Assume the Opposite

Strongswan to Amazon Virtual Private Gateway

2016-10-30T20:51:00.000-04:00

Recently I needed to connect a Rackspace subnet to an AWS subnet. Our VPN software of choice in Rackspace was Strongswan, and for Amazon we wanted to use Amazon's Virtual Private Gateway (VPG).

I figured this would be easy. Set up the Virtual Private Gateway, Customer Gateway, and VPN Connection in AWS, set up Strongswan, and done. Should really only take a few minutes.

It took many hours, spread over a couple of weeks, before I actually had it working. Google searches yielded many sample configurations for Strongswan against Amazon Virtual Private Gateways, but none of them worked for me. I'm providing the configuration that worked for us in the hopes that others can be spared the same pain of figuring it out. The end configuration is straightforward: the part that was troublesome was determining the correct set of options for /etc/ipsec.conf. The only other Strongswan file I modified was /etc/ipsec.secrets; everything else was left untouched (as provided by the Debian Strongswan installation).

The pieces:

Rackspace subnet 192.168.17.0/24.
Amazon subnet 172.18.0.0/16.

The steps:

In Rackspace, spin up a Debian 8.6 (Jessie) server for Strongswan with three network interfaces:
1. PublicNet — this is the public interface over which Strongswan will communicate to the Amazon Virtual Private Gateway. Let's say Rackspace gave us 1.2.3.4 as the IP address of this interface.
2. ServiceNet — the Rackspace network for communication to Rackspace services, not used by Strongswan.
3. 192.168.17.0/24 — our private subnet on the Rackspace side. The Strongswan server will forward traffic between this network and the Amazon 172.18.0.0/16 network.
On the Strongswan server, set up iptables appropriately. I'm not going to cover iptables configuration here. There was nothing specific to Strongswan other than ensuring that both subnets were allowed and forwarding was allowed between them.
On the Strongswan server, enable forwarding. In /etc/sysctl.conf, set net.ipv4.ip_forward=1 and either trigger a reload or just reboot.
In AWS, create the Virtual Private Gateway: nothing at all to configure here.
Create the Customer Gateway. Set Routing to Static and provide the external IP of the Strongswan server (1.2.3.4 from the Strongswan box above).
In AWS, create the VPN Connection. Set Routing Options to Static and provide the Rackspace subnet (192.168.17.0/24) in Static IP Prefixes.
In AWS, in the Route Propagation tab of the appropriate Route Table, set Propagate to true for the Virtual Private Gateway. This was the only routing configuration that was needed; I did not need to configure any routes in Amazon or on the Strongswan server for the Strongswan gateway to route appropriately.
In AWS, on the Tunnel Details tab of the VPN Connection, take note of the IP address of Tunnel 1 (we won't be using the second tunnel). Let's say this value was 5.6.7.8.
In AWS, select Download Configuration on the VPN Connection and choose Vendor: Generic, Platform: Generic, and Software: Vendor Agnostic. From this file, locate the Pre-Shared Key for IPSec Tunnel #1. Let's say this value was htFtWOVqKkss2EamZ36rFoPefECU18XJ.
On the Strongswan server from step 1, install Strongswan (in this case Strongswan 5.2.1):
```
 apt-get install strongswan
```
On the Strongswan server, update /etc/ipsec.secrets to contain the following (and only the following) to map the Pre-Shared Key to the Amazon Tunnel 1 endpoint:
```
 5.6.7.8 : PSK "htFtWOVqKkss2EamZ36rFoPefECU18XJ"
```

On the Strongswan server, update /etc/ipsec.conf to contain the following (and only the following):

conn %default
  mobike=no
  compress=no
  authby=psk
  keyexchange=ikev1
  ike=aes128-sha1-modp1024!
  ikelifetime=28800s
  esp=aes128-sha1-modp1024!
  lifetime=3600s
  rekeymargin=3m
  keyingtries=3
  installpolicy=yes
  dpdaction=restart
  type=tunnel

conn dc-aws1
  leftsubnet=192.168.17.0/24
  right=5.6.7.8
  rightsubnet=172.18.0.0/16
  auto=start

Note how the only unique values here are the subnets (leftsubnet=192.168.17.0/24 and rightsubnet=172.18.0.0/16) and the Amazon Tunnel 1 endpoint (right=5.6.7.8). Everything else is boilerplate.

Restart Strongswan, and done!

After the last step, Tunnel 1 of the VPN connection should have a Status of UP. Running ipsec status on the Strongswan server should show something like

root@theserver:~# ipsec status
Security Associations (1 up, 0 connecting):
     dc-aws1[1]: ESTABLISHED 5 seconds ago, 1.2.3.4[1.2.3.4]...5.6.7.8[5.6.7.8]
     dc-aws1{1}:  INSTALLED, TUNNEL, ESP in UDP SPIs: cf07b51b_i 1965694d_o
     dc-aws1{1}:   192.168.17.0/24 === 172.18.0.0/16 
root@theserver:~#

Note that while I managed to get it working on a Debian Jessie server, I tried but failed to get the same configuration working on CentOS 7. Different defaults for Strongswan, different default software or settings on CentOS 7, or a combination of both? It remains a mystery.

Creating key pairs for Amazon EC2

2012-04-19T23:43:00.000-04:00

A few days ago I needed to generate key pairs for an Amazon account again. I thought I'd write down the process.

