Official Rebrand Software Blog

Safely use IndexedDB in iOS 8

2015-03-06T12:19:00.000-08:00

I'm in a situation where users of my app ScoreGeek are filling up the 5MB limit imposed on LocalStorage and I need to switch to IndexedDB.

Upon making the switch I found that iOS and IndexedDB is seriously buggy when it comes to non-unique keys (it deletes values across separate tables if they share the same key... jaw dropping bad bug).

I have a workaround that does essentially this:

1) Whenever you set an object from IDB you pass the existing object ID and the table name

2) The table name, original ID and variable type are used to create a unique string

3) The unique string is used as the new key. The original key is appended to the object as "origKey".

4) When you get an object you pass the table name and key again. That is used to find the object. Then the "origKey" value is set back to the keypath and the object is returned.

Using this method no two tables will ever have the same key, so the iOS bug is avoided.

If you must sort numerically by ID then you will want to create an Index for origKey and sort using that. You can also create a KeyRange for origKey to find specific values or ranges.

Hopefully this will help other people who are pulling their hair out over this. I have tried to comment out any lines that are specific to my code (like the Toast.toast stuff) but I haven't run this code standalone.

Here is the code:

var idbConvertId = function(id, table) {

var s = "?";

var sKeyPath;

if (typeof id === "string") {

s = "s";

sKeyPath = id;

} else if (typeof id === "number") {

s = "n";

sKeyPath = id.toString();

}

sKeyPath = sKeyPath.replace(/\//g, "[[[fs]]]");

id = table + "/" + s + "/" + sKeyPath;

return id;

};

idbRevertId = function(obj, keyPath) {

obj[keyPath] = obj.origKey;

delete obj.origKey;

return obj;

};

var idbSetObj = function(obj, table, callback) {

var value = JSON.parse(JSON.stringify(obj));

var db = myIndexedDB.db;

if (db) {

try {

var trans = db.transaction([table], "readwrite");

var store = trans.objectStore(table);

var keyPath = store.keyPath;

value.origKey = value[keyPath];

value[keyPath] = idbConvertId(value[keyPath], table);

var request = store.put(value);

trans.oncomplete = function(e) {

callback(true);

};

trans.onabort = function(event) {

var error = event.target.error; // DOMError

if (error.name == 'QuotaExceededError') {

// Fallback code comes here

Toast.toast("Storage quota exceeded, some data was not saved");

} else {

Toast.toast("Transaction " + err.name + ": " + err.message);

//console.log(err);

}

};

request.onerror = function(e) {

Toast.toast("Request " + err.name + ": " + err.message);

callback(false);

};

} catch (err) {

Toast.toastMiniLong("Store " + err.name + ": " + err.message);

CloudAll.abort = true;

callback(false);

}

} else {

callback(false);

}

};

var idbGetObj = function(id, table, callback) {

var db = myIndexedDB.db;

if (db) {

var trans = db.transaction([table], "readonly");

var store = trans.objectStore(table);

var keyPath = store.keyPath;

var keyRange;

id = idbConvertId(id, table);

keyRange = IDBKeyRange.only(id);

var cursorRequest = store.openCursor(keyRange);

var ret;

cursorRequest.onsuccess = function(e) {

var result = e.target.result;

if (result) {

ret = result.value;

ret = idbRevertId(ret, keyPath);

callback(ret);

} else {

callback(null);

}

};

cursorRequest.onerror = function(e) {

callback(false);

};

} else {

callback(false);

}

};

var idbFindObjs = function(tableName, keyRangeObj, indexName, maxRecords, sortOrder, callback) {

var count = 0;

var max;

if (maxRecords === 0) {

max = 100000000;

} else {

max = maxRecords;

}

var objs = [];

var db = myIndexedDB.db;

var ret;

if (db) {

var trans = db.transaction([tableName], "readonly");

var store = trans.objectStore(tableName);

var keyPath = store.keyPath;

var cursorRequest;

if (!indexName) {

cursorRequest = store.openCursor(keyRangeObj, sortOrder);

} else {

var myIndex = store.index(indexName);

cursorRequest = myIndex.openCursor(keyRangeObj, sortOrder);

}

cursorRequest.onsuccess = function(e) {

var result = e.target.result;

if (result) {

ret = result.value;

ret = idbRevertId(ret, keyPath);

objs.push(ret);

count++;

if (count < max) {

result.continue();

} else {

callback(objs);

}

} else {

callback(objs);

}

};

cursorRequest.onerror = function(e) {

callback(Globals.empty);

};

} else {

callback(Globals.empty);

}

};

var idbFindObjKeys = function(tableName, keyRangeObj, indexName, maxRecords, sortOrder, callback) {

var count = 0;

var max;

if (maxRecords === 0) {

max = 100000000;

} else {

max = maxRecords;

}

var objs = [];

var db = myIndexedDB.db;

if (db) {

var trans = db.transaction([tableName], "readonly");

var store = trans.objectStore(tableName);

var cursorRequest;

if (!indexName) {

cursorRequest = store.openCursor(keyRangeObj, sortOrder);

} else {

var myIndex = store.index(indexName);

cursorRequest = myIndex.openCursor(keyRangeObj, sortOrder);

}

cursorRequest.onsuccess = function(e) {

var result = e.target.result;

if (result) {

objs.push(result.primaryKey);

count++;

if (count < max) {

result.continue();

} else {

callback(objs);

}

} else {

callback(objs);

}

};

cursorRequest.onerror = function(e) {

callback(Globals.empty);

};

} else {

callback(Globals.empty);

