« Previous Entries
» Next Entries

Category

Internet

• GPF, Internet, Security, Technology

  Cookie cunundrum

  February 6th, 2008 (4 years ago) by Jeff | Permalink | 15 Core Dumps

  By now, I’m assuming most of you have read Mondays GPF News item. (If you haven’t, shame on you.) GPF is leaving Keenspot, and I’m neck-deep in unit testing the new site with hopes of releasing it to beta testers soon. If you’re interested in beta testing, you can volunteer in this thread on the old forum.

  However, I’ve hit upon one little programming snag, so I thought I’d put out an appeal for help. I thought the blog would be more appropriate venue for this than the forum; that assumption could be wrong, but I’ll go with it anyway. For those of you with some Web-based programming knowledge, especially in the areas of PHP and cookies, please put on your thinking caps.

  As part of the new site, I’m implementing my own version of Keenspot’s PREMIUM service, reusing the old relabeling of GPF Premium. Keenspot PREMIUM is going away (for several reasons I won’t go into here), but as the service’s biggest proponent and largest beneficiary, I’d hate to lose that functionality. So the new site will launch with its own independent Premium functionality including all the old service’s features (optional ad-free surfing, weekly archives, High-Def archives, tons of exclusives like Jeff’s Sketchbook, etc.) plus a few new features that I’ve been wanting to implement but haven’t had the time or technological hoop-jumping expertise to work on at Keen.

  For security reasons, I want to secure Premium sign-ups and account management via secure HTTP (HTTPS). The benefits should be obvious. By encrypting account creation & management pages, you eliminate sniffing attacks and protect user privacy. While these pages may still be susceptible to other forms of attacks (and I’ve coded them to be as resilient as I know how), encrypting the traffic end-to-end can go a long way to cutting off those vectors of attack.

  However, I seem to have hit a brick wall when it comes to setting the Premium authentication cookie. Like Keenspot’s implementation, the subscriber’s browser will be “enabled” by “branding” it with a cookie, which will be read and authenticated each time the page is loaded. If valid, Premium features for that page will be turned on; if invalid, the page will default to a non-enabled state, which could be a simple as showing all ads or as complex as denying access to the content within. Unlike Keenspot’s implementation, which was JavaScript based, mine is scripted server-side in PHP, meaning it should be more accessible to a wider range of browsers and in theory more secure (no Premium content is sent at all if Premium is not enabled, rather than letting the client browser decide). My implementation has been thoroughly tested and appears to work pretty much flawlessly… with one hitch.

  The problem occurs when I set the cookie over the encrypted HTTPS connection, then try to read it over unencrypted HTTP. I appears that none of my test browsers send the cookie back when the encryption state changes. The reverse is the same; if I change the URL and set the cookie over HTTP, then try to access a page via HTTPS, the encrypted page can’t see the cookie either. It works like an either-or situation, when what I really want is both. If I set a cookie over HTTPS, I want to see it in both HTTP and HTTPS mode.

  PHP’s primary cookie interface is the setcookie() method (for setting) and the $_COOKIE array (for reading). setcookie() includes a boolean parameter for secure cookies, i.e. cookies that will only be sent via HTTPS. What’s annoying is that even when I set this flag to false to force it to be insecure, the scripts continue to exhibit the same behavior: cookies set via HTTP can only be read via HTTP and vice versa. I’ve also tried setting the same cookie both ways–first in one protocol, then the other, without erasing the first cookie–but that didn’t seem to work. The second cookie overwrites the first one, effectively turning it off.

  I had heard that IE 6 exhibited this behavior as a bug. However, I tried the exact same tests in Firefox 2.0.0.11, Opera 9.24, and Safari 3.0.4 (all on Windows) as well as IE 7, and all reacted the same way. Cookies set over HTTP could not be read over HTTPS and vice versa. It’s a bit frustrating. Obviously, I don’t want my Premium folks to be forced to use the new site in encrypted mode all the time, as this would slow down all the pages and put a significant extra load on the server as the number of subscribers increases. But I want to protect my users’ privacy and settings (and one of my important revenue streams) by encrypting their account access.

  So I guess I’m looking for answers to two questions:

  1. Is this some new standard of behavior that I’m missing? I was operating under the assumption that secure cookies (those set with the boolean secure flag) were restricted to HTTPS, but otherwise all other cookies should be sent regardless of whether it was encrypted or not. When I use the awesome Firefox Web Developer plugin, it tells me that the cookie should be there regardless of the encrypted state. Yet it still doesn’t get sent. But am I asking too much? Am I not understanding the specifications, or has something changed that I wasn’t aware of? Can I not have my cake and eat it too?
  2. 1. If I’m right and this should be working, what am I doing wrong? Is there a feature of PHP I should be use other than setcookie() to do this? Is it a bug, either in PHP or the browsers?
     2. If I’m wrong and this behavior is expected, is there a workaround I can use to let the same Premium features work over both HTTP and HTTPS? Or should I just give up on the encrypted account management and assume my stuff isn’t worth stealing enough to bother?

