360 - Dave's Blog

Search

Let's Encrypt NearlyFreeSpeech.net Setup

2016 Feb 4, 2:48

2016-Nov-5: Updated post on using Let's Encrypt with NearlyFreeSpeech.net

I use NearlyFreeSpeech.net for my webhosting for my personal website and I've just finished setting up TLS via Let's Encrypt. The process was slightly more complicated than what you'd like from Let's Encrypt. So for those interested in doing the same on NearlyFreeSpeech.net, I've taken the following notes.

The standard Let's Encrypt client requires su/sudo access which is not available on NearlyFreeSpeech.net's servers. Additionally NFSN's webserver doesn't have any Let's Encrypt plugins installed. So I used the Let's Encrypt Without Sudo client. I followed the instructions listed on the tool's page with the addition of providing the "--file-based" parameter to sign_csr.py.

One thing the script doesn't produce is the chain file. But this topic "Let's Encrypt - Quick HOWTO for NSFN" covers how to obtain that:

curl -o domain.chn https://letsencrypt.org/certs/lets-encrypt-x1-cross-signed.pem

Now that you have all the required files, on your NFSN server make the directory /home/protected/ssl and copy your files into it. This is described in the NFSN topic provide certificates to NFSN. After copying the files and setting their permissions as described in the previous link you submit an assistance request. For me it was only 15 minutes later that everything was setup.

After enabling HTTPS I wanted to have all HTTP requests redirect to HTTPS. The normal Apache documentation on how to do this doesn't work on NFSN servers. Instead the NFSN FAQ describes it in "redirect http to https and HSTS". You use the X-Forwarded-Proto instead of the HTTPS variable because of how NFSN's virtual hosting is setup.

RewriteEngine on
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^.*$ https://%{SERVER_NAME}%{REQUEST_URI} [L,R=301]

Turning on HSTS is as simple as adding the HSTS HTTP header. However, the description in the above link didn't work because my site's NFSN realm isn't on the latest Apache yet. Instead I added the following to my .htaccess. After I'm comfortable with everything working well for a few days I'll start turning up the max-age to the recommended minimum value of 180 days.

Header set Strict-Transport-Security "max-age=3600;" 

Finally, to turn on CSP I started up Fiddler with my CSP Fiddler extension. It allows me to determine the most restrictive CSP rules I could apply and still have all resources on my page load. From there I found and removed inline script and some content loaded via http and otherwise continued tweaking my site and CSP rules.

After I was done I checked out my site on SSL Lab's SSL Test to see what I might have done wrong or needed improving. The first time I went through these steps I hadn't included the chain file which the SSL Test told me about. I was able to add that file to the same files I had already previously generated from the Let's Encrypt client and do another NFSN assistance request and 15 minutes later the SSL Test had upgraded me from 'B' to 'A'.

PermalinkCommentscertificate csp hsts https lets-encrypt nearlyfreespeech.net

Tweet from David_Risney

2015 Jul 20, 10:21
There is no cloud, just other people's cars. https://twitter.com/XSSniper/status/623523334727188480 …
PermalinkComments

Retweet of GonzoHacker

2015 Jul 1, 5:22
The call is asynchronous - it's just that the surrounding code doesn't have anything better to do but wait for a response
PermalinkComments

Retweet of Polygon

2015 Jun 14, 9:20
Xbox One will become backward compatible with Xbox 360 http://polygon.com/e/8547238?utm_campaign=polygon&utm_content=chorus&utm_medium=social&utm_source=twitter … pic.twitter.com/B4cCre1A2l
PermalinkComments

Retweet of XFilesFiles

2015 Mar 23, 9:04
THE X-FILES IS BACK!!!!! http://www.hitfix.com/the-fien-print/no-conspiracy-fox-resurrects-the-x-files-for-6-episode-run …
PermalinkComments

Retweet of edent

2015 Feb 26, 3:16
Facebook Mangles Unicode URLs https://shkspr.mobi/blog/?p=20643 
PermalinkComments

theatlantic: Victorian Trolling: How Con Artists Spammed in a...

2013 Oct 29, 7:42


theatlantic:

Victorian Trolling: How Con Artists Spammed in a Time Before Email

The main difference between 21st-century scams and those of centuries past is one of delivery method.

Read more. [Image: Wikimedia Commons/Benjamin Breen]

PermalinkCommentshistory spam technical humor internet

laughingsquid: Solitaire.exe, A Real Deck of Cards Inspired by...

2012 Nov 19, 4:56


laughingsquid:

Solitaire.exe, A Real Deck of Cards Inspired by the Windows 98 Solitaire PC Game

PermalinkCommentshumor solitare game cards windows

Stripe CTF - SQL injections (Levels 0 & 3)

2012 Sep 5, 9:10

Stripe's web security CTF's level 0 and level 3 had SQL injection solutions described below.

Level 0

Code

app.get('/*', function(req, res) {
var namespace = req.param('namespace');

if (namespace) {
var query = 'SELECT * FROM secrets WHERE key LIKE ? || ".%"';
db.all(query, namespace, function(err, secrets) {

Issue

There's no input validation on the namespace parameter and it is injected into the SQL query with no encoding applied. This means you can use the '%' character as the namespace which is the wildcard character matching all secrets.

