My Tech Notes

2014-04-10T14:49:00.000+05:30

Why it is called the Heartbleed Bug?

Bug is in the OpenSSL's implementation of the TLS/DTLS (transport layer security protocols) heartbeat extension (RFC6520). When it is exploited it leads to the leak of memory contents from the server to the client and from the client to the server.

This flaw allows an attacker to retrieve private memory of an application that uses the vulnerable OpenSSL libssl library in chunks of up to 64k at a time. Note that an attacker can repeatedly leverage the vulnerability to increase the chances that a leaked chunk contains the intended secrets.

What makes the Heartbleed Bug unique?

Bugs in single software or library come and go and are fixed by new versions. However this bug has left large amount of private keys and other secrets exposed to the Internet. Considering the long exposure, ease of exploitation and attacks leaving no trace this exposure should be taken seriously.

Is this a design flaw in SSL/TLS protocol specification?

No. This is implementation problem, i.e. programming mistake in popular OpenSSL library that provides cryptographic services such as SSL/TLS to the applications and services.

What is being leaked?

Encryption is used to protect secrets that may harm your privacy or security if they leak. In order to coordinate recovery from this bug we have classified the compromised secrets to four categories: 1) primary key material, 2) secondary key material and 3) protected content and 4) collateral.

More information: http://heartbleed.com/

“Boot to Gecko” the new Mobile OS

2012-07-04T13:57:00.001+05:30

"Boot to Gecko" is a Mobile OS being developed by Mozilla.

Its main concept is everything on it runs on web. No native apps. Anyone can build and host their App on their own server(no appstore).

Anyone can build their app in simple HTML5 and CSS(no special SDK needed like Apple or Android or WM7)… and using their WebAPI can interface with the Dialer, SMS, Camera, Bluetooth, etc.

Shell Script to retrieve Certificate

2011-07-29T18:49:00.002+05:30

Here is a helpful script I received from a friend-collegue to retrieve a SSL certificate and store it in a file in Linux.

#!/bin/sh

#
# usage: retrieve-cert.sh remote.host.name [port]
#

REMHOST=$1

REMPORT=${2:-443}

echo |\
/usr/local/ssl/bin/openssl s_client -connect ${REMHOST}:${REMPORT} 2>&1 |\

sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p'

# Use the below command to show certficates, dont use this with sed or you will only get the same output as the command above

#/usr/local/ssl/bin/openssl s_client -showcerts -connect ${REMHOST}:${REMPORT} 2>&1 |\

Mehotd to read Jar versions

2011-04-08T22:26:00.001+05:30

I have a test JSP that is used for testing the installation of the applicaiton.

I that I needed to find the versions of the Jar files that are loaded by the server. I wrote a small method in a JSP to read the Versions from the JAR files.

String readManifest(String jar) {

try {

JarFile jarfile = new JarFile(jar);

Manifest manifest = jarfile.getManifest();

java.util.Map map = manifest.getEntries();

java.util.Iterator iter = map.keySet().iterator();

String ver = "unknown";

while(iter.hasNext()){

String key = (String)iter.next();

String str = null;

java.util.jar.Attributes attr = (Attributes)map.get(key);

str = attr.getValue(Attributes.Name.IMPLEMENTATION_VERSION);

if(str == null) {

str = attr.getValue(Attributes.Name.SPECIFICATION_VERSION);

}

if(str != null) { ver = str; }

else {

ver = "unknown";

}

return ver;

} catch (Exception ex) {

return "Error:"+ex.getMessage();

}

git error: error setting certificate verify locations

2010-07-18T21:02:00.001+05:30

I am using Windows and msysgit. When I try to clone a git repo from Github I received a SSL related error.

>git clone https://someid@github.com/project/wisper.git
Password:
error: error setting certificate verify locations:
CAfile: /bin/curl-ca-bundle.crt
CApath: none
while accessing https://someid@github.com/project/wisper.git

fatal: HTTP request failed

>git config -l
http.sslcainfo=/bin/curl-ca-bundle.crt

To fix the problem change the forward slashes to backward slashes.

