Firefox 3 ACHTUNG ACHTUNG self signed certificate

Lately as a techie geek, a very minor thing have annoyed me. (Non techies can switch off now).

Firefox 3 was launched a few months ago, and it is a great evolution in the subject of browsers. The progression in security and anti-phishing is very laudable. But one thing really annoys me (hence this post):

The huge ACHTUNG ACHTUNG process when encountering a site that uses a self-signed certificate for SSL. And the reasons and responses to why this is so.

A self-signed certificate is SSL certificate for encrypting and authenticate the site you are visiting. Self-signed means, that the certificate has not been signed by a 3rd party (at least not one you browser knows), thus the authenticated can not be guarantied. However the traffic is still fully encrypted.

Banks, web shops, medium to large businesses and high volume web sites do not have a reason for using self-signed certificates. They should afford the the costs and effort of setting up proper authenticated certificates. Expired and invalid certificates should not be accepted from them.

However for smaller organisation, charities, tiny business, personal sites and application, and small application, self-signed certificates is a great help. They are free and ensure encryption.

I have perhaps 50 odd tiny applications and web sites on a range of domains. I am not about to hand over $500-5000 a year to some 3rd party racketeering company to secure and authenticate all these sites. Especially as I probably make only about $100 a year on them, mostly from ads!

Yes, some of the sites are only used by me and a limited known user group, so the warning is shortlived. However for many of them they are for the general public, and needs volume to be make any money or to be of any interest. If any becomes a huge success, then I can get a decent certificate, but most of them will never be. Nor for the rest of the web with similar issues as mine.



So what is the problem with Firefox 3 ?

When encountering a self-signed, the new version of Firefox displays a full page alert. This ACHTUNG, ACHTUNG, alert in striking yellow and a policeman stopping you, is quite off-putting. To still view the site you have to go through 4 clicks of yes, really yes, accept etc.

Previous version, Firefox 2, displayed a pop-up box, where you could view the certificate, reject or accept it. Other browsers displays similar warnings, but not quite as rigorous as FF 3, which are not necessarily better.

With this new warning page, the majority of the casual web users will either be put by either the effort needed to enter the site, or scared off by the warning. The minority of the users which are technologically savvy will not be put off by the alerts, and will still be able to view the site. Also the users which are very specifically interested in the site, will perhaps ask for assistance first, but may still view the site. Depending whom your target users are, the majority may now never visit your site/app or will already be slightly peeved off.

So Firefox 3 is by its actions recommending web sites not to be encrypted.



Why the new warning?

The reasoning for a warning, is because the site can not be authenticated, thus perhaps a phishing attempt and/or it may be possible a Man in the Middle Attack has occurred. And the new extended process is so users are more aware of this than previous.

Valid points and I believe the users should be informed somehow. However I do not agree the scale of the warning is justified. And it does create a huge hindrance for many valid web sites.




Benefits and risks of using certificates

If the site has a 3rd party signed certificates, which all important sites should have, especially where money is changed hands, then only a a valid signed certificate is acceptable. Fair enough. But 3rd party authentication does not guarantee authentication, you may still have misstyped the url. The 3rd party may not have rigoursisly checked the authentisity of the site before singing the certificate. etc. But it is usually a safe bet that it is secure.

Expired or invalid certificates for important sites, is not acceptable either. But again for the less important, less resource rich people and organisation, it should be to a degree. At least it is authenticated. But for general web sites, these certicatesd is lax on behalftheir IT, and should be noted in some way.

Self signed certificates, are great in ensuring encryption. This prevents network snooping of passwords etc, which is very easy to do. Yes it can not authenticate the site. And Man in the Middle Attack is possible if it is the first time you visit this site. However Man in the Middle Attacks are extremely rare and difficult to do. Self-signed is not for banks etc.

Changed certificates. Sometimes for valid reasons a certificate is changed, e.g. when the old one expires. This should be warned of and yes, especially for self-signed certificates, a big alert warning should be prompted.

No certificate, as in plain http, unencrypted traffic. I believe we should use SSL/TLS as much as possible. When you need to log on in any way, the site should be encrypted. Any data specifically to/about you sent over the net should not be able to snooped on by casual listeners.




Developers responses and people comments

What really also annoyed me is the reasoning by developers and the advocacies by people comments in articles about this warning.

They say it is better to block people than to allow access to unauthenticated sites. Or people really need to be warned, and if they are not smart enough then too bad. Which is just bad business and ignorant.

Or no excuse not to cough up for certificates and that self-signed sites does not deserve any pity. Well that is okay for rich people, but not me, and not the millions of tiny sites that make up the majority of the web!