  Any responses via e-mail or (preferred) comments below will be appreciated.

  Update March 5, 2008: Thanks to the input of many commentors below, it looks like I’ve got a solution. The problem, as usual, was somewhere between the chair and the keyboard and the faulty component has been sufficiently flogged with a wet noodle. Immense thanks to everyone who provided feedback and suggestions.

  

• Internet, Security, Technology

  Disturbing: PayPal in cahoots with DoubleClick?

  November 27th, 2007 (4 years, 2 months ago) by Jeff | Permalink | Dump Core

  I don’t usually do link-and-run posts (I prefer to have actual content in a blog), but I thought this was disturbing enough to disseminate. I’ll probably add my own blathering commentary which will make it more than a link-and-run post anyway. (After all, I know all of you who come here really come for the blathering. I’m just so blatherful….)

  I’m not sure how many of you out there follow the Security Now! podcast over at TWiT, but it’s probably obvious by now that I do, given recent posts. This past week’s episode, #119, exposes a rather unsettling fact that shouldn’t be ignored. (The high quality 64kbps MP3 can be found at that link, while a 16kbps MP3, a transcript in various formats, and additional notes can be found here.) While I encourage you to download and listen/read the facts for yourself, I’ll see if I can summarize it below for the attention-span impaired.

  For a long time, I’ve defended PayPal as a method of monetary transfer. They’ve always been good to me personally, even during the stormy periods where some GPF readers boycotted them for “questionable” practices. (See the PayPal Wikipedia entry for an abbreviated history.) For that matter, many online comics wouldn’t be able to monetize themselves in any fashion if it weren’t for PayPal, as many webcomics use the service for donations and online stores. (PayPal has always been an acceptable form of payment in every incarnation of the GPF Store.) They’ve always had issues with customer service, but they’ve also been champions in anti-phishing campaigns.

  But Steve Gibson and Leo Laporte have helped disclose a rather shady new practice: In a previous Security Now! episode, a listener mentioned problems downloading a software service from PayPal, only to discover that the download link was sending him to a server over at DoubleClick rather than PayPal. Since he was locally blocking access to the domain “doubleclick.net” in his hosts file, the link failed and the software would not download. Gibson promised to investigate the incident and after a number of side-tracks finally presented his results.

  DoubleClick, for the few out there unfamiliar with it, is one of the Internet’s largest online advertising agencies, serving ad banners to millions of Web sites (including, indirectly, GPF). DoubleClick has long been unpopular among netizens for its questionable policies of tracking Web surfers across multiple sites, using a trick with tracking cookies to follow you from site to site. Privacy concerns were raised even further when Google, a company that itself stores and indexes a lot of personal information about its users of GMail, Ad-Sense, and other services, recently purchased DoubleClick. DoubleClick eventually bowed to pressure from the Net at large and created an opt-out page so their tracking cookie would contain “non-personally-identifiable information” and thus negate some of the tracking cookie’s effectiveness. (This opt-out page is still linked to (now indirectly, as the URL has changed) from the GPF privacy policy page.) Many folks these days, however, including myself, simply run spyware scanners like Spybot: Search & Destroy or Ad-Aware and periodically delete such tracking cookies, or just block the “doubleclick.net” domain and its subdomains using the hosts file trick mentioned above. (This is how, in part, Spybot’s immunization against cookies works.) This eliminates or at least minimizes the opportunity for your Web surfing habits to be linked personally to you.

  However, PayPal’s new links bypass many of these anti-drive-by-cookie-ing techniques by sending you directly to DoubleClick’s servers, rather than inlining content like Flash or images from their site. Since these are internal PayPal URLs and not links that are expected to send you to the outside, they should be immediately suspicious. What’s even worse is that if you examine the URL closely, there appears to be some sort of “user ID” like number included that may personally identify you if you click on it. What’s even more disturbing is the number of these links you run across as you surf the PayPal site; while some obviously ad-like images contain the “doubleclick.net” URL, many links in the site bar that look like ordinary navigational links contain it as well. While Gibson points out–quite rightly–that there is no evidence to support any sort of conspiracy theories that many come to mind, it is obvious enough that some sort of information sharing is going on between the two companies, and that if a unique user identifier is indeed being passed along with the URL, there’s a likelihood that both companies can link your potential spending habits with PayPal to your surfing habits tracked by DoubleClick.

