndbredde – mye lavere enn DAB ville ha brukt.

Behold FM-nettet, la DAB dø

Skal du kjøpe deg radio? Stem med lommeboken, kjøp Internettradio eller FM!

Dersom regjeringen mot formidning skulle tillate slukking av FM-nettet kobler du bare en FM-sender til iPod-spilleren din.

Can’t Get Things Done

2010-07-29T20:19:00.001+02:00

Getting Things Done (GTD) has become quite a popular organizational method recently, and has triggered my curiosity. I decided to read the book.

However, as an impatient soul I didn’t want to wait for a stack of flat dead trees to be sent to me, and wanted an ebook. Kindle version would be nice.

Sorry, no can do. It took a while before I understood why I couldn’t find it at Amazon. The title was there, but not there still. Reason was that the Kindle edition is only available in the US.

Googling for the ebook yielded the following results – two torrent sites, one link farm, one irrelevant link and two legitimate ebook sources, neither of which were available outside the US.

Clearly, in the author’s (or publisher’s) opinion, Europeans are either:

A bunch of pirates, or
Unable to get things done anyway

Reality: Man-in-the-Middle Attacks Against SSL

2010-04-13T15:47:00.001+02:00

If you read my post TLS: A Broken Trust Model, you really should read Bruce Schneier’s post Man-in-the-Middle Attacks Against SSL.

Certificates issued to the wrong party is not only a possibility, but a reality and even a commercial service. The target is government organizations, but is probably easily accessible to others as well.

Matt Blaze’s final comment in his blog post sums it up quite nicely:

Whether this kind of surveillance is currently widespread or not, Soghoian and Stamm's paper underscores the deeply flawed mess that the web certificate model has become. It's time to design something better.

A Lock Free Concurrent Circular Buffer

2010-03-19T15:40:00.001+01:00

The high level classes in java.util.concurrent.atomic makes it quite easy to create data structures that are thread safe and low on contention. This is a lock free concurrent circular buffer that I once found the need for:

import java.util.List;
import java.util.Vector;
import java.util.concurrent.atomic.AtomicInteger;
import java.util.concurrent.atomic.AtomicReferenceArray;

/**
 * A lock-free thread safe circular fixed length buffer.
 * 
 * Uses an AtomicInteger as index counter and an AtomicReferenceArray
 * to hold the references to the values.
 * 
 * When the buffer is full, the oldest item is overwritten.
 *
 */
public class CircularBuffer<T> {
    
    private final AtomicInteger index = new AtomicInteger(-1);
    private final AtomicReferenceArray<T> buffer;
    private final int size;

    public CircularBuffer(int size) {
        this.size = size;
        buffer = new AtomicReferenceArray<T>(this.size);
    }
    
    public void add(T item) {
        if (index.compareAndSet(size-1, 0)) {
            buffer.set(0, item);
        } else {
            buffer.set(index.incrementAndGet(), item);
        }
    }

    /**
     * Get contents of buffer, as a list.
     * 
     * Note that the list always has the size of the buffer,
     * no matter how many elements there actually are.
     * 
     * The ordering is also unpredictable.
     * 
     * @return contents
     */
    public List<T> getAll() {
        List<T> list = new Vector<T>(size);
        for (int i = 0; i < size; i++) 
            list.add(buffer.get(i));
        return list;
    }
   
    public T get(int i) {
        return buffer.get(i);
    }
}

Eleven Reasons Your Home Server Should Be a Netbook

2010-03-15T22:36:00.001+01:00

1. It's Cheap

It doesn't have to cost more than $250.

2. It Has a Solid-State Disk Drive

Hard Drives are mechanical devices that come in two forms: the ones that have failed, and those that haven't failed yet. Many netbooks come with solid state drives that potentially last as long as the rest of the computer electronics. If it doesn't come with an SSD originally one can be added later on, often in the form of a Compact Flash adapter.

The newly released Intel X25-V is an SSD especially targeted for netbooks, and sells for around $120.

3. It Has Built In UPS and Power Management

Since it's a netbook, it obviously has a battery. This saves you the need for a UPS system to keep the system running in case of power failure.

4. It Has a Built In Console

Servers are typically "headless", i.e. used without a monitor and keyboard. These can however come in handy for installation or troubleshooting. Having a server with a built-in console can be very useful and saves the cost of expensive remote Keyboard, Video, Mouse (KVM) solutions.