Or the typical techie replies that the warning is no problem, only a few clicks and they really like the information etc. Which is again ignorant of the huge portion of users which will be terrified with this unfriendly warning.

Or that Man in the Middle Attacks is really dangerous and should over prioritise any usability. No, MitMA are rare, very rare. Yes, important to protect about, but we should not stop people using the web by doing so.

Or that unauthenticated SSL is worse than plain http due to perhaps impression of authenticated. No, plain unencrypted http is terrible, as snooping is easy and common. It really is a problem with how the browsers show the distinction between unauthenticated and authenticated sites, not the sites.




The outcome and my suggestions


The current police warning by Firefox 3 is a very bad solution. It will cause:
* Many self-signed sites to convert to unencrypted.
* More easy snooping of peoples passwords as sites go unencrypted.
* Some self-signed to purchase certificates.
* Loss of information spread, ad revenue and business for small sites.
* Confidence in Firefox in progressing usability


What Firefox needs to do is to distinguish the different states of certificates (which it already does to a degree).

Signed 3rd party certificates.
Display the new signed favicon as it does. with lock in status bar etc. no problems with it.

Expired or invalid signed certificates.
Warn but allow access.

Changed signed certificates.
No warning.

Self-signed certificates on 1st encounter
Warn but allow access. But not the ACHTUNG ACHTUNG approach. A simple change of icon to a red broken lock as in previous netscape versions is enough information. A cleaner drop down bar like the new remember password bar, to allow import of cerficate, inspection and links for more information would be much better. Maybe colour location bar red, till the certificate is accepted. If not the certificate is not kept once the session is over.

Self-signed certificates on re encounter with previously accepted certificate
No warning. Just the red lock. Or with a question mark over the favicon.

Changed self-signed certificate.
ACHTUNG ACHTUNG warning.

No certificate, unencrypted.
Maybe this should be changed to show users that it is not secure in any way?!


enough ranting. no one will read this (not the whole post anyway ) :)


(Ps. Man in the Middle Attack is when some other machine between you and the site pretends to be the site and intercepts your traffic, and responds with its own fake certificate)

Grrrr!

I am sometimes worried about myself (or perhaps human kind ).

Real issues and problems, like wars, famine, murders etc while it is obviously really bad for the people concerned, and I do have some sympathies, ( and its interesting in a news sense), but it does not really upset me. Ok, I am not cold harted and do get involved, sometimes.

However little minor everyday things really ticks me off. Like being overtaken while queing in a car or shopping queues. Or how general things annoy me, like how my fellow Norwegians are quite cold and rude, my former fellow Englishmen are quite ignorant. Or that Norwegian SV politicians really pisses me off as most things they say and do generally is trying to make most people's life worse, in a quite sadistic and petulant way. Or when the people above/next door have their bass on slightly too loud, never mind people being slaughtered in Georgia/Sudan (or wherever my biased one-sided news channel reports it from), but the extra noise is really bad...

Or in a more selfish example, when e.g. encountering a Romanian beggar on the streets, I am not upset enough that an EU country can have such huge problems with social differences and discrimination of minorities, I am however annoyed that they are allowed into this country, do not work and disturb me. Terrible, I know.

In the local news, a car parking permit scheme is about to be introduced in Oslo, and that really got me annoyed how blinkered people and politicians are. And I don't even have a car! Think that will be another blog post.


Lately as a techie geek, another minor thing have annoyed me. Firefox 3 new ACHTUNG ACHTUNG alert for self-signed certificates. Think will be another blog post as well.

Netbeaning again

Return of the lost child...

Been an Eclipse devotee for several years now. But have recently returned to NetBeans. I was using netbeans before eclipse, but changed as eclipse offered more and faster development. (And JBuilder, Kawa, jedit in ancient time before then...)

Been really impressed with NetBeans 6.1, it has really moved on from 4.x range I was using, and the 5.0 version I last checked out.

First impression was how well maven works within netbeans. In eclipse the m2eclipse plugin does somehow works, but is cumbersome, and always something is a pain. In netbeans, the mevenide just works. Plain and simple. It just works as it should do, with full module structure, easy usage, seem fully integrated with the rest of the ide. nice.

In general netbeans is a lot clearer and cleaner, eclipse interface is very messy and cumbersome.

So Ill be a Sun slave for awhile now, till the next new better thing arrive...

( looking through my blog, it is becomming more and more geeky. oh well. :) )

Firefox extensions

Arent Firefox extensions fabulous? No? Oh. you got a life...
Anyway for the rest of us, they are.

Here are my favourites, I dont always install all of them on every machine, but quite a selection every time.