  Now it’s easy to be alarmist and to say everyone should boycott PayPal. Unfortunately, so many of us in webcomics depend on PayPal for survival, so there’s no way we can easily remove ourselves from it. And there’s no competitor out there with enough critical mass to really challenge PayPal for dominance, so there aren’t many viable alternatives. Thus the only current immunization option is diligent observation.

  The good news is that the DoubleClick URLs within PayPal’s site all contain at the end PayPal URL you will eventually be redirected to. It’s trivial to copy the URL, paste it into your address bar, crop out the DoubleClick portion, and go directly the the PayPal internal destination. Laporte even suggested that it won’t be long before someone comes up with a Firefox plugin that does that for you on the fly. The problem I see with this is that it won’t be long before the diabolical duo figures out savvy users are bypassing the links and they find a better way to obscure the redirection target URL so the copy/paste/edit trick will no longer work. While true encryption might be a bit too much server load for them to handle en masse, a simple ROT13 or Base64 encode might be enough to thwart all but the most stalwart gearheads.

  So… should you avoid PayPal? That’s up to you. I can’t, but I’ll be a lot more careful of where I click on their site from now on.

  

• Internet, Miscellaneous, Technology

  Comments restored… for now

  November 19th, 2007 (4 years, 2 months ago) by Jeff | Permalink | 2 Core Dumps

  Follow up from the last post: Comments should be working again, although not in a fashion that I’d prefer. I had to completely disable Admin-SSL, thus login and login cookies are no longer secure. If you logged in while it was active, you’ll likely need to log in again before you can post, even if you check the “remember me” box. I’m still looking into why it doesn’t work. There’s a known limitation that shared SSL setups will fail to recognize logins in insecure mode, but they say nothing about dedicated setups like mine, which I would think would imply that it ought to work. Then again, I also had some mod_rewrite rules in place, but I experimented with removing those and so I don’t think they’re part of the problem.

  I suppose this isn’t a big deal for you guys, since I doubt anyone will be all torn up over making sure their logins to some random guy’s blog are secure. It affects me more than anyone else, because I’d feel much safer if I could protect the admin parts of the site with a layer of encryption. Still, in places where I really need encryption I can verify it still works, so I guess the blog will just have to be open. :\

  

• Internet, Miscellaneous, Technology

  Comments broken, still working on it

  November 19th, 2007 (4 years, 2 months ago) by Jeff | Permalink | Dump Core

  It has come to my attention that comments don’t appear to be working here at the moment. I strongly suspect this is due to the Admin-SSL WordPress plugin that I’m currently using to secure parts of the blog. It seems to forget that you’re logged in when you’re not accessing a secure URL (i.e. you’re not in SSL mode). I’ve tried a few of the workarounds suggested, but none are working. I have a hunch on a few things to try, but that will have to wait until I have more dedicated time to work on it. (I’m currently watching the little guy by myself at the moment.) I’ll post an update when I think it’s been fixed.

  

• Internet, Security, Technology

  Roaming authentication with Apache mod_rewrite

  November 7th, 2007 (4 years, 3 months ago) by Jeff | Permalink | Dump Core

  I mentioned last week that I was working on a neat Apache mod_rewrite trick for locking down access to certain administration pages, but that I wasn’t having much success with it. Well, it seems to be working now and, as promised, I wanted to share it with anyone who might be interested. Fair warning to non-technical readers: extreme geekery lies ahead.

  First and foremost, I can’t claim full credit for this idea. It borrows some from Steve Gibson‘s roaming authentication scheme outlined in episode #113 of the Security Now! podcast. In that show (and subsequently continued in episode #115), Gibson outlines his method of allowing his employees to access secure portions of his site while traveling. The method described here is not quite as secure as his, as I’m forcing things to happen at the Web server software layer as opposed to the application layer and thus don’t have the same fine granularity of control he has. However, it uses many of the same ideas.

  It’s relatively easy with mod_rewrite to protect certain resources of a site by restricting access to certain IP addresses. Consider the following:

  RewriteCond %{REQUEST_URI} ^/store/admin/.*
RewriteCond %{REMOTE_ADDR} !^192\.168\.13\.
RewriteCond %{REMOTE_ADDR} !^127\.0\.0\.1$
RewriteRule ^/store/admin/.* /store/ [R,L]