>git config --system http.sslcainfo \bin\curl-ca-bundle.crt

>git config -l
http.sslcainfo=\bin\curl-ca-bundle.crt

Frequently Used Maven Commands

2010-06-28T20:02:00.001+05:30

Frequently used Maven commands

# Command to Clean any previously build code
mvn clean

# Command to install
mvn install

# If you are behind a proxy then add this in the $USER_HOME/.me/settings.xml
<settings>
<proxies>
   <proxy>
      <active>true</active>
      <protocol>http</protocol>
      <host>myproxyhost.com</host>
      <port>1234</port>
    </proxy>
</proxies>
</settings>

# And for HTTPS traffic use this in the command line
mvn install -Dhttps.proxyHost="myproxyhost.com" -Dhttps.proxyPort="1234"

# For offline building (i.e. if you think you have all the required dependencies)
mvn –o install

# Command to install without executing unit tests
mvn install -Dmaven.test.skip=true

# Command to install but using a specific profile
mvn clean install -Ptomcat

# Command to use the Cargo Deploy plugin
mvn cargo:deploy

# Command to perform the release of a module
mvn -Dresume=false release:prepare release:perform

# Command to continue a release that stopped in the middile
mvn -Dresume=true release:prepare release:perform

# Command to do a Dryrun release
mvn release:prepare -DdryRun=true

# If SCM interactions are involved then below option can be used to provide a SCM Comment prefix
mvn -Dresume=false release:prepare release:perform -DscmCommentPrefix="Mvn Release 1.0:"

# Not all jar files are available in the Maven repository.
# Command to Upload a missing artifact jar into a local repository
mvn deploy:deploy-file -DgroupId=net.sf -DartifactId=jcsc -Dversion=0.98.1 -Dpackaging=jar -Dfile=JCSC.jar -DrepositoryId=thirdparty-jars -Durl=http://mavenrepo.comp.com/nexus/content/repositories/thirdparty-jars

# Command to create a maven project from an Artifact
mvn archetype:create -DgroupId=com.mycompany.myapp -DartifactId=basic-webapp -DarchetypeGroupId=org.apache.maven.archetypes -DarchetypeArtifactId=maven-archetype-webapp -DremoteRepositories=http://repo1.maven.org/maven2

# Command to check the version of maven plugin being used
mvn -Dplugin=install help:describe -Ddetail

# Command to Generate dependency tree
mvn dependency:tree -Doutput=dep-tree.txt

# List all dependencies of this project
mvn dependency:list

# Command to generate Site documentation
mvn site:site

# Commands to generate specific reports
mvn site:site -DgenerateReports=false -Dmaven.test.skip=true
mvn project-info-reports:summary -Dmaven.test.skip=true
mvn project-info-reports:scm project-info-reports:issue-tracking project-info-reports:index -Dmaven.test.skip=true

# Commands for various other reports
mvn taglist:taglist
mvn javancss:report
mvn dashboard:dashboard
mvn jdepend:generate
mvn changes:changes-report
mvn changes:jira-report

yum install MySQL - Remote Access

2010-06-22T14:13:00.001+05:30

This post explains all the steps needed to install Mysql on Linux(RedHat, CentOS, Fedora) and configure it to access db from remote machines.

Install Mysql Client

$ yum install mysql

Install Mysql Server

$ yum install mysql-server

Upgrade Mysql Installation

$ mysql_upgrade

$ mysql -u root
mysql>

List the grants this user has

mysql> SHOW GRANTS;

Grant all privileges to login as root from any remote machine

mysql> GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED BY 'password' WITH GRANT OPTION

APSRTC Online Booking - comments

2010-06-16T17:49:00.001+05:30

Finally APSRTC started Online Ticket Booking.

http://www.apsrtc.in/APSRTCOnline

Application's response is pretty fast (may be because there is no traffic?)
My observations:
* There is no SSL during login, hope their payment gateway is secure.
* Its a struts based Java app running on IBM Websphere
* Left the default apps running: http://www.apsrtc.in/hitcount
* Developers dont know the difference between HTML comments and JSP comments. View source of the home page shows lot of commented HTML code.
* Uses struts validator framework for validations on serverside and client side. Smart way to avoid load on the server and do all validations on client first.
* While searching for From and To location, just enter % and you get all locations.

Enhance Google Reader

2010-06-11T11:40:00.001+05:30

Enhance/Customize the appearance of Google Reader with the below Firefox plugins.

http://userscripts.org/scripts/show/12917 (Need Grease Monkey plugin)
http://userscripts.org/scripts/show/26859 (Need Grease Monkey plugin)
https://addons.mozilla.org/en-US/firefox/addon/748 (Grease Monkey)
https://addons.mozilla.org/en-US/firefox/addon/6424/ (Better GReader)

Access Mercurial Hg via Proxy server

2010-05-03T17:42:00.001+05:30

Accessing BitBucket Mercurial repository via Proxy server.

