Testing Web services in a development environment over SSL/TLS (HTTPS) can be a problem if your development environment doesn’t have a suitable SSL Cert. In such cases, creating a self-signed cert is usually sufficient, but you have to ensure that your client applications (including browsers) trust the cert you created yourself.
Here’s a recipe for creating a self-signed certificate and installing it into Firefox so that the Developer window doesn’t fill up with warnings (such as about Strict-Transport-Security headers being ignored). The recipe assumes you have keytool (usually in the “bin” of your JDK). This is for Windows, but similar steps apply to other OSs.
keytool.exe -genkey -alias selfsigned -keyalg RSA -keysize 2048 -sigalg SHA256withRSA -validity 3650 -keypass [click title to read more…]
Sometimes the only way to get a development tool installed is to compile it from source. In fact, many Open Source projects will assume this is how you intend to install. Some nice people out there might actually compile it for you and make the binaries available, but unless you have 100% trust in whoever is supplying these, compiling from source might be the best route. Perl, my Swiss Army Knife of choice, has many contributors offering modules that go through an elaborate compile/configure/test routine. Such installation processes can take a few minutes to complete, which is often a good excuse to go get a coffee.
The build scripts accompanying such from-source resources often include liberal dollops of commentary that [click title to read more…]
In the past few days the tech community has gone into a panic over a discovery that computers have been vulnerable to a specific kind of attack for over 20 years. Despite being present for a very long time, it would seem that nobody has exploited the vulnerability. The details are complicated, but let’s consider a part of their discovery in more simple terms:
The problem is in the processor (CPU), the thing that does calculations using information in the computer’s main memory (RAM). Decades ago, CPU designers from companies like Intel, AMD and others, decided that they could speed up a computer if they could get it to do some calculations ahead of time, even if the results of [click title to read more…]
My “day job” as a tech consultant brings me into contact with a lot of software companies, but occasionally I encounter an enterprise that is in the process of becoming a software company. This happens when the company determines that their traditional line of business not only needs to incorporate a software/online strategy, but actually needs to make this the new focus. Motivations range from survival in the face of tech-savvy competitors to expansion into a previously untapped market.
While I enjoy helping these companies explore technology options, it is equally rewarding to help them establish a development process, being a formal approach to the creation of their new products or services. The processes that we in the software world [click title to read more…]
We’ve all heard of “back door” access. This refers to a situation where some kind of access to the system is available that does not go through the normal procedures, and is sometimes present during the early stages of development to provide convenient and efficient ways to interact with a partially complete system.
Obviously, it is essential that the final version of the solution is built without these back doors present, otherwise you have a major hole in your security.
Then there is the front door, and that will be present in the final version you put into the hands of your customers.
During development it is tempting to make the front door as “convenient” as the back door, just [click title to read more…]