  This rule set essentially says: (1) if the requested URL starts with the string “/store/admin/” and (2) the IP address of the requesting client does not begins with “192.168.13.” or (3) is not exactly “127.0.0.1″ then (4) redirect all requests for URLs starting with “/store/admin/” to the root URL of the store, “/store/”. Essentially, we’re only allowing access to what is apparently the administrative portions of an online store to a very limited number of IP addresses, one of which is fully qualified (the “loop-back” address of 127.0.0.1) and the rest belonging to a range (192.168.13.0 through 192.168.13.255). Anyone outside these IPs will be transparently redirected to the front page of the store. (Redirecting is much friendlier than outright forbidding access.) All of this takes place in Apache itself, before we even get to the application and any potential security flaws it might have. There are no worries about hacking the store software itself to deny access. Of course, we can list any number of REMOTE_ADDR entries that we wish; each condition is a regular expression (which are negated here by the “bang” at the front) so we can filter on any octet we want and can easily specify real, outside IPs rather than private ones. For example, for this site I limit access to my various admin sections to the IP of my cable modem and our outside IP at work.

  However, what happens when you are required to go on a trip and need to access the administrative parts of the site while on the go? Obviously, you can’t add the hotel’s outside IP to this rule set in advance (imagine asking the front desk for that information), and you probably won’t be able to add it easily once you get there. Sure, WordPress and the store front software have login security on their various admin interfaces, but we’re trying to protect those from hackers, right? Aside from reopening them to the entire Internet before the trip and closing them again once we get back, there aren’t very many options. How then can we identify approved “roaming” users and/or machines so they can access the admin sites without being inside a hard-coded list of IPs?

  Gibson’s answer was to optionally set a secure cookie in the user’s browser if they access the admin site within one of the approved IPs first. Being within an approved IP, they aren’t restricted by the access rule and they are allowed to reach the login prompt. During login, they are prompted on whether or not they want to enable roaming access on this particular machine. If they agree, a secure cookie is set in the browser and set to expire at some date in the future. Later, when the user attempts to access the admin site outside of the approved IP list, the site checks to see if the cookie has been set. If present, the user is allowed to log in, just as if they were within one of the approved IPs. The cookie acts as a kind of two-factor authentication: the first factor being “something you know”, the user name and password, and the second being “something you have”, the cookie. Since the cookie is set in secure mode (HTTPS), it will only be sent back to the site over a secure connection. And since (well behaved) browsers only allow a site to read the cookies it has itself set, no other site should be able to read it.

  This is all well and good… if you have access to the source of the application you’re trying to secure and you’re willing to hack it. Gibson wrote his own store front, so this was relatively easy for him to integrate. But I want to secure WordPress, a third-party store app, and a few random subdirectories that are pretty much statically built HTML. As much as I like running Open Source software, I usually prefer not to muck around with things if I can help it, lest I screw something up. Thus, I don’t particularly want to hack WP and the store to add this extra layer of functionality. Fortunately, though, mod_rewrite gives us a mechanism through which we can accomplish basically the same thing without modifying the underlying application. In theory, since all this occurs before we even reach the application, one could argue it may even be more secure than the application’s authentication mechanisms themselves.

  You can actually set browser cookies via mod_rewrite rules. Consider what happens if we insert the following before the rules we defined above:

  RewriteCond %{REMOTE_ADDR} ^192\.168\.13\.
RewriteCond %{HTTP_COOKIE} "!(.+; )*admincookie=uniqueval(; .+)*"
RewriteRule .* - [CO=admincookie:uniqueval:.domainname.tld:43200:/store/]

  This rule set essentially says: (1) if the remote IP starts with “192.168.13.” and (2) there isn’t a cookie already set by the name “admincookie” then (3) set a cookie named “admincookie” with the value “uniqueval” for the domain “.domainname.tld” (assuming that’s our real domain name) for a period of 30 days (60 minutes x 24 hours x 30 days = 43,200 minutes) restricted to the path “/store/” and its subdirectories. Now let’s modify the rule set from before:

  RewriteCond %{REQUEST_URI} ^/store/admin/.*
RewriteCond %{REMOTE_ADDR} !^192\.168\.13\.
RewriteCond %{REMOTE_ADDR} !^127\.0\.0\.1$
RewriteCond %{HTTP_COOKIE} "!(.+; )*admincookie=uniqueval(; .+)*"
RewriteRule ^/store/admin/.* /store/ [R,L]

  Note that we’ve added a new condition. In addition to checking for the approved IP list, we also check to see if the “admincookie” has been set and that its value is what we expect (“uniqueval”). Note the parenthetical parts at the beginning and end of the cookie regex; these should make sure we match the unique cookie name/value pair, regardless of how many cookies are present. (Also note the quotes around this regex; since whitespace delimits the parts of the rewrite statements, the quotes are required to include the spaces after the semicolons in the regex. Without the quotes, the regex produces a “bad flag delimiters” error when Apache parses the configuration file.) Since each approved item’s entry is negated, the rule is only applied if none of them match. So now we should be able to get into the site remotely if and only if we’re inside an approved IP or we have the secret cookie, which we know is only set if we’ve been in one of the approved IPs first. Instant roaming authentication!