}

};

var idbDelObj = function(id, table, callback) {

var db = myIndexedDB.db;

var trans = db.transaction([table], "readwrite");

var store = trans.objectStore(table);

var keyPath = store.keyPath;

var new_id = idbConvertId(id, table);

var request = store.delete(new_id);

trans.oncomplete = function(e) {

callback(true);

};

request.onerror = function(e) {

callback(false);

};

var idbDelObjs = function(tableName, keyRangeObj, indexName, maxRecords, callback) {

var a;

var id;

idbFindObjKeys(tableName, keyRangeObj, indexName, maxRecords, 'next', function(keys) {

var l = keys.length;

var delIt;

delIt = function(id, tableName) {

idbDelObj(id, tableName, function(success) {});

};

for (var i = 0; i < l; i++) {

a = keys[i].split("/");

id = a[2];

if (a[1] === "n") {

id = parseInt(id, 10);

}

delIt(id, tableName);

if (i === (l - 1)) {

if (callback) {

callback(true);

}

if (l === 0) {

callback(true);

}

});

};

And here are some of the ways I 've been using it:

this.findAllLocations = function(callback) {

var tableName = "Locations";

var keyRange = null;

var indexName = null;

var maxRecords = 0;

var sortOrder = 'next';

idbFindObjs(tableName, keyRange, indexName, maxRecords, sortOrder, function(results) {

callback(results);

});

};

this.deleteLocationById = function(name, callback) {

idbDelObj(name, "Locations", function(success) {

callback(success);

});

};

this.findBreakdownByScore = function(score_id, callback) {

var tableName = "Breakdowns";

var id = idbConvertId(score_id, tableName);

var keyRange = IDBKeyRange.only(id);

var indexName = 'scoreId';

var maxRecords = 0;

var sortOrder = 'next';

idbFindObjs(tableName, keyRange, indexName, maxRecords, sortOrder, function(results) {

callback(results);

});

};

How to Preload Audio in PhoneGap

2014-10-15T19:35:00.000-07:00

I just spent days making a simple buzzer in an iOS app! You push a big red button and it plays a buzzing sound.

Actually, it took about 20 minutes to get it working, but there was a 1-2 second pause after pushing the button before the sound would play, which is unacceptable.

So of course I googled Preload Audio Phonegap and the found a bunch of plugins that claim to do that. Implementing them was time consuming and no matter what I did I just couldn't get them working.

Then I thought: I wonder what will happen if I just play the file once at zero volume to preload it?

Well, folks, that's all it took. I feel so foolish for wasting my own time; maybe this post will help you not waste yours.

function playAudio(src, preload) {

//requires Cordova Core Media plugin

//src is the path to the file in your www folder

// for example, audio/buzzer.mp3

function audioSuccess() {

console.log("[AUDIO]: Created " + src);

}

function audioError(msg) {

console.log("[AUDIO]: Error " + msg);

}

// Create Media object from src

my_media = new Media(src, audioSuccess, audioError);

// Play audio

if (preload === true) {

my_media.setVolume(0);

} else {

my_media.setVolume(1);

}

my_media.play();

}

Firefox OS: Converting a camera image to a base64 encoded image URL

2014-09-23T14:20:00.003-07:00

I'm porting my apps ScoreGeek and Easy Password Storage to Firefox OS, and ran into some issues with saving images returned by the camera or gallery picker.

The problem is that I am used to Android and iOS returning a base64 image URL, but Firefox OS returns a blob URL that points to a local location on the device, like this:

blob://alksdjfoasdi029alfiasfjalsia93lrahsfhaslekfhasfe

You can load that URL into a image tag's source and it displays, but you can't resize it, save it, send it to another device, or even keep it around after you turn off the phone.

My objective is to save it as a Base64 encoded image URL and then put it into LocalStorage or push it to my cloud server to be downloaded by other devices.

After days of fooling around with FileReader I gave it up and found the correct approach: use a picker to get the photo data (as a blob:// url), load the blob URL into an image, then copy the image data to a canvas, and convert it to a Data URL. The result is a base64 encoded image URL that can be saved on the device.

I've copied the relevant functions from my code below, but it will require some modification to run in your environment.

I hope this helps someone else with the same problem!

var devicePlatform = getDevicePlatform();

var pick = new MozActivity({

name: "pick",

data: {

type: ["image/png"]

}

});

pick.onsuccess=function() {

var res=pick.result;

// Create object url for picked image

var photoURL=window.URL.createObjectURL(res.blob);

gamePicSuccess(photoURL);

};

pick.onerror = function() {

console.log(this.error);

};

gamePicSuccess: function (imageData) {

var $el = $('#imgGameImage'); //jquery variable pointing to the element where the image will be displayed

if (devicePlatform === "FirefoxOS") {

var elDom = document.getElementById("imgGameImage");

function myLoad() {

elDom.removeEventListener('load', myLoad); // to avoid a loop

var imgCanvas = document.createElement("canvas"),

imgContext = imgCanvas.getContext("2d");

imgCanvas.width = elDom.width;

imgCanvas.height = elDom.height;

imgContext.drawImage(elDom, 0, 0, elDom.width, elDom.height);

var imgAsDataURL = imgCanvas.toDataURL("image/png");

$el.attr('src', imgAsDataURL).load();

}

elDom.addEventListener("load", myLoad, false);

$el.attr('src', imageData).load();

}

};

function getDevicePlatform() {

//console.log("getDevicePlatform");

var device;

var deviceArray;

var userAgent = navigator.userAgent;

