David Sirr's ...stuff

Apple's Java update 4 breaks ColdFusion 8

Mon, 27 Jul 2009 10:20:12 GMT

My Day job's production servers are based on Apple X-Serve and OSX as the operating system.

In a bid to get greater service stability last week we decided to roll out the latest system updates, notably upgrading to OSX 10.5.7

We rolled out first to our staging server which is effectively a mirror of production setup, it went smoothly and we tested our several critical apps and all seemed fine.

So we also ran all the additional system minor updates including Apples Java Update 4, as running this on my dev machine had resolved several issues with the java imaging libraries crashing the server while trying to process images with certain colour profiles etc.

Again all seemed good, so we rolled out to the live server. All went fine, or so we thought.

Co-incidently around this time i was experimenting on my dev machine (also 10.5.7 with java updater 4) with recently released google API components without much luck, i was constantly getting "I/O Exception: peer not authenticate" error when trying to connect to googles API. I thought it's just my machine playing up again...

A few days later clients using two seperate applications reported general application errors, after some digging around i traced both errors to CFHTTP calls in each application.

I tested the urls in the browser on the server and both were responding as expected... strange i thought...

So i noticed that both were SSL URLs and the error was "I/O Exception: peer not authenticate", which i then immediately connected back to the troubles i had connecting to googles API on my dev box. After some research on that error, it appeared that previously this error occured with connections to SSL URLs with certs issued by intermediate CAs which weren't present in the trusted CA keystore in the JVM. But google and our other API providers were using the most expensive CA's (thawte, verisign, etc) top level certs, which were definitely present by JVM 1.6 so this couldn't be the same issue.

At this point i asked a co-worker who was only on Java Update 3 to try the same code, or really a CFHTTP to any SSL URL. It worked as expected without error. Bugger.

Unfortunately apples java updates work via patching so there is no rollback or uninstall! In desperation we tried a developer preview of java update 5 on the also broken staging server, with the result that coldfusion no longer even starts up at all :(

So the only resolution was to restore our 10.5.2 pre-update backup and then re-upgrade to 10.5.7 without applying the java update 4.

This worked. We are happy for now! But i'd love to know the solution for this update 4 issues as my dev machine is still broken until i can find time to format and reinstall everything...

So, is anyone out there running OSX 10.5.7 and applied java update 4 and connect CFHTTP calls to SSL servers?

Please let me know!

Errors with CFIMAGE and CF8 image functions

Sun, 14 Sep 2008 13:05:12 GMT

We are running coldfusion 8 enterprise in multi-instance mode on JRUN, and we are trying to do auto image processing for uploads to convert to a standard JPG format in thumbnail and large sizes... pretty standard stuff IMHO. The problem is that CF8's new image functions completely barf on certain types of images, including greyscale gifs, jpegs with funny colour profiles or jpegs with non-72 dpi. This would manifest in either jrun bombs or simple resizes of images taking longer than 5 minutes to process instead of the usual < 5secs. This understandably lead to a loss of confidence from the users of the systems when our fancy new upgrade was so painfully slow. After much frustration we fixed some of the complete bombs happening after reading some of the great tips in this post, but we still had the long processing times to deal with. After some trial and error the way we got around it was as follows:

Use cfimage to read in the uploaded file
Use cfimage to save as PNG. this is the great part! saving as PNG converts the image to 72 dpi and seems to strip the erroneous colour profiles :) and doesnt affect the quality of the image
Use cfimage to read in the new PNG
Do what needs doing
Delete the PNG
Celebrate your fast and cool utility

Using this intemediary convert to PNG step literally took the processing time from 5 mins to 10 secs for the worst case JPG file we could find

5 min Subversion (SVN) Server on windows

Fri, 25 Jul 2008 01:12:10 GMT

So i've been using subversion for years at my various jobs and have found itÂ indispensable. So i rightly thought, "how come i'm not just using this at home on my small projects and playground apps?"

It was time to fix this scenario and install SVN server on my home server (which is fine as it has a static internet IP and backup, so it's quite usable).

By far the simplest and most usable option i found for installing SVN server on windows isÂ VisualSVN Server.

It was installed, and with its simple GUI, users created in groups and assigned to new repositories in under 5mins! It even has a secure apache rolled in for websvn that you can easily configure to a non-standard port.

There is really no excuse anymore for not giving yourself all the luxuries that SVN affords you.

eXtreme Programming

Thu, 24 Jul 2008 06:01:14 GMT

Free server monitoring with alerts!

Thu, 10 Jul 2008 00:30:04 GMT

So i am googling around looking for a free server monitoring solution to play with and come across this nifty (yet ugly) site:Â http://www.servermojo.com

Looks aside, it's got some pretty cool functionality such as: free!, can add unlimited sites, has a few monitoring methods (i chose http+keyword), has basic charts, will do email alerts, and even twitter alerts (which translates to free sms alerts via twitter!)