Create a ".hgrc" file in HOME directory.
Edit the file and add the proxy server details

[http_proxy]
host=myproxyserver.mycompany.com:1234

Free SOAP web services

2010-04-23T15:07:00.000+05:30

Here are some SOAP web services available for free for testing.

Google Search RSS: http://www.ecubicle.net/gsearch_rss.asmx?WSDL

Random Bushism: http://greg.froh.ca/fun/random_bushism/soap/index.php?wsdl

Random Google Search: http://www.ghettodriveby.com/soap/index.php?wsdl

Currency Converter: http://www.webservicex.net/CurrencyConvertor.asmx?WSDL

Send SMS: http://www.aswinanand.com/sendsms.php?wsdl

More free/paid services @ http://soatrader.com/web-services/

Configuring Jetty in pom.xml

2010-04-05T01:35:00.001+05:30

To instantly run your java webapp after compiling, configure Jetty in pom.xml. This doesn't need an installation of Jetty server.
Jetty will be automatically downloaded, and your app will be deployed and server starts.

How to configure Jetty?
For those who are wondering "then how do I configure my server", here is the option. Copy the "webDefaultXml" from the jetty jar and add it to your resources. Now pass the location of the "webDefaultXml" to Jetty plugin.

<plugin>
    <groupId>org.mortbay.jetty</groupId>
    <artifactId>maven-jetty-plugin</artifactId>
    <configuration>
        <scanIntervalSeconds>10</scanIntervalSeconds>
        <webDefaultXml>src/main/resources/webdefault.xml</webDefaultXml>
    </configuration>
</plugin>

What you can configure in webDefaultXml?
A sample of options that you can configure:

Directory Listing
gzip Compression
Memory mapped File buffer (updating this to false will fix your CSS and Image lock issue)
Cache Control
Servlet Mapping URL patterns (If you have a url that you want to be processed like *.jsp)

Using Bitbucket and Mercurial

2010-03-31T00:10:00.001+05:30

Pre-requisites for this Tutorial

An Account in BitBucket.org
Install Mercurial from here

How to get the Code

Use the below command to get the source to your local.

$ hg clone https://USERID@bitbucket.org/REPOPATH/

How to make changes

Once you have the code on you local computer. You are free to make changes. And once in a while if you want to commit your changes then use the below command to commit to the local repository.

$ hg commit -m "comments" -u USERID

Remember: The above commit is local only. It will not be reflected in the bitbucket repository.
To publish you changes for everyone to see, use push command.

$ hg push

How to get changes from remote repo

To get changes made in Remote(bitbucket) to local repository.

$ hg pull
$ hg merge tip

For more detailed guide see here.

Have fun!

Gravatar - A Globally Recognized Avatar

2010-03-23T16:16:00.002+05:30

A Globally Recognized Avatar

Gravatar is an image that follows you from site to site appearing beside your name when you do things like comment or post on a blog. Avatars help identify your posts on blogs and web forums, so why not on any site?

How it works

Url: http://www.gravatar.com/avatar/3b3be63a4c2a439b013787725dfce802?s=80

The URL always begins with http://www.gravatar.com/avatar/ and the next part is the hexadecimal MD5 hash of the requested user's lowercased email address with all whitespace trimmed. Hashing is done to prevent spambots from harvesting e-mail addresses.

Parameters:

Parameter "s" will fetch image of size 80x80 (example: s=80)
Parameter "g" will fetch image if it is rated G (example: r=g, r=pg)
Parameter "d" will fetch a default image if there is no gravatar associated with an email address (Example: d=wavatar, d=404)

Technology Details:

- Initially developed in Ruby on Rails now in PHP.
- Uses nginx (fourth most popular) as Webserver
- Photos are served from Amazon S3 Cloud