//console.log(navigator.userAgent);

//userAgent = "Mozilla/5.0 (Mobile; rv:14.0) Gecko/14.0 Firefox/14.0";

if (userAgent.match(/(iOS|iPhone|iPod|iPad|Android|Windows Phone|Mobile)/)) {

//console.log(devicePlatformArray);

device = deviceArray[0];

if (device === "Mobile") {

deviceArray = userAgent.match(/(Firefox)/);

device = deviceArray[0];

if (device === "Firefox") {

device = "FirefoxOS";

} else {

device = "Browser";

}

if (device === "iPhone" || device === "iPod" || device === "iPad") {

device = "iOS";

}

if (device === "Windows Phone") {

device = "WinPhone";

}

} else {

device = "Browser";

}

return device;

};

Windows 8 Microsoft Account Login Complaints

2014-01-17T14:41:00.000-08:00

I think that using a Microsoft Account as the method to login to a computer is bad security.

I have been trying to shore up the security of my online accounts recently. The way I've been doing it is to use my password manager, Easy Password Storage, to create random passwords for each of my website accounts.

Then, when I need to visit a website, I open Easy Password Storage and copy my password to the clipboard so that I can paste it into the website I'm visiting (I try to use at least 36 random characters to prevent brute force attacks, which means I don't know my passwords by memory any more). The app makes this easy by launching the appropriate URL and copying my password to the clipboard so that I can paste it into the website's login form.

Window 8 allows me to set up my PC login using my Microsoft Account. The problem is that when I'm logging into a computer I need a password that I can remember because I can't access my app to copy and paste my password when logging in to my PC.

My Microsoft Account protects much more than just my PC login: it protects my apps, my financial data, email and more. I want a secure password, but there's no way I can remember 36 random characters each time I launch Windows.

I think the solution here would be to have a separate PC login password when using your Microsoft Account to log into your PC. The chances of anyone at Microsoft reading this blog are slim, but I suppose it could happen....

Until then I think there are some alternatives, like using a PIN or a picture password... they don't seem very secure to me either but I guess it's the only option if I want a very secure password for my Microsoft Account. Maybe someone can recommend a more secure method in the comments?

Easy Password Storage, by Rebrand Software, LLC is currently available at the following locations:

Android - Google Play
https://play.google.com/store/apps/details?id=com.rebrandsoftware.easypasswordstorageios&h

Android/Kindle - Amazon

http://www.amazon.com/gp/product/B00HPAL0TS

iPhone/iPad/iPod - iTunes

https://itunes.apple.com/us/app/easy-password-storage/id727687157?ls=1&mt=8

Mac OS X - Mac App Store

https://itunes.apple.com/us/app/easy-password-storage/id727687157?ls=1&mt=8

Windows/Mac OS X - Direct from RebrandSoftware.com

http://www.rebrandsoftware.com/app.asp?id=17

Windows Phone

http://www.windowsphone.com/s?appid=3cf0de36-c432-4fbf-add9-d6c4720f8c11

Android - AppsLib

http://www.appslib.com

Securing Your Online Identity After Being Hacked

2014-01-16T08:54:00.000-08:00

The other day my Twitter account @MikeKGibson was hacked. The attacker sent out messages to everyone who follows me with URLs to other twitter users' status updates, which in turn were links to suspicious websites.

Luckily, I caught it within an hour before the hackers had a chance to tweet something like "I like to #SniffMyOwnButt" on my behalf. I tweeted my followers warning them not to click on the links.

But, worst of all, the attackers now have access to my password, giving them easy access to any other website where I used the same password. Let's be honest, many of us use the same or similar passwords on all our website accounts.

If your own passwords are ever compromised ("before your own passwords are compromised" may be more accurate) here are steps you can take to minimize the damage by using a password manager app like my own Easy Password Storage.

The idea is not only to create strong passwords that cannot be brute forced, but to use a unique password for every website you visit. That way one stolen password cannot be used to access any account but the one that is hacked. You never know which big company is going to be hacked, or which website stores your passwords in plain-text.

Here is how I use Easy Password Storage to deal with this:

Each time I create an account on a website I open my password manager, Easy Password Storage
I add the account to my list and use the password generator to generate a random password with as many characters as possible. I aim for at least 36 random characters if it is allowed by the website.
I turn off "Save password" features of the browser. It's a pain to lose this feature, but it's so easy for a hacker to gain access to them (have you ever tried typing "chrome://settings/passwords" in Chrome, for example?)
When I know I'm going to visit a website that will require a password, like my bank, I tab over to Easy Password Storage, select my bank entry, and click the Launch button. This copies my long, random password to my clipboard and opens my bank's URL. Now I can simply paste my password in.
I have Easy Password Storage set to erase my clipboard 30 seconds after I copy my password for extra security.

I won't lie, it's more time consuming to create random passwords for each website, but I suspect it's nothing compared to the time I would have to spend changing passwords and recovering accounts after a major hack.

Once you have put a system like this in place it means you no longer know your own passwords from memory. It's important that you have access to your passwords on all your devices. That's why Easy Password Storage has cloud sync as well as offline import/export ability.

As a developer I have all sorts of computers (Mac, Windows, iPad, Android Tablet, Android phone) where I need to have access to my passwords, and Easy Password Storage keeps them encrypted and synchronized automatically in the Cloud. For more information, here is an article I wrote on Using Easy Password Storage in the Cloud.

Luckily, my Twitter password was unique and can't be used to hack my other accounts. I recommend you put a similar process in place with your own accounts now: it's much easier to deal with hackers now, before they have a chance to get into your bank account or trick people into thinking you #SniffYourOwnButt.