So you could potentially setup a few different pages like ping_apache.htm and ping_coldfusion.cfm both with just a single keyword in the file and then you could easily see if you had an alert on the ping_coldfusion and not the ping_apache that it was a jrun problem and not a server level.

Worth checking out at least, i'll post if i see any negative performance with it

Apache 2.2.x openSSL CSRs on Windows

Mon, 07 Jul 2008 02:48:56 GMT

When i went searching for info on generating CSRs (certificate signing requests) to get an SSL cert to use in apache+openSSL i was met with a sea of confusion, i think mostly surrounding the fact there wasn't a pre-compiled offical win32 binary of apache installer with openSSL baked in, requiring a lot of manual fudging. After a bit of research the process is now really quite trivial: Download the apache 2.2.9 with openSSL (mod_ssl) from apache Now the regular command you'd use to generate a non-passphrase private key and CSR will not work the same in windows as it's looking for a config in a unix path /usr/ so you need to specify the full path to the openssl.cnf file (found in the apache conf dir) Open up a cmd window and cd to your apache bin folder then enter the following (changing the url and company details):

openssl req -new -nodes -keyout www_mysite_com_au.key -out www_mysite_com_au.csr -subj "/C=AU/ST=New South Wales/L=Sydney/O=My Company/OU=IT/CN=www.mysite.com.au" -config "C:/Program Files/Apache Software Foundation/Apache2.2/conf/openssl.cnf"

This should leave two new files www_mysite_com_au.key and www_mysite_com_au.csr which you copy to your conf folder for referencing in your ssl configs as noted in the docs and ssl sample conf To get your key signed, go to a certificate issuer and cut and paste the contents of the .csr file Too easy!

New ColdFusion 8.0.1 instances in OSX Leopard

Wed, 09 Apr 2008 04:59:42 GMT

Creating the new coldFusion instance

login to the main coldfusion administrator (e.g. http://localhost/cfide/administrator)
go to enterprise manager / instance manager
select 'add new instance'
enter a server name (e.g. 'newcfusion')
leave server directory as default (/Applications/JRun4/servers)
leave create from EAR/WAR blank
submit form and wait for everything to finish
the link you are provided to continue will probably be broken so ignore and click on 'instance manager' again
open the /Applications/JRun4/ColdFusionLauncher.app and select your instance and click start if it is not running already
click the button next to your instance name to launch the adminstrator and configure your instance (e.g.http://localhost:8301/cfide/administrator)

Hooking the new instance into a specific apache website

For and apache website to talk to a specific jrun (CF) instance you need to bind an apache virtual host to a jrun proxyport for your coldfusion instance

make sure the admin jrun instance is started
browse to http://localhost:8000 and login with admin and the administrator password you gave when installing coldfusion
click the new instance from the left nav, and click services
you then need to note down the proxyPort (e.g. 51000) and click the green play button to start the proxyService
open up the httpd.conf or the apache vhost site config file and inside your <virtualHost> add:

# override the default bootstrap in the httpd.conf to bind to my new coldfusion instance JRunConfig Bootstrap 127.0.0.1:51000

restart apache after the cfinstance is running and it should now be using the new instance

Autostarting your new instance at system boot

You need to use a program like smultron to edit the file ColdFusion8Multi in /Library/StartupItems/ColdFusion8Multi and add: su $RUNTIME_USER -c "$CF_DIR/bin/jrun -stop newcfusion" under the line su $RUNTIME_USER -c "$CF_DIR/bin/jrun -stop cfusion" in the if block, and also outside the if block: su $RUNTIME_USER -c "$CF_DIR/bin/jrun -start newcfusion >& $CF_DIR/logs/newcfusion-event.log &" basically the same lines already present in ColdFusion8Multi but replace cfusion with your instance name, also make sure the log file has write permission!

Setting up a new ColdFusion server on Leopard - Part 3

Thu, 20 Mar 2008 01:14:53 GMT

This being my first attempt at setting up a leopard webserver i was getting a tad frustrated with apache and the SSL setup for one of the websites. Everytime I dropped in the site's config the server wouldn't start, giving a bad passphrase error in the console. Not being able to find an option for this in my SSL config I was going around in circles and getting scared that this would be a show-stopper for our new server, especially after reading so many forum posts saying that SSL in leopard was a nightmare requiring custom builds of apache and openSSL etc... Salvation was found in the Server Admin tool... despite the fact that once you start manually editing the virtual host site files the lovely web config panel ceases to recognise any of your sites, there is a quite useful 'Certificates' button when you select the root node of your server. I had already copied all the related cert files from the 10.4 server to /private/etc/certificates, so it was then a simple matter of choosing the import certificate option and figuring out which files to put in what box. My files ended up being:

certificate file (*.crt)
private key file (*.key)
certificate authority file (*.chcrt)
private key passphrase (this was the thing that instantly fixed it for apache)

From here it worked like a dream! I hope this will save similar worry to some of you out there...