There are two key pairs that you need: one pair for making API calls (and using the command line tools which make API calls under the covers), and another pair to log into your EC2 machines with SSH. The following works on Linux and Mac clients “out of the box”, Windows users will need to download the appropriate software.

Now, Amazon provides facilities for generating key pairs, why not use those? The first rule of public-key cryptography is that nobody but you ever sees your private key. In fact, that's not just a rule, that's the whole point: the best way to keep a secret is never to share it. If you use Amazon's facilities to generate your private keys, you're violating this rule. Yes, malicious Amazon employees could force the use of key pairs that they have generated themselves, but that should at least be traceable. In the end, when you use Amazon's infrastructure, you are putting a certain level of trust in Amazon, but a basic tenet of security is that having security at multiple levels is A Good Thing.

Ok, with the reasons to do it yourself covered, this is how you do it:

Generating AWS Signing Certificates

 openssl req -x509 -newkey rsa:2048 -passout pass:a -keyout kx -out cert
 openssl rsa -passin pass:a -in kx -out key

The first command produces the key pair and a self-signed certificate; just hit return to accept the defaults at all the certificate request prompts (real information is not required or useful). The second command removes the password “a” from the private key file, which is generally required for automation purposes (make sure that the file and your machines are appropriately secured). The kx file can be deleted.

To use the key pair, upload the cert file as a signing certificate to Amazon and specify the location of the cert and key files in the appropriate environment variables (EC2_CERT and EC2_PRIVATE_KEY) or directly on the command line.

Generating EC2 key pairs

 ssh-keygen -b 2048 -t rsa -f aws-key

This will generate two files, aws-key and aws-key.pub containing the private and public keys respectively. Import aws-key.pub as a “key pair” (it's only the public key, not really a pair) into AWS. When you launch a Linux instance with this key, this public key is made available to the instance, where it will typically appear in an authorized_keys file for remote access via ssh. If you don't set the key as your default ssh key on your client, you can use the -i option of ssh to specify the location.

Raising the bar

2012-03-31T23:59:00.000-04:00

A few days ago I arrived home a little late, missing supper. As I approached the door, I could hear Victor and Anna bouncing in the front hall, raising a call of "Daddy! Daddy! Daddy!": what a delightful welcome home. So I came in, dropped my laptop bag (containing laptop and power brick, keyboard, mouse, tablet), and gave first Victor (seniority has its privileges) and then Anna big hugs. Then I took off my boots and turned around to see Victor balancing on my laptop bag.

Needless to say in the actual event I didn't stop to take this photo but rather cried, “Victor, what are you doing!?”. I had Victor perform this reenactment (bag empty of course) earlier today, although I now realize that the positioning is correct but the orientation of the bag is wrong. The bag had fallen on its front, which means that the keyboard, mouse, and brick were on the bottom with tablet and then laptop above.

Once I established with Victor to never, ever stand on bags again, I brought the bag to my office to assess the damage.

There was none.

No damage to the MacBook Pro, not to the Apple Wireless Keyboard, not to the iPad, and not even to the Magic Mouse. Yes, it is actually a laptop bag, so it has some padding, but not a significant amount.

I knew the MacBook Pro was durable. A rather younger Victor had once crawled across it with no ill effects, and I'd taken advantage of that durability when doing things like wedging it into hotel room safes. I might ding the aluminum but I wasn't worried about that translating into any real damage. However, with the accessories potentially forming a fulcrum underneath them I'd worried that there might be enough flex to at least crack the screen. Apparently not, and apparently that applies to the iPad (first generation) as well.

I'm having a hard time imagining a laptop from any other company surviving that without damage. Certainly none of the non-Apple laptops I've owned in the past: Victor's weight would have cracked the screens or back even without a fulcrum effect.

I see other companies attempting to match the style, but not the substance. Clearly the Dell here is intended to match the MacBook Pro. But the case of the Dell uses sheet metal, to a completely different effect. They don't get it. It's actually worse than a plastic case, because the sheet metal flexes much more than plastic. The owner of the Dell informs me that you can reboot it by applying pressure to the sheet metal on the bottom in a particular place. I'm actually afraid to hold that Dell anywhere but the edges.

Prior to owning unibody MacBook Pros, I didn't see any issue with standard laptop construction. Laptops were of course delicate pieces of machinery, and if they broke after being subjected to such abuse, well, what did you expect?

Now I expect more. Apple has raised the bar.

Mac OS X Lion: stepping backwards

2012-02-04T03:00:00.000-05:00

I finally took the plunge and upgraded my MacBook Pro to Lion. Technically I went to 10.7.2. The immediate motivation was to upgrade to the current version of Xcode. I'd delayed for two reasons: I'd heard about issues with a number of major applications, and I knew there were a couple of major changes that would, at best, take some getting used to.

My assumption is that by this point companies have fixed their Lion-related issues, so I just made sure I had all the relevant updates and so far so good. The known changes were another thing, though.

Yes, scrolling is “backwards” now. I understand (and agree with) the motivation for changing it, but I can see it is going to take me a long time to get used to it, particularly since I regularly use Linux and Windows boxes too.