Easy Password Storage, by Rebrand Software, LLC is currently available at the following locations:

Android - Google Play
https://play.google.com/store/apps/details?id=com.rebrandsoftware.easypasswordstorageios&h

Android/Kindle - Amazon

http://www.amazon.com/gp/product/B00HPAL0TS

iPhone/iPad/iPod - iTunes

https://itunes.apple.com/us/app/easy-password-storage/id727687157?ls=1&mt=8

Mac OS X - Mac App Store

https://itunes.apple.com/us/app/easy-password-storage/id727687157?ls=1&mt=8

Windows/Mac OS X - Direct from RebrandSoftware.com

http://www.rebrandsoftware.com/app.asp?id=17

Windows Phone

http://www.windowsphone.com/s?appid=3cf0de36-c432-4fbf-add9-d6c4720f8c11

Android - AppsLib

http://www.appslib.com

Using Easy Password Storage in the Cloud

2014-01-14T08:22:00.000-08:00

Easy Password Storage is my password management app which has been receiving great reviews like:

"This is the best password app at the app store. You have to have it!" -The Bold Man, Mac App Store

"It’s simple, easy to use, high level of encryption and is fast, so not waiting ages for logins or anything. Very handy, I’d be lost without it." -dbirch, Mac App Store

Version 4 recently unveiled cloud support and mobile companion apps for the following platforms:

iOS / Android / Kindle / Windows Phone / Mac OS X / Windows (links to app stores below)

This version comes with the ability to synchronize passwords between all of your devices in the cloud. I want to touch on some of the ways you can benefit from using the free cloud service on your devices.

Backup: Even if you don't have multiple devices to synchronize you can still benefit form having an encrypted backup of your passwords in the cloud. If you drop your phone in the toilet and replace it with a new one, just install the app and your passwords will be restored.
Similar Device Sync: One copy of the iOS app will work your iPhone, iPad and iPod as long as you're using the same apple account. Add a password on one and it shows up instantly on the others.
Sync cross-platform: Add passwords on your iPhone, they show up on your Kindle Fire and your Windows Desktop versions of the app.
Easily switch phones: If you decide to switch from your Android phone to an iPhone in the future, no problem, your passwords will come with you.

Security is our number on concern. Here is how the app handles your data before sending it to the cloud:

Your passwords are encrypted by the app with your private Master Password with your choice of either Blowfish 448 bit or Advanced Encryption Standard (AES) 256 bit encryption.
Next, the app encrypts that data with our developer key using 448 bit encryption. Now your data is doubly encrypted.
That data is encoded for extra security and ease of transfer
A connection to the cloud server is established over an HTTPS connection
The data is encrypted in transit to our cloud server using SSL
Your private Master Password is never sent to the cloud or stored anywhere. That means we can't access your passwords (and unfortunately means we can't recover them either, so remember your Master Password!)
All that is done in reverse when the data is sent back to your devices. Only an app with the same username, master password and encryption type can decrypt your data, and the user must be signed into your cloud account as well.

Even with that level of security you may still decide you want to backup or sync your data offline, which is why we have included the ability to import/export passwords encrypted in file or text format. The app can run completely offline and still keep your passwords synchronized.

Here are all the devices and app stores where Easy Password Storage is currently available:

Android - Google Play
https://play.google.com/store/apps/details?id=com.rebrandsoftware.easypasswordstorageios&h

Android/Kindle - Amazon

http://www.amazon.com/gp/product/B00HPAL0TS

iPhone/iPad/iPod - iTunes

https://itunes.apple.com/us/app/easy-password-storage/id727687157?ls=1&mt=8

Mac OS X - Mac App Store

https://itunes.apple.com/us/app/easy-password-storage/id727687157?ls=1&mt=8

Windows/Mac OS X - Direct from RebrandSoftware.com

http://www.rebrandsoftware.com/app.asp?id=17

Windows Phone

http://www.windowsphone.com/s?appid=3cf0de36-c432-4fbf-add9-d6c4720f8c11

Android - AppsLib

http://www.appslib.com

Recovering From Accusations of Malware

2013-04-25T07:16:00.001-07:00

Introduction

Here is the story of my 8 year battle against false reports of malware in my software, how I eventually won that battle, and how you can ensure the same thing doesn't happen to your website or products.

The Beginning: Can one person make an effective anti-spyware product?

In 2005 my software company was two years old, I had a good number of customers, and people were hungry for more private label software. The economy was great and I had a lot of requests to create new private label applications.

In particular, there were many requests for anti-spyware and anti-virus products. However, I always turned them down citing the inability to maintain a good definitions database.

Eventually, I found a way that I could maintain a definitions database for spyware (not antivirus) by creating internal software that sourced information about files from the web, meaning I didn't need a team to maintain definitions.

With that, I created what I think was a fairly good and safe anti-spyware product that I called Ad-Purge. Upon release it sold well and people seemed to like it for a light-weight spyware solution. However, because of the crowd sourced definitions it was prone to false positives: if a lot of websites thought a file was spyware then Ad-Purge did too.

The Spyware Warrior on the Offensive

Within a few months of release Ad-Purge was labeled as a "rogue anti-virus product" by a person who called himself Spyware Warrior. I, of course, was appalled. I wrote to him trying to clear my name; I made changes to the software to make it more consumer friendly; I kept a close watch on the definitions to avoid false positives, but Spyware Warrior was determined that I created the product with bad intentions.