5. It Has Built In Thermal Management

Because of their small and compact form factor, portable computers come with built in thermal management features that often are more elaborate than a typical server. They are also built to be used in a "normal" living room environment, and not a server room with ample cooling.

6. It Has Backup Connectivity

Many netbooks come with a bundled mobile internet device in addition to wireless and wired ethernet. This provides a useful backup connectivity solution in case the primary connection fails or is congested. Combined with the built in battery this will keep the server running and accessible even if the building has lost all electricity, a feature that would be very costly for a full fledged server.

7. It's Small And Quiet

Servers are not build to be quiet. A 1U rack-mounted server typically has around ten 1-inch fans, and boy are they noisy! They typically will be kept running at full speed or a minimum speed that is still very noisy. Noise level ratings around 50-60 dB are common, or as noisy as a TV set or an air conditioning unit. Laptops are much quieter.

8. You Don't Need More Performance (At Home)

A home server is typically either a simple web server or a server to make files available. It thus does not need to be very powerful. The $250 price point above gives you a 1 GHz Atom processor.

9. You Don't Need More Space

It's for sharing documents or services that depend on being at your home. With a 16 GB or 32 GB SSD you easily outperform all but the most expensive hosting or sharing sites. Add in an SD card reader and you can easily expand this storage space at almost no cost.

10. Spare Parts Are Cheap(er) And Easier To Obtain

Server-grade replacement parts are typically pricey and not on stock in your everyday computer store. Laptop spares on the other hand are stocked everywhere. For most popular models replacement batteries are manufactured by other vendors long after the original battery has gone out of distribution. I just bought one for my nine-year-old model.

11. It Doesn't Have to Be New

You can get good deals for used laptops on eBay. My home server was actually purchased there for $120 in 2006, then five years old. It's still running fine.

C++0x Might Be C++11, Maybe

2010-03-13T23:22:00.000+01:00

Trip Report: March 2010 ISO C++ Standards Meeting « Sutter’s Mill

The biggest news is that this afternoon we voted in the final remaining feature changes to C++0x, and to much applause then unanimously approved the text for international ballot as a Final Committee Draft (FCD). FCD means that, assuming no surprises, we intend to do only bug fixes and editorial corrections for the next year or so, and then ballot a final standard. If we can do that, assuming all goes well, C++0x could officially be published as soon as next year as ISO C++ 2011, and we can stop with the “x-is-hex” jokes and just start calling it C++11.

Best wishes to the ISO Technical Committee for pulling this one off – now let’s hope the wheels of the ISO organization are able to grind it through on schedule..

C++0x: A const * const Odyssey

2010-03-10T20:52:00.001+01:00

This is a presentation I and my colleague Anders Schau Knatten held at an internal software seminar this February.

It was meant to cover both some introductory material, best practices we have acquired, new features to look forward to and things that might (or should) scare you.

However not one member of our audience had less experience with C++ than Anders and myself have together, so we quickly jumped down into details.

You should probably view the presentation full screen and open the speaker notes to get the most out of it.

You might find this additional note on slide 43 interesting: A non-virtual destructor once made it to the board of directors..

Why C++ is Male

2010-03-08T21:39:00.011+01:00

Through recent frustrations, and needless to say, core dumps, I have realized that C++ as a language have some distinct features often associated with men: It can only do one thing at a time, and it cannot communicate. In this post I'll elaborate on these.

It Can Only Do One Thing at a Time

In C++ threads or the notion of multiprocessing simply does not exist. The language has neither a thread concept nor any thread synchronization primitives like mutexes, semaphores and locks.

Even relatively simple constructs like static members simply do not work in a multi-threaded context. As described by Scott Meyers and Andrei Alexandrescu in C++ and the Perils of Double-Checked Locking, no matter how many volatile keywords or extra locking you add in the mix, it still won't work consistently. Some compilers try to help you by fixing this for you, but since that is compiler implementation dependent it does more harm than help.

C++ has no thread-safe memory model, and does not provide any means for a memory barrier. Which means that any "clever" compiler or instruction dispatcher is free to reorder your statements in whichever way provides the same result in a single thread of execution.

C++ Cannot Communicate

What is the de facto standard for communicating with the outside world, and has been for the last two decades? The Internet Protocol, or more specifically, the TCP and UDP protocols on top of it. But the C++ language does not support this protocol. The only means of communication provided by the language are streams for input and output, and they can only be used for talking to files or to the console.