The other major change is that "full-screen mode" uses separate desktops now, so applications on the second monitor disappear. I hate this, as apparently do many other people. I'd say about 50% of the time I'd have one application in full screen mode on one monitor and one or more activities on the other that I was peripherally monitoring... no more of that now that I'm on Lion. No more making Chrome full-screen for writing a blog entry while watching some long-running process in a Terminal on another monitor... like I'm doing right now, except not full-screen. I think I understand why Apple did this too: the previous ways of doing full-screen didn't work well for a lot of scenarios and each application did it in a different way. But it's rather annoying to me since the pre-Lion methods mostly worked really well for my scenarios.

The separate-desktop for full-screen mode idea works great when you have just a single screen. But since I have multiple screens, I want the main activity full-screen (no distractions!) on the main monitor and all the side activities on the second monitor. I hope Apple comes up with a good paradigm for that, but I suspect they don't see it as an issue that needs to be resolved. There are hacks to work around this problem but there are significant issues to them. People say “just don't use full-screen” but there is no “no-chrome” mode on most applications to achieve the effect that I'd get with most full-screen implementations on Snow Leopard. That's what I really want, a way to get rid of the excess application chrome. Perhaps Apple should provide a standard mechanism for that.

The final Lion issue (for this post anyway) is Preview. In Snow Leopard, small images would scale badly (no anti-aliasing etc) when you enlarged them in Preview. On the other hand, other software like Google Chrome scaled images nicely. But that's ok, I'd go full-screen in Preview and then the images would look good. I was hoping Lion would fix this. Lion did, indeed, make the behaviour consistent... full-screen images now look like garbage too. See the image at the top for the difference between what Chrome does (left) and what Preview does (right).

One more issue: the Finder crashed while I was writing this. I don't remember the last time the Finder crashed on Snow Leopard.

So with all the negativity out of the way, I will say that I do like Launchpad and Preview does seem a lot faster than it was.

Amazon S3 reliability

2012-02-02T02:12:00.000-05:00

According to the Amazon Web Services Blog, they currently have 762 billion objects in Amazon S3. That's impressive. The popularity of Amazon S3 isn't hard to understand: it's easy to use, only $0.14 per gigabyte-month in most regions, and is “designed to provide 99.999999999% durability and 99.99% availability of objects over a given year” (quoted from Amazon Simple Storage Service (Amazon S3)).

That's an impressive statement: 99.999999999% durability. That means that for my 7,038,080 objects, I could expect to lose one in 14,208 years, or to put it another way I have a 0.007% chance of losing an object in a particular year. That seems like a pretty minuscule risk.

But then you look at the scale of Amazon Web Services. There are 762 billion objects in Amazon S3. That means by their design criteria (ignoring the reduced redundancy storage option) they expect to lose at least seven of those objects this year. Have you checked your objects today?

Now I doubt that the “99.999999999%” probability is a “normal operating conditions” number. I suspect that's a guess at the probability of three Amazon data centres being taken out at once, or something like that. In normal operations I suspect that you might as well just call it 100% reliable in terms of preserving your object. But I find it amazing that they're at the scale where such minuscule probabilities become certainties (if you naïvely apply them).

RAID redo

2012-01-30T17:44:00.000-05:00

I spent some time this weekend rebuilding the family file server, which is a Linux box. The last time I rebuilt it was several years ago, and at that time I figured I should set it up with (software) RAID 5 to avoid the hassle of having the recover from backup if a disk failed. This worked great. A few years ago a disk did fail, I bought a new one, plugged it in, it rebuilt and everything was good.

Similarly, a few years back at work I configured our new VMware ESXi box with an eight disk RAID 5 array (hardware RAID). Last year a disk failed, and on that machine I didn't even have to power it down. I yanked out the old disk, hot-plugged the new, and the machine didn't miss a beat.

So, RAID 5 is wonderful, right? Well, the time between the disk failure and disk replacement was somewhat stressful. In both cases, the disk couldn't be replaced immediately. The disk in my home server failed the night before I left on a trip, so I couldn't replace it for two weeks. And the new disk for the work machine had to be ordered and took some time to arrive. There was this gap where there was no redundancy. In both cases there were backups, but restoring from backup takes a lot more time than just plugging in a disk, and I realized that I really, really didn't want to waste my time setting up machines when simply providing a little more redundancy would have removed the need. “You can ask me for anything you like, except time.”

So the home server needed a bit of maintenance (for example, the root volume was low on space) so I figured while I was doing that I would reorganize the server and take some extra time to fix the redundancy problem, moving to RAID 6 on the four disks. RAID 6 would allow two disks to fail without loss of data. I'd lose some space but the extra redundancy would be worth it. Why RAID 6 over RAID 10? Well, RAID 6 provides better error checking at the expense of some speed.

This is what I did to prepare:

Took an LVM snapshot of the root partition and copied that snapshot as an image to an external drive. Why an image? Sometimes the permissions and ownership of files are important, I like to preserve that metadata for the root partition.
Copied the truly critical data on the root partition to another machine for extra redundancy. The existing backup process copies the data offsite, which is good for safety but not so good for quick recovery, so I wanted to make sure I didn't have to use the offsite backup.
Copied the contents of the other partitions to the external drive. The other partitions don't contain anything particularly critical so I didn't feel the need for redundancy there.
Zero'd out all the drives with dd if=/dev/zero of=/dev/sdX. Some sites suggested this was important, that the Linux software RAID drivers expected the disks to be zeroed. It seems unlikely but it didn't cost me anything to do it. There was an interesting result here, though: the first two drives ran at 9.1Mb/s, while the second two ran at 7.7Mb/s. If I recall correctly there are three identical drives and the one I replaced which is a different brand, so it isn't a drive issue but rather a controller issue: the secondary controller is slower.