  To summarize, the primary advantages to this scheme are:

  • Restricts access to specific requested URIs to specific IP addresses and/or ranges and to machines outside those addresses that have a special roaming authentication cookie.
  • The roaming cookie can only be set from within one or more of the authorized IPs.
  • The cookie is set and checked at the Web server level, before the request reaches application code, so this scheme can be placed on top of third-party applications as an additional layer of security. No changes to the application layer are required.

  There are, of course, a few caveats:

  • Based on these rules alone, none of the information transmitted back and forth is encrypted; it’s all sent in the clear, which may potentially be sniffed by a man in the middle. Then again, you can always use mod_rewrite to force certain URLs to always use SSL (assuming you have a secure certificate), thereby securing the connection first. All WP admin functions, the GPF Store, and my other secured admin locales here on this site are all secured via SSL, so that helps in keeping my site secure by eliminating sniffing. (Of course, if you go this route, don’t forget to copy any necessary rules from the main Apache configuration file to the SSL config file, as the secure site will be treated as a different virtual host with its own set of rewriting rules. This little hiccup is what was keeping me from publishing this for quite a while.)
  • Forcing SSL, however, doesn’t necessarily protect the cookie itself. Gibson’s roaming authentication cookie required an SSL connection. This is called a secure mode cookie. While I’m still doing research into this, as far as I can tell so far mod_rewrite does not have the facility to specify secure mode in a cookie set by a rewrite rule. Thus, the above cookie is not secure and will be sent with each request in or below the specified path, encrypted or not. The cookie is then theoretically susceptible to sniffing attacks. Setting a secure mode cookie is easy enough to do in application code, but not apparently so in mod_rewrite.
  • The value of the cookie is currently hard-coded to a set value, and every browser accessing it within the approved IP will receive the same hard-coded cookie value. Ideally, the cookie should be unique to each browser and somehow obscured or, better yet, encrypted. Unfortunately, while I’ve been researching this also, so far I haven’t come up with a way to create such a unique token natively within mod_rewrite. (Remember, all this is occurring in Apache before we even reach application code.) Right now, I’m using a rather large hash of a unique pass phrase string I use a small command-line script to create a very long, highly random string using random numbers, several hashes, a little bit of Blowfish encryption, and some random string manipulation, but the cookie value is still technically hard coded. It may be possible to write a cron that will periodically create a new value token, update the Apache config file, and restart Apache. This will update the value every so often, but it seems quite a hassle. (Plus, the user under which the cron runs has to be root in order to modify both the config file and to restart Apache.)
  • Similarly, there’s no way to distinguish between browsers behind the approved IP. My desktop is unlikely to roam anywhere, so it technically doesn’t need the cookie. Meanwhile, if my parents bring their laptop over and visit this site from that machine while within my network, they’d get the roaming cookie as well. Neither of these scenarios are ideal. In application code, it would be simple to set the cookie only after the user has been authenticated by the app’s internal mechanism first. But we’re not working with application code; we’re rewriting URLs in the server. Thus, this becomes a different security concern: controlling access to the approved IPs, which could be both a physical (who can patch directly in via Ethernet) and a logical issue (who can access the wireless LAN). One thing I’ve done to get around this problem is to require the browser to be authorized for roaming access to first navigate to a very large (~50 characters), randomly-generated alphanumeric subdirectory alias (generated using the same command-line script mentioned above) that is highly improbably that some might guess. This alias can only be accessed within a single authorized IP address that I directly control. It is only then that the cookie set. This eliminates the unintentional cookie setting by casual browsing of the site from other machines behind the approved IP.
  • The regular expression to match the cookie should probably be more precise. For example, the expression as stated above could also match the string “myadmincookie=uniquevalnum2″, which technically isn’t what we want. Since we’re only dealing with cookies that should be set by our domain, it may not be that big of a deal, but it’s still a vulnerability nonetheless. If nothing else, there’s always the potential of colliding with cookies sent by other applications running on your site, so picking a unique cookie name and value is important. The %{HTTP_COOKIE} variable gets all the cookies for a given site/path as one big string, with each name/value pair delimited by a semi-colon and a space (“; “) and the name and value are glued together with an equal sign. I’m looking into a better regex to match this more precisely and I’ll update this post if I find one. I’ve updated the regex so it should match the cookie name/value pair more exactly.
  • Of course, none of this by itself can completely secure a site. In addition to this scheme, I force SSL on certain paths, deny access for all users to other paths that should never be accessed directly, and even explicitly block certain IP ranges that have attempted to hack the site. It’s not fool proof by any means, but combined with many other secure practices and mechanisms, it adds one more layer of protection, and sometimes one added layer can make all the difference.