You Can Teach C++ New Tricks

In the recent years I've learned the art of walking and chewing gum at the same time. I can even pay attention to a conversation while doing other stuff, or at least I think I can.

Being a married man I have also learned to cope with my lack of communication skills, to some extent. Neither of these feats came easy. They were achieved after failing a lot and suffering many crashes.

I have never tried teaching a man to do these things, but having been taught these capabilities has provided some insight into the requisite effort and amount of frustration involved.

Trying to teach C++ to do several things at the same time while communicating with others can also be accomplished. It is however probably equally frustrating as teaching your significant other something he obviously wasn't designed to do. Both capabilities require that you deal with the more primitive foundation the individual has evolved from (Neanderthals and C), and relying on cultural constructs (operating system interfaces) that have been added on top of evolution and behave differently from individual to individual.

In many circumstances the resulting behavior is undefined, and will certainly cause some surprises. You also have to meticulously and in great detail instruct your friend on every step required to perform the task, in a language he understands.

The Modern Man: C++0x

Men have evolved, and so has C++ as well. In C++0x the language has grown the capability of doing several things at once, but it still prefers to do so alone in a dark corner.

UML in a new way

2010-02-24T22:42:00.008+01:00

Once again I found myself in the need of writing some UML. My last attempt nearly got me carpal tunnel syndrome and a broken mouse.
Yet I once more went on the quest of finding a UML editor, bracing myself for a crunch down on the little pointer with a tool that would eat all my RAM and spit it back out.
This time around however, I discovered PlantUML. The process of writing for instance an action diagram became this easy:

@startuml
(*) --> "Download PlantUML"
--> "Run it"
--> "Open Notepad"
--> "Write Some Text"
--> "Hit Save"
--> "Look at the generated diagram"
--> (*)
@enduml

The tool supports Sequence, Use Case, Class, Activity, Component, and State diagrams, and only requires GraphViz.
And if Notepad isn't your tool of choice, you can choose between Word macros, Eclipse plugins, Ant tasks, or 10 other ways of running the tool.
Since it's text you can easily store it in version control, source code comments, pass it along in emails, tweet it, generate it, and parse it.
Batteries included, mouse not required. Highly recommended.

New version of XPath XML editor

2010-01-14T22:51:00.005+01:00

Recently I needed to use my XPath XML editor to tweak a number of POMs. Only catch was that I was required to do this on a Windows machine.

What's the catch you ask? XML and Java work just as fine on Windows. However, my editor requires a list of POM file names on the command line, something I quite easily fixed with

`find . -name pom.xml`

This isn't easy in CMD, but even Windows has evolved recently. Enter Windows PowerShell. The PowerShell replacement is pretty simple once you get to know the PowerShell basics:

$(ls -include pom.xml -recurse -name)

If you'd like to tinker with it, I've also pushed the xmleditor to GitHub.

Six questions on TDD

2009-10-13T21:55:00.004+02:00

Read Uncle Bob's TDD Triage:

"Is TDD a replacement for architecture?
Is TDD a replacement for design?
Should TDD be used for every line of code?
Well, if you are going to write some tests afterwards, why not write all tests afterwards?
Given that we accept the need for tests, why the resistance to test-first?
Wouldn’t it be faster without such high test coverage?"

and Echoes from the Stone Age:

"TDD
The Design Pattern Religion
Minimizing Concurrency"

Very good reads indeed. It is of course triggered by all the controversy of Joel Spolsky's blog on Jamie Zawinski being a Duct Tape Programmer.

Here are some of my comments:

Learn concurrency principles. You'll need it. Moore's Law no longer gives you more clock cycles per second, it gives you more processor cores. To effectively utilize a modern CPU you have to keep all cores busy. And if you struggle keeping two quad-cores busy, imagine keeping 1,000 cores busy. It probably requires a fundamental programming paradigm change like the proposed fork-join framework for Java.
Use high level building blocks like java.util.concurrent and java.util.concurrent.atomic. It gives you well tested code that is maintained by Other Smart People, relieving your brain to work on more important things. Two classes to study: ExecutorService and BlockingQueue.
TDD is a good way of writing safe concurrency code. Design each element as a single threaded execution flow, and assert state before and after. Pay attention to locks and shared data.
Architecture is Important. You don't build a skyscraper or a space station in the same way as a dog house or a residential house.
Testing is a good way of exploring unknown APIs or legacy code. You basically assert the expected output or behavior of the code you are exploring.
Duct Tape is good for many things. You can even build a sailboat out of it. But you probably wouldn't enlist for the Volvo Ocean Race with it?