Now that the machine was a blank slate, I set it up from scratch:

Start the Debian 6.0.3 installer from a USB key.
In the installer, partition each of the four disks with two partitions: one small 500M partition and one big partition with the rest of the space (~500G).
Set up RAID 1 across the small partitions (four-way mirroring).
Set up RAID 6 across the large partitions.
Format the RAID 1 volume as ext3, mounted as /boot.
Create an LVM volume group called “main” and added the RAID 6 volume to it.
Create a 5G logical volume for /.
Create a 5G logical volume for /home.
Create a 10G logical volume for swap.
Create a 20G logical volume for /tmp.
Create a 200G logical volume for /important.
Create a 200G logical volume for /ephemeral.
Tell the installer that this machine should be a DNS, file, and ssh server and let the installer run to completion.
Copy the important files to /important and the ephemeral files to /ephemeral.
Configure Samba and NFS.

So why this particular structure? Well, Linux can't boot from a software RAID 6 partition, so I needed to put /boot on something that Linux could boot from, therefore the RAID 1 partition. The separate logical volumes are primarily about different backup policies. The 5G size for / and /home is to limit growth (these volumes will be backed up as filesystem images) and 5G fits on a DVD for backup, in case I want to do that at some point. Swap of course needs to be inside the RAID array if you don't want the machine to crash when a disk fails: yes Linux knows how to efficiently stripe swap across multiple disks but a disk failure will cause corruption or a crash. The 20G volume for /tmp is so that there's lots of temp space and it's on a separate volume so backup processes can ignore it. The /important volume contains user files that are the important data and can be backed up on a file-by-file basis (as opposed to / which is backed up as an filesystem image). The /ephemeral volume contains files that don't need to be backed up. All filesystems have the noatime mount flag set, and they're all ext4 except for /boot which is ext3.

If you're counting you'll note that there is still a lot of empty space in that LVM volume group. There are several reasons for this:

Some empty space is required if I want to make an LVM snapshot, so I never want to use up all the space.
I frequently make additional temporary volumes for a variety of purposes.
If I need to expand any particular logical volume, there is room to do so.

Safe Facebooking with Chrome

2012-01-16T03:00:00.000-05:00

I don't like the idea that every page on the web with a Like button will tell Facebook that I've browsed to that page. But at least that information is anonymous... so long as I'm not logged into Facebook.

I used to just not stay logged in, only logging into Facebook for “Facebook sessions” in incognito mode, use a different browser and clear the history, etc or similar such mechanisms. But I found this post about Chrome's certificate pinning where Chris describes how to “Twitter Like A Boss”. This inspired me to run a new Chrome process with a separate profile for Facebook, using this command line (via an alias):

/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome

  --user-data-dir=$HOME/.mb/chrome-safe-browsing/facebook

  --disable-plugins

  --proxy-server=localhost:1

  --proxy-bypass-list='https://facebook.com,https://*.facebook.com,https://*.fbcdn.net,https://*.akamaihd.net'

  https://facebook.com/

With no line breaks, of course.

This isolates Facebook's cookies into a separate profile, which prevents my general web browing in another Chrome instance from being tracked under my Facebook login. It also disables browsing any other sites (following a link will fail, you need to copy/paste into another browser), forces all Facebook connections to use SSL, and disables plugins.

Note that this doesn't use incognito mode (I want to stay logged in now that my everyday browsing isn't affected) and it doesn't use certificate pinning. The main point was to stop leaking information to Facebook. I may get around to figuring out the certificates to pin at some point, but really I'm hoping that a better solution will arise to the problem that certificate pinning is addressing (which is not to say that certificate pinning hasn't already proved effective in critical scenarios).

It's harder to do the same thing with Google because I use so many Google services. The core principle is to use a separate browser instance for each login for corporations like Facebook and Google that have code on so many third-party web pages; this is one way of doing that which happens to have additional security benefits (forcing SSL etc).

Adventures in taxation: Apple's App Store versus Google's Android Market

2012-01-10T03:00:00.000-05:00

I recently went through the process of registering to distribute paid applications in both Apple's App Store and Google's Android Market. I could talk about those processes, but that's not what this post is about. Wait, I couldn't talk about Apple's process anyway, as that agreement explicitly forbids discussing said agreement.

Anyway, this post is about taxes, not about how fast Google's approval process was (pretty fast) or how slow Apple's was (longer but not really that long), or about how Google did the bank account verification but Apple didn't, or about how Apple actually walked me through the banking information whereas Google just said "enter all the numbers"... ok, really, I'm not talking about those items.

I am not a tax lawyer or accountant, so I may well be completely wrong here, but my research so far indicates to me that if I put an app in an appstore (or sell a subscription to web-based service) I am required to charge GST/HST to customers based in Canada. If the customer is not in Canada, I do not need to charge any tax. So, how do I arrange to do that?

With Apple, the path is to fill out the appropriate paperwork such that Apple can collect the taxes and submit them appropriately. Once they have processed those forms, Apple will charge the GST/HST on any paid apps I sell and submit that tax to the Canada Revenue Agency. I no longer have to worry about it.