I eventually decided that Mr. Spyware Warrior was simply a jerk and went back to what I enjoyed: writing software instead of spending time trying to appease him. This was a mistake, for the spyware community took his opinions as fact causing Ad-Purge, and worse my website, to show up on many different blacklists and malware sites.

In 2008 I was forced to simply discontinue Ad-Purge in order to avoid being caught up in any more of these false accusations. Eventually the false positives went away for the most part and business resumed as usual. I continued to sell the private label version but made sure my customers could not repeat my mistakes. In particular, I turned down many requests from my customers to make the demo version detect spyware but not remove it until the software was purchased in full.

Five Years Later

Recently, in 2013, I became aware that my website and business had extremely negative reviews on a crowd sourcing security website called Web of Trust (WOT). Upon closer inspection I discovered that we had some good customer reviews but the vast majority listed us as a malware website!

Here is our current Web of Trust page: http://www.mywot.com/en/scorecard/rebrandsoftware.com

I began by replying to each of the user reviews that cited malware and asking them to reevaluate their ratings. They were helpful but reluctant to change their rating unless I had my software removed from various website reputation scanners, for example:

URL Void: http://www.urlvoid.com/scan/rebrandsoftware.com/
Virus Total: https://www.virustotal.com/en/url/88a6e...

These tools list scan results from various security software vendors. If any of the vendors think your website is malicious then it is a bad sign.

RebrandSoftware.com was listed by over 20 different vendors as being a distributor of malware. When I contacted some of the vendors they made circular references: we can't take you off our list because you're listed on URL Void. Obviously I couldn't get removed from URL Void without them first taking me off their list.

The Solution

What I had to do was track down every suspicious file or URL that was being tracked by these vendors, make sure it was actually safe, and use all of their false positive reporting tools to contact them individually.

I noticed when scanning my software executables that VirusTotal.com thought many of my programs written in Visual Basic 6, our older programming language, were spyware. As a simple test I recompiled the software on an updated system, resigned our executables and installers, and uploaded the new copies to our website. This took care of about 75% of the false positives. I don't know what they were keying on, maybe an old VB6 .dll file, but I suspect that those files are used by potentially millions of applications written in the early 2000s that are also being falsely accused of being spyware.

Next, I went through all the URLs on our site that were flagged as malicious. Many of them were old URLs that are not even in use, pointing to blank pages or error messages. It seemed that many of the vendors never bothered to check what was actually at the URL they were condemning, they simply found it listed by other vendors and added it to their own database.

Armed with the knowledge that everything on my website was safe I began submitting false positive reports to the antivirus vendors. Sometimes you have to sign up and post on a forum, sometimes there is a false positive submission form, and sometimes you have to download the company's product and register your email address (sketchy).

Most vendors removed the false positives right away, but many took no action or used more circular logic. I wonder if they actually look at the content of files and URLs or they just crowd-source their definitions like I did... lesson learned.

When it came down to only 4 or 5 websites reporting malware I resolved to contact them every day, repeatedly, until they responded.

I have also been tracking down blog posts which list us as a malware distributor and leaving comments that explain what my company does. A quick look at my website shows that my apps are highly rated on places like the Mac App Store and the Windows Store, meaning they have been scrutinized and vetted by companies who hopefully would never let malware into their systems.

Are My Customers Malicious?

I wonder how, after the 2008 incident, all this started up again and I suspect that I have a small number of customers who are actively using my rebranding services to create fake programs and distribute viruses with them. I rebrand our software for other companies to sell, and I suspect that some of my customers must be modifying the executables after I deliver them.

I don't have a good way of knowing whether it is deliberate or not. It's certainly possible that one of my customers had an infected computer, purchased clean software from me, downloaded it, it was infected on their computer, and then they tried to distribute it. Obviously this is a bad practice and all software should be verified clean before distribution.

One sure indicator of a fraud is when I am paid hundreds of dollars for a product and the purchaser seems to take no interest in their final product's quality. They will upload poor quality images even though my artist can create professional graphics for them for free. Sometimes they provide URLs which are dead or point to an unregistered domain. Then their payment will be charged back and I know the whole thing was a ruse. Was this someone with malicious intent or just someone trying to use a stolen credit card? Maybe both? I don't know.

I've learned to spot those obvious cases, but I certainly can't tell a person's intentions from their normal transactions with me. It is against our terms of service for our customers to do anything illegal with the software purchased from us, including distribute malware or engage in scamming. The vast majority of my customers are people interested in making money with shareware or trying to offer a bonus product to their customers. Having software with your name on it can impress clients, make your website more legitimate, create more sales for other products when packaged, etc.

I don't think it's up to me to judge people's intentions. All I can really do is respond to any inquiries by anti-virus vendors.

The number of anti-virus vendors who have contacted me in the past 10 years about my software or my customer's? Zero.

In the end I simply decided to discontinue the anti-spyware product entirely. I will continue to update the definitions database for the legitimate customers who vastly outnumber the potentially bad ones.

My Name Is Cleared, Kinda

Now, finally, I have been removed from every major website credibility reporting tool and most anti-virus vendors. One vendor, AlienVault, responded to my technical support request with a phone call from a sales rep. When I asked him if the support team knew how I could report a false positive he asked them and responded "They don't know but they're looking at like 7 monitors right now." Ugh.

I have bookmarked my WebOfTrust, URLVoid and VirusTotal pages and intend to check them frequently. If you have websites or distribute shareware I highly recommend you do the same. These anti-virus vendors are not going to contact to you if your site or products get falsely accused. And worse, if any false positives start making the rounds they are sure to be amplified by security vendors copying each other's records. It's something that has to be stopped immediately or it spreads out of control.