My Open Source Projects

Tue, 18 Mar 2008 08:30:55 GMT

I've just added a new section in the pages area of the blog with detail of my open source projects that will be kept up to date. So far i've only put up CFGrowl project, but more to come!

When is “Beta” just a lame excuse?

Fri, 14 Mar 2008 11:29:11 GMT

When you're the author of second-life. I've recently had to write an applicationÂ for work to manage registrations to a private island in second-life. It worked fantastically in development and interfacedÂ second-life's beta registration API. The problem is that when we launched it we had reports from users that it was throwing errors for hours at a time and would come back randomly, always with the same malformed response error. This is a reasonably high profile project in the education arena with many schools from all over the world participating and second-life staff were involved in the inception phase. So when we logged a support ticket to plead for assistance their staff closed it immediately with, "this is known beta product and we do not support it". Nice response guys! Examination of their API wiki shows it's been in beta for well over 2 years!! As a developer how do they expect us to even bother looking at their platform as being viable when there is no support and no endpoint in sight. A highly disappointingly experience all round...

Coolest Keyboard Ever!

Thu, 13 Mar 2008 12:00:05 GMT

I've just seen the coolest keyboard ever! It's called the Optimus Maximus and each key has it's own LCD so you can assign any image or character to the keys, it'd be perfect for foreign layouts or hotkeys in applications or gaming layouts etc... Main drawback is it's hefty pricetag of about US$460, which is a bit rich for me! Even more amazing is their future concept keyboard

PS3 Review: Call of Duty 4

Thu, 13 Mar 2008 08:26:12 GMT

Amazing game. There seems to be so much hype surrounding this game that it's be seemingly impossible to live up to it... but it does! In case you've be living in a hole, the Call of Duty (CoD) series are first person shooter war games. CoD 4 is the latest installment and is based in the current era and gameplay revolves around playing either terrorists, American marines or British SAS. The single player is fast paced, engaging, diverse, and well worth the effort. But for most people the real drawcard of this game is the online multiplayer with the goal being to level up your character as high as possible, completing challenges and milestones along the way to unlock new weapons, accessories, power-ups, challenges, and game modes. Despite sometimes encountering high latency when connecting to American servers from Australia, the game is best described as digital crack! The ever enticing next level-up being only a few hundred points away draws you into endless successive games, and the game becomes that much more enjoyable as you unlock powerful weapons and scopes for easier aiming, and perks which are like super powers. It's also one of the best looking FPS games i've seen so far on PS3 and the controls are reasonably well laid out and easy to adjust to, not making gameplay like solving a rubicks cube. Overall we'll worth checking out if you into FPS or multiplayer gaming. P.S. check out this hilarious review of the game by zero punctuation

Music Review: Kimya Dawson

Wed, 12 Mar 2008 10:00:06 GMT

After watching Juno the other day, my wife and i were both amused and interested by the quirky music in the soundtrack, so i obtained a copy and was duly impressed by Kimya Dawson's songs in particular, and in turn obtained Remember That I Love You, which features many of the songs that were in Juno. I can highly recommend this album if you like that sort of acoustic lyrical randomness, and on closer listening the songs have a much deeper subtext and you can really appreciated Kimya's song writing skills.

Essential Software List

Wed, 12 Mar 2008 08:58:31 GMT

I've added an essential software list to this blog that contains a list of software that i use daily in my web development and a second list of more general apps i can't live without. This is a great resource if you are new to a Mac dev environment and aren't sure what apps to use on OSX! I plan on keeping this list up to date whenever i find any awesome new apps

Setting up a new ColdFusion server on Leopard - Part 2

Sat, 08 Mar 2008 09:06:38 GMT

ARGH!!!! a so much time wasted... on what? One Apache virtualhost rewrite section :( Problem: enabling friendly URLs in wordpress Supposed Solution: cut and paste sample apache code from wordpress admin

RewriteBase / RewriteEngine On RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule . /index.php [L]

Frustration: Multiple random frigged up errors that require pulling all my hair out, wasting a couple of hours, and reading countless useless articles on google Salvation: Doubting leopard server / Apache's ability to parse plain text in a simple and logical fashion, I manually typed every line of the sample code verbatim rather than copy/pasting any of it. and... it works like a charm... so to reiterate... ARGH!!!! Lessons learned: type your code, even though it may take longer it may be shorter in the long run! also, if you want to use rewrite within a virtualHost instead of a .htaccess, you need to be inside a <directory> to use the RewriteBase which will help keep your assets working correctly after a rewrite. Lastly use blogcfc instead of wordpress! (i would be if only blogcfc had this lush hemmingway theme :) )