Versions Maven Plugin

2009-08-24T11:19:00.003+02:00

Ever struggled with keeping versions of dependencies or inter-module links up to date? Now the Versions Maven Plugin comes to the rescue! It has readily available goals for tasks like:

The worst thing about this plugin is that it haven't appeared sooner. It also means I can now retire my XML Editor tool's primary usage.

HTTPS connection explained

2009-07-28T10:36:00.001+02:00

If you wonder how HTTPS works, you could read this one:

The First Few Milliseconds of an HTTPS Connection

After that, please come back and read my post TLS: A Broken Trust Model about the flaws of how HTTPS establishes a trust relationship between client and server.

TLS: A Broken Trust Model

2009-06-11T20:45:00.002+02:00

What is TLS

TLS stands for Transport Layer Security. It was formerly known as SSL, or Secure Sockets Layer. In short, it's the protocol behind the s in https, making internet banking, passwords and other data safe from eavesdropping while browsing.

In https, TLS also has another purpose -- trust. Through a chain of digital certificates and certificate authorities, the system tries to ensure you that the web site you are visiting is controlled by the company they claim to be.

How Does TLS Work

To protect communication, an encryption key has to be agreed upon by both ends in the conversation - namely the web browser and the web server. Because of efficiency this key must be identical on both sides. But how do you exchange this key in a secure fashion, ensuring no-one else can access it?

TLS solves this by encoding this key in another key. This other key is asymmetric, meaning different keys are used for encrypting and decrypting data. The key used for encrypting data can thus be openly exchanged. This encryption key, also called the public key, is encapsulated in a digital certificate with other information about the rightful owner of this key.

Among other things, this certificate contains the DNS name of the web server who owns it, and the name of the organization or individual it is registered to.

This certificate is presented to the browser by the web server when they initiate the TLS session.

The Purpose of those Certificates

But how do you know that this certificate is valid? This is where certificate authorities come in. They sign digital certificates, telling us that they vouch for the validity of this digital certificate and have verified that it is issued to the correct organization or person.

And how does the certificate authority identify itself. By another digital certificate. And how do you know this digital certificate is trustworthy? By yet another certificate authority, vouching for this intermediate certificate authority.

This obviously cannot continue forever. This is why TLS relies on root certificates. These certificates are ultimately trusted, meaning you simply accept that they are valid.

In order for this certificate chain to work in practice, these root certificates are installed in every web browser as they are distributed by the web browser vendor.

Who do you trust?

The web browser's ultimate trust in root certificates is distributed among a large number of corporations like Verisign, Thawte, COMODO, Microsoft, Deutsche Telekom, Entrust, Geotrust, Equifax, GlobalSign, Go Daddy, GTE CyberTrust, Starfield Technologies, and USERTrust. These comprise the list that my Internet Explorer 8 contains.

Firefox 3 contains the following staggering list: TÜRKTRUST, ABA.ECOM, AC Camerfirma SA, AddTrust AB, America Online, AOL Time Warner, Autodidad de Certificacion Firmaprofesional, Baltimore, beTRUSTed, Certplus, COMODO, DigiCert, DigiNotar, Digital Signature Trust, Entrust, Equifax, GeoTrust, GlobalSign, Taiwan Goverment Root Certification Authority, GTE Corporation, IPS Internet Publishing Services, IPS Seguridad, NetLock Halozatbiztonsagi, Network Solutions, QuoVadis, RSA Data Security, SECOM Trust, SecureTrust, Sonera, Staat der Nederlanden, Starfield Technologies, StartCom, Swisscom, SwissSign, TC TrustCenter for Security in Data Networks, TDC, Thawte, Go Daddy, USERTRUST, Unizeto, ValiCert, VeriSign, VISA, Wells Fargo, and XRamp Security Services.

So: Who decides which companies are admitted into this inner circle of ultimately trusted organizations? What means do they take to ensure that they are as trustworthy as they claim. And why is there such a large difference between Microsoft's and Mozilla's list?

A Snake Oil Market: Issuing Digital Certificates

These certificate authorities have created an artificial market, selling their trust at a high price. Furthermore, since digital certificates always have an expiration date, after which the certificate is no longer valid, they have ensured return customers as well.

The organizations provide little added value, apart from the aforementioned trust. But are these certificate authorities really more trustworthy than the organizations forced to purchase digital certificates from them?