With Google, it isn't so simple. I need to tell Google the rules about how much tax to charge depending on the location of the buyer and I'll have to deal with submitting the tax to the Canada Revenue Agency. I suspect this works better for larger companies (where Apple's one-size-fits-all mechanism doesn't work) but as a simple one-location seller Apple's approach is simpler for me. I wonder how Apple deals with organizations that have multiple locations and therefore don't have simple rules for which tax to charge where?

Now I need to figure out whether I can just charge GST for Google or whether I need to actually have a different per-province rate. Since Google seems to support per-province tax rates, I'm thinking that it is the second. I mean, if you look at the rules, they're quite simple. Here's an excerpt (from GST/HST Technical Information Bulletin B-103 [53 pages]):

If the Canadian rights in respect of a supply of intangible personal property (other than a supply of intangible personal property that relates to real property or tangible personal property or a supply of intangible personal property that relates to services that is deemed to be made in a province based on the place of supply rule that is explained in Part IV of this section), can only be used primarily (more than 50%) in the participating provinces, the supply is proposed to be made in a participating province if an equal or greater proportion of the Canadian rights cannot be used in another participating province.

I applaud the Canada Revenue Agency for the crystal clarity of their online documentation. But I think I'll seek professional advice, just to be safe.

Storage Spaces: Linux LVM for Windows?

2012-01-07T03:00:00.000-05:00

When I first read about the Windows 8 Storage Spaces feature, I thought, awesome, Linux LVM capabilities for Windows! More specifically, a combination of the multiple device (MD) management in the kernel and the logical volume manager (LVM).

But then I realized that I hadn't read anything about atomic snapshot capabilities, which is my favorite feature of LVM2 on Linux. Atomic snapshots make consistent hot backups trivial. Snapshots are the top reason I set up LVM on every Linux box I create. Without snapshots, Storage Spaces seems significantly less interesting.

Hopefully Storage Spaces will have atomic snapshot capability and they just aren't talking about it yet.

Google gives itself a red card

2012-01-06T03:00:00.001-05:00

So to prove that they are a fair referee for search ranking, Google has given the Chrome team a red card and effectively banned the main Chrome page from the first page of rankings for 60 days.

I approve. If this were some non-Google site the punishment would seem out of proportion to the offense — there was only one link that passed PageRank and it seems pretty clear that Google didn't intend the campaign to create such links — but since this is Google itself, they do need to hold themselves to a higher standard. And hey, they deserve to be given a penalty just for the incredibly poor quality of the campaign: articles that say nothing about Chrome or indeed anything at all.

Will this hurt Chrome in the short term? I believe so. As a computer geek, I already use Chrome most of the time and I'd never need to do a search to find a browser. But I'm not most people. Most people reading this blog aren't “most people”. “Most people” don't know a lot about browsers and may well discover Chrome through a search.

Will this do any real damage to Google or Chrome in the long term? I don't think so. I think Google has responded well overall. As for Chrome, Apple and Microsoft aren't particularly interested in the web as such, so Safari and Internet Explorer aren't keeping up with Chrome. Mozilla has lost its way, instituting policies such as rapid automatic updates (like Chrome) without accepting the corollary that the updates have got to be transparent (unlike Chrome). I think there is a culture issue at Mozilla. And Google understands security better than the rest, with silent automatic silent updates for Chrome from the beginning and extra security measures such as public key pinning. Chrome has growing mind share due to all this and I think Chrome's market share will continue to grow for some time, or at least until a competitor changes path significantly.

Credit bureaus: how to annoy customers and inspire skepticism and distrust

2011-12-31T03:00:00.000-05:00

Earlier this week I received a new Mastercard in the mail. But I hadn't applied for one and the first name wasn't right. Identity theft?

So first, call the issuing bank: they would cancel the card. Then I called Equifax and TransUnion; all was good with my credit reports. Whatever was up with this person using my address and a near-name, they hadn't been connected to my credit file. I had the bureaus put an alert on my file just in case, so that extra identity verification would be done for any credit requests. Equifax insisted on charging me $5.65 to put an alert on my file, TransUnion did not charge me. I also called Canada Post to ensure that there were no mail redirects happening.

Then today I received a call from the same bank again, about another credit card application. The call was triggered by the alert on my credit file. The bank said they would request the applicant go into a branch to verify their identity in the hope of “catching them”. Seems unlikely.

This made me want to actually look at my credit file: we'd renewed our mortgage recently, so we knew all was good at that time, but the assertion of the credit bureau people that “nothing had changed” since that event was no longer enough for me. I wanted to see the files myself. And then I thought, maybe I should sign up for credit monitoring too.

First, Equifax. I go through the signup process, creating a username and password. Then I'm prompted to call Equifax for additional verification. Fair enough, in fact that seems a good thing. I call the number, and have to wade through a number of menus, all of which have minute+ preambles. You would think that you'd be given a direct “additional verification” number, rather than a general number. Moving past that, the preambles (verbosity: maximum) prompting me to go to the website were exceedingly annoying: I'd just been on the website, stop wasting a whole lot of my time by telling me to go there first, repeatedly! Eventually, I get a human: a bored male voice answers. He asks me a number of questions to verify my identity, but it seemed he just couldn't get me off the phone fast enough, to the point of being rude. Clearly there is an significant emphasis on call duration or volume. He said I'd get an email with my password. I'm thinking, why, I already set up my password online? But I check, and I have not one, but four identical emails with the password I'd provided online in plaintext. What the hell? What idiot stores passwords in plaintext these days, and sends them over email that way? These people are responsible for the security of our credit information? I'd randomly generated a password unique to Equifax, but still concerning.