Web of Trust currently reports that my website is trusted, but only barely. My hope is that their users will reevaluate my website and change their scores. I'm also going to start promoting Web of Trust on my website so that my actual customers can report their good experiences. If you have a moment, I sure would appreciate a positive rating there: http://www.mywot.com/en/scorecard/rebrandsoftware.com

Now, hopefully, I can get back to what I really love: writing apps!

Losing Weight With Easy Calorie Counter: Part 1

2013-02-28T12:59:00.000-08:00

Introduction

I've been developing and using my app Easy Calorie Counter (available for Windows and Mac) for about a year now and using it in conjunction with running and exercise to lose weight. You can see a screenshot of it below:

I'm male, 34 years old, 5'8", and I brew my own beer which makes it particularly easy to go overboard on calories if I'm not careful.

In the Summer and Fall of 2012 I managed to lose 13 lbs, moving from 165 lbs. to 152 lbs, and have kept the weight off since then. I've learned a lot about what works so I'll be posting a series of tips for others who might be struggling.

Tracking your calories is the key. During my first cycle of P90X I actually gained weight, going from 162 to 165 over a period of three months. I was so hungry from all the extra exercise that I ate a lot of high calorie foods, and I didn't track what I ate.

You don't have to use Easy Calorie Counter for this to work, but it's only a few dollars and there's a free demo available here. You could even start tracking what you eat with pen and paper, that's what I did and what prompted me to write the app in the first place.

Tip #1 - Finding your target calorie level

Losing weight is all about math. The bottom line is that you have to burn more calories than you take in and your body will do the rest. Easy Calorie Counter has a built in calculator to help you find your target fat loss calorie level. Here's a screenshot:

Here you can see I've selected Lightly Active. I work at a computer all day but I exercise every day of the week, which would probably make me Moderately Active.

I think that this calculator, which uses either of two respected formulas for calculating fat loss calories, gives results that are a bit on the high side. My sweet spot seems to be 1600 calories per day. With that amount I tend to lose a little bit more than 1 pound per week. But everyone is different, and a computer can never give a perfect number for something like this, so here is how to find your real fat loss calorie level:

Run the calculator to get an estimate of your fat loss calories
Weigh yourself on an empty stomach (try it right after you wake up and use the bathroom)
Use a calorie calculator to eat as close to your target calories as you can for 1 week
At the end of the week, weigh yourself again on an empty stomach. Did you:

Maintain your weight? Consume 500 fewer calories per day and repeat step one
Gain weight? Consume 500 fewer calories per day and repeat step one
Lose 1-2 pounds? Perfect! Maintain to reach your target weight!
Lose 3 or more pounds? Consume 300 more calories per day and repeat step one*

*People who are heavier are likely to lose 3+ pounds per week, which is ok

Repeat those steps until you find your real number for fat loss calories that causes you to lose 1-2 pounds per week. It might take a few weeks, it took me 2 or 3, but once you know that number you'll be armed with all the information you need to really lose weight and keep it off.

In the next installment I'm going to show some examples of ways to shave off calories without being hungry all the time. There are some nice substitutions you can make in your diet that make it easy. You might even still have room for a beer if you're careful!

Getting my apps on the Windows Store requires... a Mac?!

2013-02-28T11:56:00.000-08:00

It seems that Microsoft is intent on turning me against them.

First, they don't allow my Desktop Apps to be truly listed on the Windows Store. They link to my app's external website instead. Not that there's anything wrong with the homepage for Easy Password Storage, the app I'm trying to register, but I wish customers could use the payment information they have already entered into the Windows Store and directly rate my app. Apparently that is only possible with Metro style* apps, despite the fact that my apps run great on everything from Windows XP to Windows 8.

Next, in order to get my app certified I have to have a $99 signing certificate from Symantec and only Symantec will do. What's wrong with my industry standard Comodo certificate which have already paid for and jumped through many hoops to obtain? My guess is nothing...

So, eventually, I received my Symantec wonder-certificate and my MS developer account and had my Windows App Certification Kit software installed. When I ran it I was informed that reports generated with Remote Desktop were invalid for some reason that is not made clear.

Luckily, I managed to find a workaround which allows me to connect remotely and still certify my apps, essentially proving that either Remote Desktop is a crappy application or there is no reason to refuse a Remote Desktop application when certifying apps.

I finally ran the certification kit, got a result of "Passed", and was ready to submit my app! Hooray!

Not so fast! When I uploaded my certification XML file to the Windows App Certification page, I was informed that:

* The submission package is invalid as this was generated using an invalid toolset architecture. This website accepts submissions from 64 bit toolset architecture only.

Ok, no problem, I purchased Windows 7 a few years ago and my current hardware supports 64 bit architecture: I'll just upgrade to a 64-bit version, right? Wrong. You can't update Windows from 32 bit to 64 bit without wiping your machine, reinstalling all your software and restoring all of your backed up files. It's possible but risky, not to mention a huge waste of my time.

So what is my solution? Use my Mac.

I'm currently installing a copy of my Windows 7 64 bit using VirtualBox on my Macbook Pro.

Then I can use my virtual copy of Windows on my Mac to complete the Windows App Certification.

Ah, the irony.

*I know Microsoft has tried to ditch the name "Metro" but it's burned in my brain and I like to tease them with it.