• Fast dial:
  essential, such an eye candy. and usefull.


• del.icio.us bookmarks:
  new firefox 3 bookmarks, are nice, but i use several machines, several users, several profiles, sometimes not firefox, so syncing bookmarks is key.


• faviconizeTab:
  nice.


• Web developer:
  Must have for web developers. Suprisingly I use it much anymore, so Ive realised I just dont do much frontend coding anymore.


• Firebug:
  Like web developer, good css/ajax debugging tool.


• Foxyproxy:
  Not recommended for everyone, but nice work extension to automatically alter which proxy you use. (In case they monitor how much time you "research on the net".


• ie tab,
  if in windows, even less reason to ever click on e!


• quick java:
  quick buttons to enable/disable java


• NoScript
  essential security tool, a bit overzealus.


• pwdHash: handy.
  
• adblock plus:
  if some adds annoy you, or as i often encounter, slows your pc down to a grind if you tab open 5-10 news articles with lots of flash adds....


• remember the milk for gmail:
  handy


• twitterfox:
  nice not essential


• facebook:
  nice not essential


• CTRL+TAB:
  Nice idea, but lacks some configurability, so needs to mature a little.
  Tab scope:
  Nice, but not that usefull,
  Tab sidebar
  Very nice
  Ctrl Tab Preview
  If only it was updated to FF3


• google preview:
  just usefull, not essential.


• Split Browser:
  Handy viewing some side by side. A bit buggy last time I used it.


• firegpg:
  nice, if only people would care about encrypting emails...


• google toolbar:
  used to always install it, not bothered in the new firefox 3


• foxtrick:
  if you play hat trick, then foxtrick was essential, and is still usefull.


• 
  modify headers,
  if debugging web apps .


• 
  gmail notifier:
  if you dont have an external one.
  works with google apps.


• Elasticfox:
  Essential if you use amazon ec2 alot


• 
  S3 fox:
  Handy amazon S3 browser.


• google browser sync:
  Very handy, but discontinued for firefox 3.
  Syncing many things, but the element I used was passwords.
  very usefull as i use many machines, often reinstalling firefox,
  and dont want to remember every password.
  downside was privacy, but id rather trust google,
  than some 3rd party i dont know. (better the devil you know)

New Postfix howto!

I have finally updated my Postfix howto!
It is now based on Ubuntu 8.04 Hardy Heron. And as before includes detailed, easy to follow instructions of building a mail server using Postfix, Courier, MySQL, amavisd, SpamAssassin, ClamAV, SASL, TLS and SquirrelMail.

It is not quite finished yet however, but I would recommend following it rather than the old one. But keep referencing the old one as it has a lot of detail. The new howto, edition 7, does at the moment only include the core packages, but enough to get a advanced and secure server up. For any extensions and further info it still referes to the old edition (5). But I will keep padding it out with old and new content.

New for this edition is the inclusion of Amazon Elastic Computing Cloud(EC2) as reference build of the server. I have also made public AMIs for people to launch and customize if they so choose.

Hope it is of use to people!

Cheers,
Ivar Abrahamsen

elastic experience

Been playing with Amazon's web services, EC2 and S3.

EC2, Elastic Computing Cloud, is really nice. In a nutshell, it allows you to create servers on the fly as and when you need it.

My initial impression before using it was that is would be very good for high load, performance intensive applications for larger corporations or research. And not for my use; low to none performance, tiny web sites and web apps, which are mostly used by just me.

The main reason was the cost of running one 24/7 is costly with amazon pricing, especially as it would be idle most of the time. At most I get 500 web site visitors a day, thats only 1 every few minutes.

But after playing around with EC2, I have realised it can also be very usefull for my meagre usage. Initially it looked a conveluted way of creating and accessing EC2 and S3. But the starter guide was actually quite easy to follow. And then the firefox extensions for both makes admin very easy.

I run a subversion server on my normal server for my code, websites, documents etc. But its does not need to be online 24/7. I can just bring up an EC2 AIM instance for a little while, or even for the daytime hours.

I also use my current server to run test apps, which only I use. They do not need to be up for very long. EC2 will be fine.

The main cost will be the 24/7 hosting of my static web sites. If I run one, I might as well run them all on the same instance. But I worked out the costs is on par the ISP is charging for my co-location server. However it's costs are shared with others, which I may not be able to do with EC2.

So now Im moving from one physical server doing everything(including crashing and being down for long periods), to several dynamic instances with at least one permanent. Will keep a look at costs to see how much more this way is costing.

Will have to write and create some routines to persist to S3 some of the data of the instances. This looked a pain initially, but I think it is just a period of adaption before it will be acceptable.