Notes

Code review red flag was using strings to query the database. Additional levels made this harder to exploit by using an API with objects to construct a query rather than strings and by running a query that only returned a single row, only ran a single command, and didn't just dump out the results of the query to the caller.

Level 3

Code

@app.route('/login', methods=['POST'])
def login():
username = flask.request.form.get('username')
password = flask.request.form.get('password')

if not username:
return "Must provide username\n"

if not password:
return "Must provide password\n"

conn = sqlite3.connect(os.path.join(data_dir, 'users.db'))
cursor = conn.cursor()

query = """SELECT id, password_hash, salt FROM users
WHERE username = '{0}' LIMIT 1""".format(username)
cursor.execute(query)

res = cursor.fetchone()
if not res:
return "There's no such user {0}!\n".format(username)
user_id, password_hash, salt = res

calculated_hash = hashlib.sha256(password + salt)
if calculated_hash.hexdigest() != password_hash:
return "That's not the password for {0}!\n".format(username)

Issue

There's little input validation on username before it is used to constrcut a SQL query. There's no encoding applied when constructing the SQL query string which is used to, given a username, produce the hashed password and the associated salt. Accordingly one can make username a part of a SQL query command which ensures the original select returns nothing and provide a new SELECT via a UNION that returns some literal values for the hash and salt. For instance the following in blue is the query template and the red is the username injected SQL code:

SELECT id, password_hash, salt FROM users WHERE username = 'doesntexist' UNION SELECT id, ('5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8') AS password_hash, ('word') AS salt FROM users WHERE username = 'bob' LIMIT 1
In the above I've supplied my own salt and hash such that my salt (word) plus my password (pass) hashed produce the hash I provided above. Accordingly, by providing the above long and interesting looking username and password as 'pass' I can login as any user.

Notes

Code review red flag is again using strings to query the database. Although this level was made more difficult by using an API that returns only a single row and by using the execute method which only runs one command. I was forced to (as a SQL noob) learn the syntax of SELECT in order to figure out UNION and how to return my own literal values.

PermalinkCommentssecurity sql sql-injection technical web-security

Changing Windows Live IDs

2012 Jun 6, 2:54

Use of my old Hotmail account has really snuck up on me as I end up caring more and more about all of the services with which it is associated. The last straw is Windows 8 login, but previous straws include Xbox, Zune, SkyDrive, and my Windows 7 Phone. I like the features and sync'ing associated with the Windows Live ID, but I don't like my old, spam filled, hotmail email address on the Live ID account.

A coworker told me about creating a Live ID from a custom domain, which sounded like just the ticket for me. Following the instructions above I was able to create a new deletethis.net Live ID but the next step of actually using this new Live ID was much more difficult. My first hope was there would be some way to link my new and old Live IDs so as to make them interchangeable. As it turns out there is a way to link Live IDs but all that does is make it easy to switch between accounts on Live Mail, SkyDrive and some other webpages.

Instead one must change over each service or start over depending on the service:

Xbox
In the Xbox 360 system menu you can change the Live ID associated with your gamertag. This worked fine for me and I got an email telling me about the transfer of my Microsoft Points.
Zune
There's no way to do this for the Zune specifically, however changing over your Xbox account also transfers over all your Zune purchased content. I don't have a Zune Pass so I can't confirm that, but all of my previously purchased television shows transferred over successfully.
Windows 7 Phone
To change the main Live ID associated with your phone, reset your phone to factory default and start over. All purchased applications are lost. Had I purchased any applications I would have been pissed, but instead I was just irritated that I had to reset my phone.
Mail
I don't use my Hotmail account for anything and it only sits and collects spam. Accordingly I didn't attempt switching this over.
SkyDrive
I didn't have much in my SkyDrive account. I downloaded all files as a zip and then manually uploaded them to the new account.
PermalinkCommentshotmail domain win8 skydrive technical windows live-id

“On The Verge is ready for a lot of things, but we clearly...

2012 Apr 2, 8:31


“On The Verge is ready for a lot of things, but we clearly weren’t ready for renowned astrophysicist Dr. Neil deGrasse Tyson, who stopped by to talk space exploration, life as a meme, and why he carries a slightly-illegal laser with him at all times.”

PermalinkCommentsinternet meme humor video neil-degrasse-tyson

Command line for finding missing URLACTIONs

2011 May 28, 11:00

I wanted to ensure that my switch statement in my implementation of IInternetSecurityManager::ProcessURLAction had a case for every possible documented URLACTION. I wrote the following short command line sequence to see the list of all URLACTIONs in the SDK header file not found in my source file:

grep URLACTION urlmon.idl | sed 's/.*\(URLACTION[a-zA-Z0-9_]*\).*/\1/g;' | sort | uniq > allURLACTIONs.txt
grep URLACTION MySecurityManager.cpp | sed 's/.*\(URLACTION[a-zA-Z0-9_]*\).*/\1/g;' | sort | uniq > myURLACTIONs.txt
comm -23 allURLACTIONs.txt myURLACTIONs.txt
I'm not a sed expert so I had to read the sed documentation, and I heard about comm from Kris Kowal's blog which happilly was in the Win32 GNU tools pack I already run.