How to use the Windows App Certification Kit through Remote Desktop

2013-02-28T09:45:00.003-08:00

In the past few years I've become a Mac lover dispite decades of Windows use. I work primarily on my Macbook Pro and have disassembled my old home office in favor of an all-mac, all wireless environment.

About a year ago I moved my Windows XP and Windows 7 machines into the "server room" where they run without monitors, keyboards or mice. I use Remote Desktop from my Macbook to connect to them so now I can work from anywhere in the house or on the patio wirelessly.

Recently I decided to get my RebrandSoftware.com apps listed on the Windows Store. This week I've been paying a lot of attention to Easy Password Storage, one of my most highly rated apps on the Mac App Store, and the fone I want to get posted on the Windows Store first. To get it approved I have to run the Windows App Certification Kit. It installs my app, checks that all the files have a digital signature, runs diagnostics and gives a report which can be uploaded to Microsoft.

There's one hitch, though: Remote Desktop is not allowed! I assume it has something to do with video benchmarks, but it's a major annoyance for me. Surely there is someone else in this situation, which is why I decided to write about it.

Imagine my surprise when I found out that to get my app certified I would need to get a monitor, keyboard and mouse, hook them into my old Windows box and sit on the floor next to a cat litter box. Yes, it's true, the "server room" is really a closet where cats poop all day. That is the extent of my disdain for those old windows boxes.

If you try to certify your app over Remote Desktop your app is immediately rejected. I gathered my old monitor, keyboard and mouse but could not find a cord for my monitor. After two years of almost all wireless the ordeal seemed particularly archaic. Shouldn't I be able to stream an HD version of my monitor? I can stream HD movies from Netflix... Why would app certification require a physical monitor?

It turns out my distress was for naught because I have found a simple workaround: as of this writing the Windows App Certification Kit doesn't realize the connections using LogMeIn.com are remote desktop connections. The workaround will probably work with other remote login services as well but I have only tested with LogMeIn.com.

The results: Passed with Warnings. Here's a screenshot:

The warnings are unrelated to using a Remote Desktop agent: it says my app didn't properly respond to system restart notifications. I think it's safe to ignore, but it could certainly be the topic of a future blog rant.

The real victory: I won't have to endure the "server room" any time soon!

Tips for external links and social media within apps

2013-02-21T11:35:00.003-08:00

I've been trying to link to social media sites within all of my apps. Within each app you can do the following things:

-Click to Rate (this either brings you to our website's rate page, or the Mac App Store)
-Click to Tweet (composes an example tweet that links to the proper app)
-Click to Follow (launches my twitter page)
-Click to Like (launches the appropriate facebook page for the app)
-Click to Friend (launches my facebook page to friend or follow)

If you click any of the links above you'll see that they're not actually linking to Facebook or Twitter, but to my own website, RebrandSoftware.com. From there, a page on my website redirects to the actual Facebook or Twitter page.

I never know if/when I might have to change my Facebook URL or my Twitter handle. This way, all my apps are pointing to a page on my website instead of directly to Facebook or Twitter. I can change that page to redirect to a new URL at any time.

I will never have to change the URLs within my apps again. If my Facebook or Twitter URLs change I can update the pages on my website, instead of rebuilding and redistributing all of my apps. Even customers using old versions will be brought to the correct URL without having to update first.

I think this lesson applies to any time you're linking to an outside source: keep control of the links by sending them through your own server first to redirect to the proper URL. It's also a handy memory tool:

http://www.rebrandsoftware.com/follow.asp
is much easier to remember than
https://twitter.com/intent/follow?screen_name=MikeKGibson

Going live with a new website!

2013-01-26T09:02:00.000-08:00

It's been many months in the making and today I'm going live with a complete redesign of RebrandSoftware.com.

There is an overwhelming amount of legacy data and services that we have to continue supporting through the merge:

-Existing customers, usernames and passwords
-Services that our software depends on
-Existing sales
-Integration with SoftLocker.net

So I've tried my best to make sure everything will work with only minor interruptions. Let's hope for the best and email me at mike@rebrandsoftware.com if you're having any issues!

Amazon Checkout HMAC-SHA1 With Classic ASP

2012-11-28T07:13:00.000-08:00

I've been trying to implement Amazon Checkout for the last few days. Using Classic ASP it's been a real nightmare: no sample code to work with.

I've finally cracked it with the help of some Google Checkout cryptography libraries , specifically the file "GlobalAPIFunctions.asp" located in the sample code linked to above.

You will also need to get the GCrypt COM object installed on your server. I had to ask my hosting company to do this, it might already be installed since Google Checkout is popular.

Here is the code that worked. Before you use it:

Download the GlobalAPIFunctions.asp file and install it on your server
Edit the include file URL to point to GlobalAPIFunctions.asp
Edit the AWSSecretKey, AWSAccessKeyID, and AWSMerchantID variables to match your Amazon Checkout account
Make sure GCrypt COM Object is installed
Edit the cart XML for your purposes

<%
'This is a Base64 encode that doesn't put line breaks in like Google's does
Dim Base64Chars
Base64Chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZ" & _
"abcdefghijklmnopqrstuvwxyz" & _
"0123456789" & _
"+/"