  I welcome any feedback on how to improve this, especially if anyone knows how to get around the secure and unique cookie caveats.

  Appendium: I should also point out that this scheme should be equally usable if you place the code in your master Apache configuration file (usually something like /etc/httpd/conf/httpd.conf on UNIX clones) or in per-directory .htaccess files. I usually prefer to put such rules in the master config file, mostly because it’s more secure (outside of the document root) and only gets parsed and loaded once while .htaccess files are read and parsed each time there’s a request in that directory (or any of its subdirectories). However, that only works if you have access to the master config, which most shared hosting services don’t provide. Of course, such rules placed in an .htaccess file will only apply to that directory and its subdirectories, so you’d have to tweak the rules (such as file paths and the cookie path) as necessary.

  Update 11/20/2007: Updated cookie regex to better match the exactly name/value pair; added notes about rotating cookie values.

  Update 11/30/2007: Put cookie regex in quotes to correct avoid “bad flag delimiters” parsing errors; added advantage summary to better showcase the advantages of the scheme; updated my cookie value scheme; added highly-random subdirectory alias to avoid unintentional cookie-ing

  

• Internet, Security, Technology

  WordPress security tweaks

  October 31st, 2007 (4 years, 3 months ago) by Jeff | Permalink | 1 Core Dump

  If you guys haven’t figured it out by now, I’m been becoming quite the Internet security nut over the past few years. A thorough search of the Technology category reveals a good bit of my interests in SSH, SSL, public key cryptography, etc. Maybe I ought to experiment with subcategories and introduce a Security category under Technology….

  Anyway, WordPress usually includes some default feeds in the Dashboard after you log in, mostly from WP developers. One recent entry linked to a “geek ramblings” post about creating a secure WordPress install, which in turn references a WordPress security whitepaper over at BlogSecurity. (If you didn’t know any of these sites existed, don’t feel bad. Neither did I until today.) There’s lots of interesting reading there, especially if you’re (a) interested in securing your WordPress site and (b) you happen to be curious and/or adept enough to dabble in a number of arcane Web server settings. I happen to fit both of those criteria.

  One of the main reasons I’m mentioning this is that there might be a few changes and improvements for folks who have registered to comment. The site now redirects you to a secure SSL page on login, and your cookies will be stored in secure mode too, meaning they can’t be read unless sent over an SSL connection. This might require you to log in the next time you try to comment, even if you’ve told the site to remember you, because the old cookies won’t be secure and will need to be reset. Otherwise, you probably will never notice the difference unless you go to edit your profile, which most of you probably will never worry about once you’ve registered.

  The rest of the changes are all behind the scenes, so I won’t bother you with them. Just read the links if you’re curious. I’m experimenting with some arcane Apache mod_rewrite rules to really locking down the admin pages, all outside the scope of the links listed above, but so far those tests don’t seem to work. However, if I get them to do what I want, I might post them here (to give back to the community and all). It will be pretty sweet and borrows a few ideas from recent episodes of the Security Now! podcast (#113 specifically) to lock down access to the admin site from only certain locations or certain roaming computers.

  

• Internet, Software, Technology

  Running “Dexter”

  September 25th, 2007 (4 years, 4 months ago) by Jeff | Permalink | 1 Core Dump

  Ordinarily, I don’t go about announcing underlying technology upgrades (for example, I just upgraded iptables and Apache this morning), but I thought this was mildly amusing and I thought I’d share. As the observant among you probably know, I’m running WordPress, which just released version 2.3, nicknamed “Dexter”. It is so named after the “great tenor saxophonist Dexter Gordon.” Darn… I was being hopeful….

  

• Internet, Miscellaneous, Software, Technology

  Move complete… I hope

  July 11th, 2007 (4 years, 7 months ago) by Jeff | Permalink | 1 Core Dump

  If you’re seeing this post, then welcome to the new server! Our new host is Slicehost, a small hosting service that caters specifically to online developers. I have to say that so far, I’m pretty impressed. I had a few bumpy points getting SSH started and the initial setup was so bare-bones I had to install a ton of packages just to get functional (including fundamentals like tar and which), but it’s moving a lot faster than the old site sitting behind the cable modem.