I then attempt to sign up for credit monitoring. But it quickly becomes clear that the provider of the monitoring service is a separate company from Equifax and the integration is poor: it seemed I was going to have to enter all my information over again and create a separate account for that product. Given that I decided to just request a credit report (which had nothing unexpected in it).

Next, TransUnion. Ok, their site seems a little more professional, and their credit monitoring, while it is probably also a separate company, seems better integrated. But I couldn't even get past creating an account there. I was asked to provide an user id, but there was no indication of whether I'd picked a unique one. So I went to the next screen, where it said "the information matched an existing account". What does that mean? Was there a userid conflict, or is there already an account with my personal details? Calling them seemed to indicate the first, but I couldn't get any further. Once you get to that screen, there is no way to go back, you have to start over. In the end I gave up for today.

These companies are all about tracking information that is particularly vital, both to financial institutions and the population at large. Accuracy is key and security is critical. But even ignoring the Equifax password security issue, there is a lot of poor design in both the technology and the processes. While the individual items I encountered may mostly just be annoying, it leads me to wonder whether these issues are reflective of the quality of the rest of the systems for these two companies. My experience with both companies doesn't leave me with warm fuzzy feelings about the safety of my credit information.

Strange expectations

2011-12-30T03:00:00.000-05:00

Last night I watched the Apollo 11 launch with my 5-year old son. Afterwards, he turned to me and said:

“I've changed my mind. When I grow up, I want to be a, umm, one of the people in the rockets.”

“You mean an astronaut? Someone who goes into space is an astronaut.”

“Yes. And then, when I'm old enough to drive, then I want to be a race car driver.”

It was hard not to laugh, but he just doesn't have the knowledge and experience to have what adults would consider “reasonable expectations”. It's not that he wants to be an astronaut or a race car driver that is funny, it is that he knows it is going to be a long time before he can drive, so he figures he may as well be an astronaut in the meantime — after all, as far as he knows there are no age limitations for “people in rockets”, and from his perspective the one is no harder than the other.

This was a reminder to me that when designing technology we need to be sure to reset our expectations when dealing with those who do not have our knowledge and experience. They are going to make assumptions that seem bizarre: it's not just that they don't have the knowledge and experience, it is that they don't have the base expectations that we have accumulated over our experience.

The Gravity project

2011-12-17T15:00:00.000-05:00

What is the Gravity project? Gravity is “OSGi in ActionScript”, which we released last summer as the Client Component Framework in the Adobe Digital Enterprise Platform. A year ago Stacy Young posted about Gravity in his blog with a link here “if you're interested”. Well, I've actually been blogging about Gravity over on the Adobe Gravity blog, not here, but I've been reminded that I should at least provide a link!

Apple and the Paradox of Choice

2011-12-15T00:30:00.000-05:00

I have a confession to make. I read Daring Fireball. I find that if you tune out the Apple bias, Gruber does provide some interesting information.

For example, earlier today he posted a link to Barry Schwartz's TED talk on the paradox of choice. I had already seen it, but it is a great presentation and was a good reminder that more choice is not an unambiguous good.

The interesting bit is that later in the day Gruber posted a bit questioning why nobody lines up for new Android phones like they do for new iPhones. I think one large part of the answer is simply the paradox of choice. One implication of the paradox of choice is that on average the level of happiness with an Android phone will be lower than that with an iPhone, even if all other things are equal, because the Apple user doesn't have to second-guess whether maybe they could have bought a better iPhone.

I'm not saying that's the only factor, but I found it interesting to see Gruber put the two items so close together without noting the applicability of one to the other.

The Google garden

2011-12-11T21:00:00.000-05:00

I bought a book via Google's Android Market the other night. It was not what I'd originally intended to do.

I wasn't tired but I was in pain; I'd picked up my five-year old the wrong way (they just keep growing!) and hurt my back. So I figured I'd just read a novel since I couldn't concentrate, but I didn't have any that I hadn't read. Hmm, ok, eBooks are generally outrageously priced but if I bought one I could read it right now.

First, I looked for interesting books in the Kobo application that came preinstalled on my Android phone. I couldn't find anything I wanted to read there, so I went to the Android store to get the Kindle reader, to see if there was anything from Amazon I was interested in. But of course once in the Android Market application there was this Books tab... so naturally I looked there. I found a book that I was interested in and bought it. Never got to the Kindle app.

Now, I bought it on my phone, but I was sitting in front of my laptop as I was doing it. I wasn't buying it on my phone because I wanted to read it on my phone at that particular moment, but rather just because I did want to be able to read it on my phone later if I needed to. So to figure out how to read this book I just bought, I typed in a quick query on my laptop, and up comes the Google books site and since I'm logged in, there's my book. So I never did read it on my phone.

I find this impulse buy sequence interesting because:

When I started I had no thought of buying the book from the Android Market (I'd forgotten that Google was selling books), and
when I switched to my laptop I had no intention of reading the book on my laptop (I didn't know it was possible).