' Functions for encoding string to Base64
Public Function base64_encode( byVal strIn )
Dim c1, c2, c3, w1, w2, w3, w4, n, strOut
For n = 1 To Len( strIn ) Step 3
c1 = Asc( Mid( strIn, n, 1 ) )
c2 = Asc( Mid( strIn, n + 1, 1 ) + Chr(0) )
c3 = Asc( Mid( strIn, n + 2, 1 ) + Chr(0) )
w1 = Int( c1 / 4 ) : w2 = ( c1 And 3 ) * 16 + Int( c2 / 16 )
If Len( strIn ) >= n + 1 Then
w3 = ( c2 And 15 ) * 4 + Int( c3 / 64 )
Else
w3 = -1
End If
If Len( strIn ) >= n + 2 Then
w4 = c3 And 63
Else
w4 = -1
End If
strOut = strOut + mimeencode( w1 ) + mimeencode( w2 ) + _
mimeencode( w3 ) + mimeencode( w4 )
Next
base64_encode = strOut
End Function

Private Function mimeencode( byVal intIn )
If intIn >= 0 Then
mimeencode = Mid( Base64Chars, intIn + 1, 1 )
Else
mimeencode = ""
End If
End Function

' Function to decode string from Base64
Public Function base64_decode( byVal strIn )
Dim w1, w2, w3, w4, n, strOut
For n = 1 To Len( strIn ) Step 4
w1 = mimedecode( Mid( strIn, n, 1 ) )
w2 = mimedecode( Mid( strIn, n + 1, 1 ) )
w3 = mimedecode( Mid( strIn, n + 2, 1 ) )
w4 = mimedecode( Mid( strIn, n + 3, 1 ) )
If w2 >= 0 Then _
strOut = strOut + _
Chr( ( ( w1 * 4 + Int( w2 / 16 ) ) And 255 ) )
If w3 >= 0 Then _
strOut = strOut + _
Chr( ( ( w2 * 16 + Int( w3 / 4 ) ) And 255 ) )
If w4 >= 0 Then _
strOut = strOut + _
Chr( ( ( w3 * 64 + w4 ) And 255 ) )
Next
base64_decode = strOut
End Function

Private Function mimedecode( byVal strIn )
If Len( strIn ) = 0 Then
mimedecode = -1 : Exit Function
Else
mimedecode = InStr( Base64Chars, strIn ) - 1
End If
End Function

'AMAZON VARS
dim AWSSecretKey
dim AWSAccessKeyID
dim AWSMerchantID
dim AWSSignature
dim AWSCart
dim AWSCartB64

AWSSecretKey = "XXXXXXXXXXXXXXXXXXXXXXX"
AWSAccessKeyID = "123ABCDEFG"
AWSMerchantID = "123XZY"

'AMAZON VARS END

AWSCart = AWSCart & "<?xml version=" & """" & "1.0" & """" & " encoding=" & """" & "UTF-8" & """" & "?>"
AWSCart = AWSCart & "<Order xmlns=" & """" & "http://payments.amazon.com/checkout/2009-05-15/" & """" & ">"
AWSCart = AWSCart & "<Cart>"
AWSCart = AWSCart & "<Items>"

'while 'Iterate through the items in the cart here

'AMAZON ADD ITEM TO CART
AWSCart = AWSCart & "<Item>"
AWSCart = AWSCart & "<SKU>" & YourSKU & "</SKU>"
AWSCart = AWSCart & "<MerchantId>" & AWSMerchantID & "</MerchantId>"
AWSCart = AWSCart & "<Title>" & YourItemName & "</Title>"
AWSCart = AWSCart & "<Price>"
AWSCart = AWSCart & "<Amount>" & YourPrice & "</Amount>"
AWSCart = AWSCart & "<CurrencyCode>USD</CurrencyCode>"
AWSCart = AWSCart & "</Price>"
AWSCart = AWSCart & "<Quantity>" & YourQuantity & "</Quantity>"
AWSCart = AWSCart & "</Item>"

'AMAZON ADD ITEM TO CART END
'wend 'Finished iterating through items in the cart

'AMAZON Process Cart

AWSCart = AWSCart & "</Items>"
AWSCart = AWSCart & "</Cart>"
AWSCart = AWSCart & "</Order>"

AWSSignature = cryptObj.generateSignature(AWSCart, AWSSecretKey)
AWSCartB64 = base64_encode(AWScart)

set cryptObj = Nothing
%>
<html>
<body>

<script type='text/javascript' src='https://static-na.payments-amazon.com/cba/js/us/sandbox/PaymentWidgets.js'>
</script>




<div id="cbaButton1">
<img src="https://payments-sandbox.amazon.com/gp/cba/button?type=cart&cartOwnerId=<%= AWSMerchantID %>&color=orange&size=large&background=white"/>


</div>

<script type='text/javascript'>
new CBA.Widgets.StandardCheckoutWidget({
merchantId:'<%= AWSMerchantID %>',
orderInput: {
format: "XML",
value: "type:merchant-signed-order/aws-accesskey/1;order:<%= AWSCartB64 %>;signature:<%= AWSSignature %>;aws-access-key-id:<%= AWSAccessKeyID %>"},
buttonSettings: { size: 'large',color:'orange',background:'white'}
}).render("cbaButton1");
</script>
</body>
</html>

New Website

2012-11-20T08:41:00.002-08:00

I've been hard at work updating RebrandSoftware.com with a focus on apps.

The new site features easier navigation, the ability to review apps, a much better support section, and news via the official blog. You can also get a glimpse of me and my family in the new About section.

Along with the new website comes a new app, Easy Calorie Counter which I will post about in more detail soon.

It's also much easier to track your app purchases now. We keep the download links and registration information available on the new My Apps page, and also give you the ability to rate apps you purchase or switch computers.

Most of our apps are now on the Mac App Store, so Mac users can choose whether you want to get them there or through our website.

I've been working on the site for months now, but there are bound to be some issues when it goes live. Hopefully we will be able to work through those quickly.