  Slicehost does one thing that I think is really pretty slick, especially from a hard-core geek’s point of view: Unlike most web hosts who give you a little sandbox to play in and tie your hands on what you can and cannot do, the “slicers” give you your own virtual server with root access. That’s right, you have the keys to the virtual kingdom. That means you decide what gets installed on your box, from the Linux distro (no other OSes are supported at the moment, but they do offer several distros) to the individual server applications. Want a LAMP box? You got it. Prefer Fedora to Ubuntu? (Me! Me!) Here you go. You decide what gets installed. The caveat to such permissiveness, of course, is that if you screw it up, it’s your own darn fault. That’s okay, though, because your virtual server shouldn’t affect anyone else sharing the box and you can rebuild your “slice” at any time, wiping it clean and restoring it to its original pristine state. Pay a nominal extra fee and you’ve got backup snapshots that you can also restore in the case of catastrophic failure.

  One thing to watch out for is the waiting list. They appear to allocate hardware dynamically based on their current user base (keeping some servers in reserve for redundancy) and then purchase new machines based on their projected demand. If you sign up for the smallest package with the minimum prepayment plan, you could be looking at several weeks of wait time. However, if you’re willing to pay a little more in advance, you’ll be moved up the list. I decided to prepay for six months instead of three and was told I’d have my “slice” in “less than a week.” I ended up getting it in a few hours. Yep, that’s technically less than a week.

  Initial annoyances (I’m not sure I’d call them complaints):

  • It appears something was up with their Fedora repository. My initial setup did not include the SSH package, and since that’s the only remote access package installed by default (telnet and FTP are rightly left in the bit bucket) , I couldn’t log on. I contacted their support site and got a response in about an hour or so. Unfortunately, it was already getting late, so I couldn’t stay up to see if the fix they gave would work. However, I was able to log in licketty split this morning with no problems. (I then took the opportunity to lock the box down tight; this site proved quite helpful in that regard.) A small part of me cringes inside, wondering what might happen if I have to rebuild my slice and this repository isn’t working again….
  • While it’s great that they give you a clean slate to work with, they really give you a clean slate. As mentioned above, some things you just take for granted on a *NIX box like tar and gzip were nowhere to be found. I think it’s fine that I have to install MySQL, Apache, and PHP on my own; not everybody’s going to use those and they may have a database, Web server, or scripting environment they prefer over those options. But no tar? No gzip? Not even which? I lost track of how many seemingly fundamental packages I had to install, stuff I just naturally expected to be there. Not a major complaint, mind you, but an annoyance, as it took far longer to get the system to the point that I could actually function than it did to get the blog moved.

  All in all, though, I think I’m going to like this new home. If you’re interested in checking them out, click the link in the first paragraph and poke around. If you decide to sign up, though, come back here and click my referral link. A little kickback is always nice.

  Of course, now that we’ve moved, commenting should be re-enabled. If you created an account before the move, it should have been ported over. (The internal user ID numbers got switched around, but since no one was able to post after I switched to WordPress, I don’t think that really matters.) Feel free to log in and make sure your account is accessible.

  Feed readers: Please update your feed links now. You’ll find the new RSS and Atom links in the “Feed Me” section of the sidebar. Remember, the old “domain:port” URLs will no longer work.

  

• Internet, Miscellaneous, Technology

  Return of the move

  July 10th, 2007 (4 years, 7 months ago) by Jeff | Permalink | Dump Core

  Sorry for the recent silence, everyone. It wasn’t my intention to seemingly disappear for several weeks. As you might guess, it’s been entirely real life craziness keeping me hopping. There were several occasions were I actually planned to post something, only to get distracted and never get around to it.

  Well, here’s some news definitely worth posting. I mentioned quite some time ago my plans to eventually move the blog from its current home—my Linux box Demeter sitting behind my cable modem—to somewhere a bit more stable. Not that Demeter herself is unstable, mind you, but the current hoops we have to jump through just to get the blog online have caused casualties to its usefulness, like killing commenting and making our RSS/Atom feeds go through odd channels. While my dynamic DNS service does an admirable job in getting the raw HTML to you guys, it’s not suitable for a long term solution.

  The point is that it looks like the move is going to finally take place, only the final destination isn’t where I originally intended. I was planning to move to Keenspot on the back end, largely because I am already familiar with them and how their servers are set up. Of course, this also meant the blog would be loaded with ads to cover the bandwidth costs (unless, of course, you’re a Keenspot PREMIUM subscriber). Not something I’m particularly thrilled about, but I was viewing it as a necessary evil. (After all, it’s the ads (and PREMIUM) that currently keep GPF a float. Lately all our other revenue streams have been high and dry.)