"The way that images were stored originally was: a complete image was made for all sizes between 1×1 and 80×80 pixels, a directory made for each rating, and a symlink placed from the rating to the appropriate image (either the users image or the default image in case the rating was too high.) So that's 80 images, 5 directories, and 240 symbolic links. The reason for this, I believe, was to attempt to serve the avatar content without any database interaction whatever. The files were then archived, uploaded to Amazon S3, and an entry added to Amazon SQS. Finally the SQS entry was retrieved by the serving server, the file downloaded, extracted, and placed on the filesystem. So this is why it took several minutes once you uploaded and cropped your image for you to be able to browse the rest of the site again. You can imagine how many files Gravatar was comprised of by the time we got a hold of it! We knew that this would simply NOT work for our new 512×512px avatar sizes. Lastly there were a couple of directories which had several hundred thousand entries (either files or other directories) which were nearly impossible to even get a listing inside of. So we had a list of things NOT to do. We just needed to figure out what TO do

So we decided that we would render all our avatars dynamically from the highest quality copy of the image we can manage… down. We would only store one version of the image, though we would store it in multiple places (a local file server for speed, and S3 for redundancy.) We would still rely heavily on caching. And we would asynchronize as much of the workload as was possible, so that you don't have to wait for things to happen after you finish cropping (to do this we employed various techniques and hacks best left for another day and another story.)

Gravatar now lives on about 20 servers: 2 Database servers, 1 File server, 2 Load balancers, 5 Caching servers, 9 Web servers, and 1 Development server. That combination of servers is handling an average of 7,214 of your requests every second of every day. That's a whopping 623,293,056 requests daily! 96% of all of those requests are served directly from cache. These days we get around 5,000 uploaded images every day."

Unique Avatar Icon Generators based on Email address

identicon wavatar monsterid

Gravatar Rocks.

"Unknown Source" in Stacktrace

2010-03-23T15:48:00.001+05:30

When compiled java source with Ant any Exception thrown from these compiled classes doesnt show line numbers. This seems to be a default setting in Ant.
http://ant.apache.org/manual/CoreTasks/javac.html

BUILD FAILED
java.lang.NullPointerException
at com.mycompany.myapp.MyClass.doSomething(Unknown Source)

To get back the line numbers in the Exception Stacktrace add the below options to the javac task.

debug="on"

Creating Web Applications from Scratch

2010-03-09T00:10:00.002+05:30

Archy is a useful tool I came across which can be used to create blank web applications.

http://code.google.com/p/archy/

This tool becomes extremely handy as it includes all the necessary web.xml configuration and some sample code to start with.

And its very easy to use also. I recommend all starters to use this tool to create their application base.

Maven: See deprecated API usage warnings; commandline

2010-03-08T12:21:00.002+05:30

Maven command line option to see the warnings for deprecated code usage.

mvn clean compile -Dmaven.compiler.showDeprecation=true

http://maven.apache.org/plugins/maven-compiler-plugin/compile-mojo.html

Grep gz files in Unix/Linux

2009-12-08T17:08:00.002+05:30

ZGREP

NAME
zgrep - search possibly compressed files for a regular expression

SYNOPSIS
zgrep [ grep_options ] [ -e ] pattern filename...

DESCRIPTION
Zgrep is used to invoke the grep on compressâed or gzipâed files. All options specified are passed directly to grep. If no file is
specified, then the standard input is decompressed if necessary and fed to grep. Otherwise the given files are uncompressed if neces-
sary and fed to grep.

If zgrep is invoked as zegrep or zfgrep then egrep or fgrep is used instead of grep. If the GREP environment variable is set, zgrep
uses it as the grep program to be invoked. For example:

for sh: GREP=fgrep zgrep string files
for csh: (setenv GREP fgrep; zgrep string files)

AUTHOR
Charles Levert (charles@comm.polymtl.ca)

SEE ALSO
grep(1), egrep(1), fgrep(1), zdiff(1), zmore(1), znew(1), zforce(1), gzip(1), gzexe(1)

-----------------
Example:
zgrep "ERROR" *.gz

Performance Tuning for firefox

2009-12-08T17:06:00.002+05:30

Firefox has Memory issues. If the browser is kept open for a while, even if I close all tabs except one Firefox doesn't clear the memory that it occupied. In my case I kept the browser open for more than a day; 2 windows with 4 tabs each. From the second day onwards it takes up more than 512Mb of memory and even typing becomes slow.

I found this article that explains how to fix the memory leak issue in firefox. Its basically tuning for better performance.

http://www.detector-pro.com/2008/04/how-to-fix-firefox-memory-leak-problem.html

Hope this helps you.