I've long thought that the ubiquity of Google allows them to enter markets where the barrier to entry is high. To me this is an example of that, both in that Google controls the Android Market and therefore can feature whatever they want there, and in that since I use other Google services and was therefore logged in, finding my book on my laptop was a matter of seconds despite the fact that I didn't even know I could do that. I managed to accidentally discover both Google services in minutes in the path of least resistance. While I wasn't even thinking about buying from Google in the beginning, in the end I'm happy I did because I now know that I can read the books I buy there in any browser just by logging into my Google account. I can be at another location without my own computer and still be able to do so.

I believe this ubiquity could allow Google to succeed with Google+ despite the daunting head-start that Facebook has: people will end up in Google+ by accident, and some will start to use it despite not having originally intended to do so. This plus the network effect could grow Google+ to critical mass if Google sticks it out.

Some people argue that Google's just trying to build a Walled Garden like Apple. I don't agree. Certainly they have a big garden, and that contributed to the fact that in the end I bought from Google rather than Kobo or Amazon, but I don't see the walls. I don't have to have Google hardware to read the book, I don't even have to have Android, the only thing I need is to have is a web browser.

With respect to Google+ versus Facebook, well, I trust Google to be more secure and certainly hope that they'll be less random.

Reboot!

2011-11-28T00:42:00.000-05:00

I'm back, and the blog has a new name: Assume the Opposite.

It's been a long time since I've written anything here, primarily due to the lack of comment support in the home-grown solution I was using: I wanted feedback! As time passed it became clear that I wasn't going to get around to adding comment support any time soon so it was time to find an alternative platform. So after much fiddling with DNS and Blogger here we are.

Why “Assume the Opposite”? Proof by Contradiction is a standard mathematical technique where you assume the opposite of a hypothesis and follow the ramifications until you reach a contradiction. If you reach a contradiction, you have proven that your original hypothesis is true.

However, an inability to find a contradiction can also be illuminating. A classic example of this is Euclid's Fifth Postulate: for two thousand years mathematicians tried to prove that it could be derived from the other four postulates, or convinced themselves that they had derived it via other "simpler" postulates. It wasn't until 1830 that two mathematicians independently assumed that it was false and found that you could build a completely consistent geometry around that assumption (now called Bolyai-Lobachevskian geometry after those mathematicians). Einstein's general theory of relativity, which thus far seems to describe the universe well, postulates that space is curved and therefore Euclid's Fifth Postulate does not accurately describe the world we live in.

Now, computer science (and technology in general) is not mathematics: computer programs exist to enable the end users to Get Something Done, and computer source code is consumed as literature by programmers in addition to being evaluated deterministically by a computer. Nonetheless, I find assuming the opposite of my beliefs to be useful tool, not to prove them true, but rather to prove them false. Agile methodology exhorts us to Do the Simplest Thing Possible. When I find myself thinking “We'll definitely need X” (for example, we'll need a relational database), assuming the opposite, exploring where the issues might lie if we didn't have X, frequently leads to greater simplicity. Perhaps we don't really need X (a simple file would do), or we only need a particular aspect of X (a NoSQL database would work).

Question received wisdom. Assume the opposite, and see if it leads to simplicity instead of trouble.

P.S. I was tempted to use a purple cube for the picture but decided it would just confuse most people.

Gitosis Remote Repository Cheat Sheet

2010-03-15T22:58:00.000-04:00

I've found myself looking up how to do various operations on remote gitosis repositories recently, so I decided to create myself a cheat sheet. My remote repositories are on Debian systems, so the users and other configuration options are those that you get when you do a stock install of gitosis on a Debian system. Most of this is shamelessly stolen from Garry Dolley's “Hosting Git repositories, The Easy (and Secure) Way” with slight adaptations for the Debian differences. The idea is to cover the specific commands you need to deal with Debian remote gitosis repositories. This intentially doesn't cover anything that you can figure out from just doing “man git” and digging in.

Creating a new local repository from a remote repository

There is a remote repository that you don't have locally, and you want to get a copy to work on.

git clone gitosis@<server>:<repository>.git
cd <repository>

Note that the admin repository is gitosis-admin.

Setting up the remote origin on a new (non-clone) local repository

You are creating a new repository on the remote server. You have edited the gitosis-admin configuration files appropriately and pushed the changes, and performed

git init

on the local directory to create a new local repository, but the remote and local repositories are not yet connected.

git remote add origin gitosis@<server>:<repository>.git

Pushing a new local repository to the remote repository for the first time

I must admit this command seems more complicated than it should need to be. But at least you only need to do this once per repository.

git push origin master:refs/heads/master

Updated 2012-07-30: yes, it is too complicated. For some time I've been using this shorter version:

git push origin master

Understanding ApplicationDomains

2010-03-14T23:06:00.000-04:00

I've been explaining how ApplicationDomains work in ActionScript frequently in recent days, so I'd
thought I'd put down an explanation here.

ApplicationDomains contain ActionScript class definitions.^[1] The rules for ApplicationDomains are:

Every ApplicationDomain except for the system ApplicationDomain has a parent ApplicationDomain, so ApplicationDomains form a tree structure.
Definitions in parent ApplicationDomains are used over definitions in child ApplicationDomains.
In a particular ApplicationDomain, the “first definition in” is used.