  Well, Chris Wright over at Help Desk managed to change my mind. He pointed me to his current web host, and after taking a cruise around their site and FAQ, I was hooked. I have a number of ambitious online plans in the works, all of which require some rather stringent and quirky software requirements. These guys seem to cater directly to online developers, meaning they’re a lot more likely to accommodate my unusual needs, and their prices are ridiculously beyond reasonable. (I’ve never seen a bandwidth plan as cheap as theirs.) So I’m going to move over to them, at least on a trial basis, to see how things go. If everything goes over well, expect to see some rather obnoxious plugging in the future.

  So, what does this mean for you? Right now, not much. For the time being I’ve temporarily disabled sign-ups for commenting. Comments aren’t working right now anyway, and preventing anyone new from signing on should make moving the database easier. (Existing accounts should be intact once the move is complete.) The switch in the DNS should be largely transparent, so those of you who visit the site directly shouldn’t notice anything different (other than the odd nested frame set inserted by the dynamic DNS should be gone).

  The real funky stuff will come with the feeds. By now, most of you should be using the “domain:port” URLs for RSS and Atom feeds. These bypass the dynamic DNS and go directly to the web server on the port it’s really running on, not being nested through the DNS’ frames. Unfortunately, there won’t be a graceful transition for the feeds, as I have no intention of running the web server on multiple ports after the move. (It’s technically possible, but probably a waste of resources.) So those of you reading the blog via the feeds might want to come by the site periodically and check in for updates, at least until we know the transition has successfully taken place. New feed URLs will be posted once the move is complete. (Of course, I ought to just go with FeedBurner and hide all this behind-the-scenes garbage, but I’m also lazy and I’d rather do things myself.)

  So when is all this going to go down? I’m not quite sure yet. The new host has a waiting list as they allocate hardware dynamically based on demand. I’ve been told it should be “less than a week,” which could be anywhere form one to two days. Tack onto that a day or two for me to move the database and debug everything, and it could easily be a week or more before you’ll notice anything. As usual, though, you should be able to just pop in here anytime and get the latest, regardless of which host we’re currently on.

  

• Internet, Miscellaneous, Technology

  So… what happened?

  April 5th, 2007 (4 years, 10 months ago) by Jeff | Permalink | Dump Core

  Most of you are probably wondering what happened yesterday with the blog. For those who may not have seen it, folks visiting the site via a Web browser were being redirected to another site. I won’t post its URL, as I don’t particularly want to give them any more Googleshare, but it seemed to be some sort of portal site in a language I didn’t immediately recognize. Some of you have speculated that this might have had something to do with the impending move to Keenspot, or perhaps with Keenspot’s current DNS server problems. While I wish those were the case, unfortunately they weren’t.

  It looks like it was a problem with my dynamic DNS service, DNS2Go. As previously stated, DNS2Go has an HTTP redirection service that lets me forward “www.jeffdarlington.com” on standard HTTP port 80 to the site’s real IP address at its real non-standard port. This is the component that seems to have failed. Going to www.jeffdarlington.com took you to the mysterious site; however, if you went to jeffdarlington.com:8081 (the site’s real port number), you got the blog. (The style sheet didn’t work, of course, because WordPress hard codes the domain name in all URLs, including to the style sheet. But the content itself was still available.)

  I put in a support ticket last night with DNS2Go’s tech support and got the following response this morning:

  It was something on our end and we have resolved that problem.

  Not very descriptive, but accurate; the site is obviously now up. My guess? I think they were hacked, and they don’t want to admit it. Their own main domain was also down during this time, and all of my domains that used the redirection service in some fashion were affected. I haven’t had a chance to independently research this theory with the conference going on and all, but it seems a bit more suspicious to me than just a technical glitch.

  Anyway, things are back to normal now. The move to Keenspot is currently slated for the weekend of April 20th, just in case anyone is interested in knowing.

  

« Previous Entries
» Next Entries

About

Jeffrey T. Darlington is the creator of the popular online comic strip General Protection Fault. He is also the creator of a number of other inconsequential things, but seeing as they are inconsequential, he didn't think you should be bothered by mentioning them. More...

Search

Capitalism

Recent

• Weekly Twitter Updates for 2012-01-28
• Weekly Twitter Updates for 2012-01-21
• Weekly Twitter Updates for 2012-01-14
• Weekly Twitter Updates for 2012-01-07
• Weekly Twitter Updates for 2011-12-31

Tag Cloud

Twitter GPF Security Writing Technology Recycle Bin Software humor WinHasher TWiT .NET Webcomics Linux Star Wars server cookie podcast meta WordPress Microsoft Security Now Steve Gibson virtual machine Doctor Who C# mod_rewrite Fedora Wii schedule Apache Windows PHP HTTPS Star Trek blog iPod advertising To Thine Own Self hard drive comments DoubleClick authentication anniversary gifts Christmas