Sunday, February 27, 2011

If you run firefox– install https everywhere now

I'll do a post later about session hijacking, firesheep and the evils of non https based websites. In the meantime, if you use firefox be sure to the run the https everywhere extension.  Without https everywhere I would be concerned about accessing my accounts on a public wifi network.  HTTPS Everywhere forces the browser to use https when accessing any website that supports both http and https.

(By the way If you have a security question, or question on any of the topics I cover on my blog leave a comment and I’ll be happy to do a post answering your questions)

Saturday, February 12, 2011

The 3 A's of security when buying a coffee

The three A's of security are  authorization, authentication and auditing.  While these A's apply to computer security they are also present in most transactions.  For example, lets look at what happens when Igor wants to buy a coffee:



When Igor goes to buy a coffee with his credit card, the cashier starts by asking Igor for a Picture ID, then the cashier swipes Igor's card (which dials the head office to make sure there is money), finally a receipt is

printed. After all that Igor gets his coffee. Let's look at the 3 A's in this transaction

  • Authentication - Prove the entity is the entity -  Ensure Igor is Igor by making sure the picture on his drivers license matches his face.

  • Authorization - Prove an entity is allowed to do something - Ensure Igor is allowed to place a 5$ charge on his credit card.

  • Auditing - Record what has occurred - Write down that a coffee was purchased.




Authentication, Authorization, and Auditing in the coffee shop

Saturday, January 29, 2011

Why do I keep getting exception code e0434352?

If you want to know how to debug CLR exceptions using cdb then read this post.



Exception code e0434352 is the exception code used internally by the CLR to represent most exceptions(*).



Regardless of if you throw a System.NullReferenceException or a System.ArgumentException in C#, you'll throw a SEH exception e0434352 under the covers.



A fun way to validate this theory is to watch what happens to the CLR exceptions settings in cdb. Fire up cdb, and see the state of clr exceptions:



0:000> .shell -ci "sx" findstr clr
clr - CLR exception - second-chance break - not handled
clrn - CLR notification exception - break - handled
.shell: Process exited


Now, set the exception handler for exception number e0434352 and recheck the value of the clr exception handler:

0:000> sxe e0434352
0:000> .shell -ci "sx" findstr clr
clr - CLR exception - break - not handled
clrn - CLR notification exception - break - handled
.shell: Process exited


Armed with this knowledge I expect this post makes more sense.



NitPickers Corner:

(*) I know of at least Divide by Zero not using this exception code.

Sunday, January 23, 2011

Using NUnit to explore static field initialization

Given the following code:



class Constants
{
public static readonly Constants Instance = new Constants();
public static readonly string ApplicationName = "ig2600";
public readonly string CachedClassName;

public Constants()
{
CachedClassName = GetQualifiedClassName("Constants");
}

public static string GetQualifiedClassName(string className)
{
return string.Format("{0}::{1}", ApplicationName, className);
}
}


Which of the below tests pass?

[TestFixture]
public class TestConstants
{
[TestFixture]
public class TestConstants
{
[Test]
public void TestOne()
{
Assert.That(Constants.Instance.CachedClassName, Is.EqualTo("ig2600::Constants"));
}

[Test]
public void TestTwo()
{
Assert.That(Constants.Instance.CachedClassName, Is.EqualTo("::Constants"));
}
}
}


Not sure? Download the code with mercurial from  https://bitbucket.org/idvorkin/ig2600_blog, then fire up VS and NUnit, and look at the StaticFieldMystery project.

Saturday, January 22, 2011

Four Visual Studio Extensions You Need To Be Using

I spend a lot of time in Visual Studio and these extensions  make visual studio even more awesome.  If you haven't used VS to install  extensions, it's  trivial.  Follow along by doing:



Tools -> Extension Manager -> Online Gallery -> Search



Here are the extensions  I use, and strongly recommend you try. I have seen no adverse problems from running any of these extensions.  Here are the extensions I use:



Productivity Power Tools (by Microsoft; free):

Adds a Solution Navigator,  a better Solution Explorer,  and cool tabs features like pinning and color coding by project.





PowerCommmands for Visual Studio (by Microsoft, free): 


Several random features, the ones I really enjoy are Open Commmand Prompt here and Open Containing Folder.