The Flash runtime has a special ApplicationDomain called the System ApplicationDomain, and it is special for two reasons: it contains all the definitions that are built into the Flash runtime, and it is the only ApplicationDomain that doesn’t have a parent. All other ApplicationDomains are descendants of the system ApplicationDomain. This means that the classes that are built-in to the Flash runtime will always win over classes defined in swf files loaded by the runtime.

When a swf is loaded, all the class definitions go into a particular ApplicationDomain. For the main^[2] swf of an application, the Flash runtime creates a new ApplicationDomain that is a child of the system ApplicationDomain. When the application loads other swfs, it can choose the ApplicationDomain that the swf will be loaded into.

Ok, too many words, time for a demo:

This application visually shows how ApplicationDomains affect which version of a class is instantiated, when there are multiple versions of a class present. The tree shown corresponds to the ApplicationDomain hierarchy created by this application: each ellipse corresponds to an ApplicationDomain. When you hover over an ellipse, six small coloured ellipses appear, corresponding to one of six different swfs. Clicking on a small ellipse will load the swf corresponding to the small ellipse into the ApplicationDomain corresponding to the large ellipse, drawing an instance of the class on that large ellipse. The six swfs all contain the same Ellipse class, but each version draws the ellipse in a different colour. This is the ellipse class:

package
{
    import flash.display.Sprite;
    import flash.events.Event;

    public class Ellipse extends Sprite
    {
        public function Ellipse()
        {
            addEventListener(Event.ADDED_TO_STAGE, addedToStageHandler);
        }
        
        private function addedToStageHandler(event:Event):void
        {
            removeEventListener(Event.ADDED_TO_STAGE, addedToStageHandler);
            graphics.lineStyle(1);
            graphics.beginFill(ELLIPSE::COLOUR);
            graphics.drawEllipse(0, 0, 50, 25);
            graphics.endFill();
        }
    }
}

The important part to note is the ELLIPSE::COLOUR constant. We create six different versions of this class by simply compiling the class six times, defining the constant differently each time:

mxmlc -define=ELLIPSE::COLOUR,0xff0000 -default-size 50 25 -o=ellipse-r.swf Ellipse.as
mxmlc -define=ELLIPSE::COLOUR,0x00ff00 -default-size 50 25 -o=ellipse-g.swf Ellipse.as
mxmlc -define=ELLIPSE::COLOUR,0x0000ff -default-size 50 25 -o=ellipse-b.swf Ellipse.as
mxmlc -define=ELLIPSE::COLOUR,0x00ffff -default-size 50 25 -o=ellipse-c.swf Ellipse.as
mxmlc -define=ELLIPSE::COLOUR,0xff00ff -default-size 50 25 -o=ellipse-m.swf Ellipse.as
mxmlc -define=ELLIPSE::COLOUR,0xffff00 -default-size 50 25 -o=ellipse-y.swf Ellipse.as

So to see the rules mentioned at the start in action, click the yellow ellipse in ApplicationDomain 111. That ellipse will turn yellow, because ellipse-y.swf, containing the yellow version of Ellipse, was loaded into ApplicationDomain 111 and an instance of Ellipse was created in that ApplicationDomain and drawn on the large ellipse. Then click the red ellipse in ApplicationDomain 1; this will load ellipse-r.swf into ApplicationDomain 1 and draw an instance from that ApplicationDomain on that ellipse. Click the small yellow ellipse (or any other ellipse) in ApplicationDomain 112 and it will turn red. Why? Since the red version of Ellipse was loaded into an ancestor domain, the new instantiations of Ellipse in ApplicationDomain 112 will be of the red version and any Ellipse versions loaded into ApplicationDomain 112 will be ignored.

To compile the main application from source:

mxmlc -o=ad-example.swf ApplicationDomainExample.as

I compiled these examples with the Flex 3.5 SDK.

Technically, all varieties of ActionScript definitions are looked up via ApplicationDomains, not just class definitions.
The swf referenced in the <object> tag of the html wrapper for a web application or the swf specified in the <content> tag of the application descriptor for an Air application.

Thawte Privacy Breach?

2010-03-11T23:01:00.000-05:00

I just received a snail mail notice from Thawte indicating that I have certificates that are up for renewal. Now, I do have certificates from Thawte, so I assumed that the notice was about one of those... but I was thinking, I don't have any certificates expiring soon, do I?

Then I opened the letter. It did, indeed, indicate that two web server certificates, specified by domain name and order number, were up for renewal in April and May. But they aren't my domains. If I were a malicious person, I could probably contact Thawte and, armed with the domain name, order number, certificate type, and expiry date, get access to mess with the accounts: change the password, get the certificate revoked, etc.

And of course, having received information for other people, I have to wonder, who has received mine?

Hello World

2010-02-28T16:23:00.000-05:00

Following the long geek tradition of self-referential names, I was tempted to call this blog Yet Another Technology Blog. But that's been done to death and YATB isn't particularly pronounceable.

And then I thought about calling it Mark's Standards, Technology, Unknowns, Practicalities, Innovation, and Design blog. That's quite a mouthful, but it can conveniently be abbreviated to “Mark's STUPID blog”. But that doesn't work because I fully expect that some of my entries will be beyond STUPID. At least in retrospect.

Finally I realized that my topics frequently come from someone popping their head through my door with “Uhm, Mark?”, and so the title of this blog was born.

In this blog I'll talk about, well, whatever I feel like, but it will mostly be technology-centric, from the social aspects of technology consumption and production to design and coding.