One thing Im not sure I can move to EC2 is my email server. But google apps is handling well some of my domains, I might just convince myself to move it all to it.


Ps. The one odd, funny thing, but to be aware of with EC2, is that after you have terminated your instances, try after awhile the ip again in a browser. I have gotten other people's instances whom have been handed the IP, but often their websites are in their initial install state. So Ive seen default admin pages for CSM apps(ie with default passwords as well) etc being exposed to anyone before the actual owner logs in and changes settings. Remember you can be in the opposite situation as well.

Grrrrrrr

My server keeps crashing. No idea why. And I cant physically get to it anymore. It feels really frustrating.... :(

It has been up faultlessly for more than two years so suppose ive been spoilt.

And the other people I share the server can neither get to the server easily, but at least they still work in the same country as the ISP. But it means days delay between reboots. And then some hours of searching for why it crashes before its gone again.

Things is, it worked faultlessly when we removed it from the isp and ran it for a few days at someones house. But in the ISP it dies within a day.

If it is hardware, my main suspect is always the powersupply. But I cant remember what the specs where......

No single default persistence unit defined

If you getting nowhere with this type of problem:

Using spring and jpa, and you get this error:

No single default persistence unit defined in {classpath*:META-INF/persistence.xml}

And you DO have a persistence.xml in your classpath.

Then the cause is simple.

You may have other persistence.xml files as well in your lib/jars.

Solution, add your persistenceUnitName to entityManager bean.


<bean id="entityManagerFactory" class="org.springframework.orm.jpa.LocalContainerEntityManagerFactoryBean">
<property name="dataSource" ref="dataSource" />
<property name="persistenceUnitName" value="blahblahYourName" />

which matches the one in your persistence.xml


<persistence-unit name="blahblahYourName">

</persistence-unit>


Beastie Boys

Over celebration

The Biggest Hypocrite In England

City populations

Must have been bored today.
Started looking at en.wikipedia.org/wiki/Demographics_of_Europe then got to....

Different ways of counting city population....:


Largest_urban_areas_of_the_European_Union: Manchester is 7th largest area with 3.8 mill people.

Largest_European_metropolitan_areas: Manchester is 11th with 4.2 mill people. However in the Manchester City itself is only 440,000 (but that does not include Salford, Oldham, Trafford, Sale, etc).

Larger_Urban_Zones_(LUZ)_in_the_European_Union: Manchester is 14th with 2.8 mill people. The scousers keep interfering in the others, but this is perhaps the proper size of Manchester.


Ps. Looking at it differently

www.top500.de/cities/ranks/page000.php: Oslo is Europe's fifth largest city!

JavaZone

Another JavaZone finished. Two full days of geektime, but fun. Stressfull, as there were too many simultaneous presentations. But it is well planned, with a lot of renowned presentors.

Best presentations was:

* Tijs Rademakers and Jos Dirksen showing how to use Mule in a easy to follow style.

* James Coplien debunking some agile myths.

* Matt Raible comparing web frameworks.



My hands have been itching for a chance to test some the new tech and methods. A vaccine jab at the doctor today killed all that though!

ClubZone, the evening entertainment, while looked good on paper and probably a lot of effort to plan, was a disaster. The problem was the Norway-Greece footy match. Fitting 2500 people (okay probably some were not into football ) into the only place that showed the match was never going to work. So my group all went home to catch the second half. No free beer for us.

Now how can I introduce Mule into our stack, without a special need for it....

facebookerized

Ok. so Ive joined facebook a few months ago, and it now seems most of the people I know are members. Suppose the media attention of how dangerous it is, attracts more...

Can be a bit adictive at the start, and really nice to see what happened to old friends. But novelity will probably go down after a while. However if my core friends are on by then it is a nice tool to stay in touch and plan stuff.

Will knee spoil summer?

Was looking forward to the summer...

Had started cycling to work after the winter and planning long bike trips, prepared the golf clubs for finally some real usage and both football with mates and work was moving from indoor astroturf to real grass, then I go and blow up my knee!

So now Im hobbling like a muppet, with a knee which the doc recon may be jumpers knee combined with inflamed joint fat pads. Nice. However I hope that is the only problem as it is treatable.

Its not only sport thats affected, but also weekend trips and every tasks are restricted, so its not fun for Chloe either. But that may be mostly due to my winging.

Its been a month since I injured it and the kne had started to get better. We travelled to Gothenburg at the weekend, and it was no problem.

But yesterday I stupidly decided to walk home from work. Walk was fine, and I was starting to get optimistic about playing footy soon again. Then as popped into a shop it "clicked" and I was in total agony again. Depressing.