NuGet Package Manager (by Micosoft, free): 


A package manager for .net. Say you want to use an open source library in your VS project, you open package manager and say Install-Package . With that the project you requested along with it's dependancies are downloaded and liked to your project. Must have when working with popular .net projects.





Resharper (by Jetbrains, 199$) This is "the" extension for visual studio. If you haven't used it, get the trial, I suspect you'll conclude it's worth paying for.  Resharper has several strong refactorings, plugins to fix stylecop errors, and first class support for running NUnit. 





VSVim (by Jared Parsons, free)

If you don't love VI you skip this.  If you love VIM you get a fifth must use extension.  VsVim gives VIM keybindings to visual studio. It  still has some warts, but it's being actively developed and gets better every release. 



Again, I strongly recommend if you use Visual Studio that you try out these extensions right now, trust me, it’s worth the effort.





Monday, January 17, 2011

SSDs rock - but not for the reasons you think

I bit the bullet and picked up an SSD. It's expensive, but it had some surprising benefits. The normally quoted benefit is speed - which I really don't notice. Most operations went from some annoying amount of time, to some other annoying amount of time. I did notice two things:



1) Silence:  I'm so used to hearing my laptop harddrive I couldn't figure out what I was missing - there is no more annoying grindings; clicking or whirring.



2) Coolness: SSD's run cooler - which means less spinning fan, which means more silence



In theory the SSD should also help with the dropping (my last HDD got some bad sectors after a short fall) - so far very true.



(Update: A short,  highly entertaining talk about SSDs - mostly for servers here)

Monday, December 27, 2010

Delayed Push Notification Service for Windows Phone

This is a multi part blog post the other posts in this series are:

  • Overview – you’re reading this now.

  • The push notification service – how to implement the delayed push notification service

  • The client library – not yet written.

In this post I discuss push notifications, and share my web service which implements a delayed push notification.

Push notifications are a web service that MS provides that can send a message to the phone. There are 3 flavors of push notifications:

  1. Raw notification: Raw bytes - ignored if your app isn't running, sent to your app if it's running. 

  2. Tile notification: Manipulate application tile, worth it's own blog post. 

  3. Toast notifications: If your app isn't running pop up a toast giving a message to the user. 

An interesting detail about the push notification web service is how the web service is addressed, and how the phone is identified. I'd expected something like this: But instead you get the more elegant:



// doesn't work like this.
proxy = CreateProxy("http://well-known-push-notification-service")
proxy.push-toast(id-for-running-app-phone-taken-from-phone, "toast text")
proxy.push-toast(id-for-running-app-phone-taken-from-phone, "toast text2")
// works like this.
proxy = CreateProxy(id-for-running-app-phone-taken-from-phone-with-built-in-service-url)
proxy.push-toast("toast text") // no need to specify phone/app id
proxy.push-toast("toast text2") // no need to specify phone/app id
An annoying limitiation of push notifications is you can't schedule them at arbitrary times. From MSDN:

sendNotificationRequest.Headers.Add("X-NotificationClass", ""); 

// Possible batching interval values:
// 3: The message is delivered by the Push Notification Service immediately.
// 13: The message is delivered by the Push Notification Service within 450 seconds.
// 23: The message is delivered by the Push Notification Service within 900 seconds.
As a result I decided to write a simple web service which will allow you to send your app push notifications.  The sequence diagram for this service is:



The API for this web service is:

http://{root}/push-toast
POST a query string with the following parameters:
{'url:'push notification url',
'message':'text of the toast'
'seconds':'time delay in seconds'
}

RETURN: a json object with:
{
'key' : 'an opaque value used when requesting the toast be cancelled '
'secret' : 'an opaque value used when requesting the toast be cancelled '
}

http://{root}/cancel-push
POST a query string with the following parameters:
{
'key' : 'an opaque value returned from post'
'secret' : 'an opaque value returned from post'
}
RETURN: not defined
If you want to use this web service you can ping me and I'll give you access. In future blog posts I'll talk about the code for the web service as well as the client library.  Leave a comment if you'd like to use this service and we can talk about whatever features you require.