What Is Wrong With TLS

It boils down to trust. If you were to make a top ten list of the organizations you trust most -- what would these organizations be? And are any of the organizations mentioned above on that list?

Why can't you choose for yourself who to trust?

What is TLS supposed to protect?

TLS protects the data transmitted between the browser and the web server. Often this is your personal or confidential data, like user identification, financial information or other data which you would like to be kept secret, and that the organization you exchange data with often is mandated to protect.

What are the risks involved?

The most severe risk is that a certificate authority issues a certificate to the wrong people. These people could then pose as the organization the certificate is issued to, and steal your personal data without you being aware of it. The browser would claim the communication is secure with a trustworthy party, and it's impossible to detect that something wrong is going on.

A Better TLS Key Exchange

Remember, the primary purpose of the digital certificate is to exchange and protect the key used to encrypt the data in transit between the browser and the web site.

This key could be protected in other ways, two of which are suggested here:

1. The browser issues a digital certificate

The web browser can generate a self-signed certificate and present it to the web server when initiating a TLS session. The web server doesn't know whether this certificate is trustworthy, but that doesn't matter. It's only a matter of exchanging an encryption key in a secure manner, not trust. Most web sites require you to log on to identify yourself and establish this trusted relationship.

This certificate can be generated when the browser starts, and be destroyed when the browser exits.

2. The encryption key is based on shared secrets

The encryption key, or a scheme to generate an encryption key, can be shared between the browser and the web site. This can be based on the user's authentication data like user name and password. The browser can then start sending encrypted data, expecting the web site to know how to decrypt them.

A Better Trust Model

Since the data exchanged is yours -- shouldn't you decide whether you trust the organization you exchange data with?

This could be solved by removing the intermediate steps in the trust chain. Either you trust the party you are exchanging data with, or you do not. The decision is yours and yours only.

For example, when you establish a customer relationship with an organization, this organization could send you a self-signed digital certificate identifying itself. You would then choose whether you accept or reject this certificate.

Conclusion

TLS in itself is not broken, but the trust model employed is. Furthermore, the TLS protocol does not need to change, at least not significantly, to implement the improvements suggested. The key exchange part needs to be revised, and the way browsers handle digital certificates must change.

But it would create an overall more trustworthy solution, removing an unnecessary middle man.

Why submitting clear text passwords is bad

2009-05-07T15:29:00.002+02:00

Jeff Atwood reminds me why even submitting passwords in the clear to a web site can be dangerous: You basically have to trust that they are storing the password in a secure fashion.

Which they more often than not don't.

Coding Horror: I Just Logged In As You: How It Happened:

"I guess I can tell you, so you don't fall into this trap again. There's a site I help out with that doesn't salt their passwords. They're MD5 encrypted, but if you've got a dictionary password, it's very easy to use a reverse-MD5 site to get the original. I was able to figure out you were a user on the site some time back, and realized I could do this, if only I knew your openid provider..."

There are basically two ways of solving this:

Use different passwords for different web sites. SuperGenPass takes the hassle out of this by generating a password based on a master password and the site's domain name.
Hash the password in the browser before submitting. My blog entry Password Authentication Without Revealing Your Password demonstrates a solution to this one.

I really wish client side hashing was more prominent than it is. I have seen it in action only two or three times, one of those implemented by myself.

Hemmelig kjennelse i Stavanger Tingrett om piratkopiering

2009-05-06T16:42:00.005+02:00

tu.no - Slik forklares hemmelig pirat-dom - Teknisk Ukeblad:

"Dagbladet skrev tirsdag at Stavanger tingrett har avsagt hemmelig kjennelse i spørsmålet om Lyse Tele må utlevere identiteten til en av sine bredbåndskunder som er mistenkt for piratkopiering av «Max Manus»-filmen.

Spørsmålet er svært betent, fordi piratjegerne som vil ha identiteten er advokater som jobber på vegne av en privat kunde.

Idag er det bare politiet som kan kreve dette, men i et byråkratvedtak av Post- og teletilsynet er det åpnet for at advokatfirmaet kan kreve utlevering på egenhånd, uten å måtte gå via politiet.

Reaksjonene på dette har kommet på nettet, men politikerne har så langt holdt seg unna på tross av mange oppfordringer om å komme på banen."

Hvor er politikerne? Er det slik vi vil ha det?

Dommeren som har avsagt kjennelsen har tatt ferie. Tilfeldig?

Se kommentarene på Twitter: #krevsvar