Google Chrome OS Screenshots

2009-11-22T00:06:00.007+05:30

Auto Generate JUnit Test Cases

2009-11-14T00:45:00.003+05:30

If you are starting fresh with using JUnit and writing Unit Testcases, then this tool will be very handy.

We currently already use JUnit, however we didnt write testcases for the POJOs. Now the code had grown so much we now have lot of POJOs and our coverage looks very dull.

The advantage of this tool is it not only generates skeleton test cases, for POJOs with just setter and getters, it actually generates Testcases also.

JUnit Code generation tool: http://www.junitdoclet.org/

Eclipse plugin using this doclet: http://sourceforge.net/projects/e-junitdoclet/

Example:
JUnitDoclet.1.0.2>junitdoclet.bat -d out -sourcepath C:\mymodule\src -package com.my.package

Very cool tool and I am gonna use this a lot. Thanks to JUnitDoclet Team.

JS: Calculate Browser window Height

2009-07-03T14:57:00.001+05:30

Calculating browser window size using Javascript is not straight forward. There are many properties to check for and each property behaves differently in each version of Browser.

Following are various properties available to get Browser window width and height:

window.innerHeight/window.innerWidth
window.outerheight/window.outerwidth
document.body.clientHeight/document.body.clientWidth
document.documentElement.clientHeight/document.documentElement.clientWidth

Now if you want to calculate the window width and height you'll have to write javascript that checks the browser type and gets the width and height.

Fortunately for us Mark has already written a script that works in any browser. Here it is... http://www.howtocreate.co.uk/tutorials/javascript/browserwindow

Thank you Mark!

Eclipse Shortcuts

2009-01-19T15:31:00.002+05:30

Eclipse shortcuts for everyday development.

Ctrl+Shift+R

Open any Resource in the workspace.

Ctrl+Shift+T

Open a Java Class. Also supports abbreviations, example: BIS gives BufferedInputStream, NPE gives NullPointerException

Connecting Apache and Tomcat using mod_jk

2008-12-19T15:46:00.001+05:30

Aim of the Task: Connect Apache Http Server 2.0.63 with Tomcat 5.5

My Apache is running at 80 and Tomcat running at 8080. I have an application running in tomcat at url http://localhost:8080/examples and after this configuration I should be able to access the application through Apache.

1) Download mod_jk

Download the mod_jk module from the following location.

http://www.apache.org/dist/tomcat/tomcat-connectors/jk/binaries/win32/jk-1.2.27/mod_jk-1.2.27-httpd-2.0.63.so

Copy this file to Apache modules directory.

2) Create worker.properties

Create worker.properties in the Apache conf directory and paste the following default content in it.

# Define 1 real worker using ajp13

worker.list=worker1

# Set properties for worker1 (ajp13)

worker.worker1.type=ajp13

worker.worker1.host=localhost

worker.worker1.port=8009

3) Generate mod_jk.conf

This file is auto generated by the Tomcat. Add the following line in the server.xml of Tomcat under the <Server> root tag.

<Listener className="org.apache.jk.config.ApacheConfig" modJk="APACHE_INSTALL_DIR/modules/mod_jk-1.2.27-httpd-2.0.63.so" workersConfig="APACHE_INSTALL_DIR/conf/workers.properties" />

Note: Replace APACHE_INSTALL_DIR with the complete location of the Apache Installation Directory.

Start the tomcat server and if everything is ok then Tomcat will generate the mod_jk.conf under the directory Tomcat5.5/conf/auto.

4) Modify httpd.conf

Now open the httpd.conf file and load this conf.

Include tomcat-5.5/conf/auto/mod_jk.conf

5) Configure Tomcat applications for Apache

Add the following lines to configure how Apache uses JK module.

# Send everything for context /examples to worker named worker1 (ajp13)

JkMount /examples/* worker1

DONE.

Now start Apache and access the examples url without port. Ex: http://localhost/examples

Tech Jargon - 16 Dec 2008

2008-12-16T12:53:00.001+05:30

Content Delivery Network - A network of Servers delivering cached content (generally images, flash and scripts) to improve performance of a site.
Akamai - A leading CDN company providing services to comapnies like SONY, Yahoo and Microsoft.
Embryonic Connection - A TCP connection which is not completely established.
Terracotta - is an open source JVM-level clustering software for Java. It delivers clustering as a runtime infrastructure service, which simplifies the task of clustering a Java application immensely, by effectively clustering the JVM underneath the application, instead of clustering the application itself.