But in my effort to learn and use PowerShell I found the following similar command line:

diff 
(more urlmon.idl | %{ if ($_ -cmatch "URLACTION[a-zA-Z0-9_]*") { $matches[0] } } | sort -uniq)
(more MySecurityManager.cpp | %{ if ($_ -cmatch "URLACTION[a-zA-Z0-9_]*") { $matches[0] } } | sort -uniq)
In the PowerShell version I can skip the temporary files which is nice. 'diff' is mapped to 'compare-object' which seems similar to comm but with no parameters to filter out the different streams (although this could be done more verbosely with the ?{ } filter syntax). In PowerShell uniq functionality is built into sort. The builtin -cmatch operator (c is for case sensitive) to do regexp is nice plus the side effect of generating the $matches variable with the regexp results.
PermalinkCommentspowershell tool cli technical command line

Methods of Watching TV

2010 Feb 3, 1:09If you've got cable, Internet, and Netflix you end up with a large number of TV viewing options. Its nice to have the options but is there some way to collect and summarize my available options at any one time?

TV PC
Comcast TV Xbox 360 + Windows Media Center Windows Media Center
Comcast OnDemand Cable box Fancast
Hulu Xbox 360 + PlayOn + Windows Media Center Hulu
Netflix Watch Instantly Xbox 360 + Netflix App Netflix Watch Instantly
Netflix DVDs Xbox 360 PC
PermalinkCommentstv xbox 360 wmc dvr

Clement Wedding Table Example

2009 Oct 14, 3:58

sequelguy posted a photo:

Clement Wedding Table Example

PermalinkCommentsca wedding table hotel monterey clement

Comcast Digital Switch Impact on My Windows Media Center

2009 Sep 25, 2:19

Amateur wireless station (LOC)Irritatingly out of line with what their commercials say, in my area Comcast, under the covers of the national broadcast digital switch, is sneaking in their own switch to digital, moving channels above 30 to their own digital format. Previously, I had Windows 7 Media Center running on a PC with a Hauppauge PVR500 which can decode two television signals at once setup to record shows I like. The XBox 360 works great as a Media Center client letting me easily watch the recorded shows over my home network on my normal TV.

Unfortunately with Comcast's change, now one needs a cable box or a Comcast digital to analog converter in order to view their signal, but Comcast is offering up to two free converters for those who'd like them. The second of my two free converters I hooked up to the Media Center PC and I got the IR Blaster that came with my Hauppauge out of the garage. I plugged in the USB IR Blaster to my PC, connected one of the IR transmitters to the 1st port on the IR Blaster, and sat the IR transmitter next to the converter's IR receiver. I went through the Media Center TV setup again and happily it was able to figure out how to correctly change the channel on the converter. So I can record now, however:

  1. I can only record one thing at a time now
  2. Changing the channel is slow taking many seconds (no flipping through channels for me)
  3. The Hauppauge card can't know if the channel change worked. So if it tries to change to HBO (I get it for free with one of the Comcast packages) which is encrypted and the converted won't show, the channel doesn't change but the PC doesn't know it and ends up recording some other channel.
To fix (3) I need to manually go through and remove channels I don't have from the Media Center. To fix (1) I may be able to get a second IR transmitter, a third digital converter, hook it up to one of the other inputs on my Hauppauge, and go back through the Media Center TV setup. There's no fix for (2) but that's not so bad. All in all, its just generally frustrating that they're breaking my setup with no obvious benefit.PermalinkCommentsdigital tv hauppauge mce cable windows media center comcast

Video: Project Natal invades Late Night with Jimmy Fallon

2009 Jun 12, 12:37"Last night on Late Night with Jimmy Fallon, Microsoft's Kudo Tsunoda brought along his baby, Project Natal, and let Jimmy Fallon, John Krasinski, and Stephen Moyer go to town. The footage has made its way onto Hulu and while these are pretty much the same demos for Ricochet and Burnout Paradise that we saw at E3 last week, they're still impressive."PermalinkCommentsvideo humor videogame natal xbox360 jimmy-fallon

Beach View

2009 May 22, 12:10

sequelguy posted a photo:

Beach View

PermalinkComments

Netflix Watch Instantly Recommendations

2009 May 3, 9:17
WeedsAvatar The Last AirbenderPaprikaGrindhouse Planet TerrorOutsourcedThe King of KongPrimer

Netflix lets you watch a subset of their movies online via their website and a subset of those movies are available to watch on the Xbox 360's Netflix app. so its not always easy to find movies to watch on Xbox 360. Yet, I regularly see my Xbox friends using the Netflix app and its a shame they didn't make an easy way to share movie recommendations with your friends. Instead we must share movie recommendations the old fashioned way. Here's the movies I've found and enjoyed on my 360.

Weeds
You don't have to be a stoner to enjoy this humorous and dramatic satire featuring a widow trying to raise her children and deal pot in suburbia.
Avatar The Last Airbender
An American animated series that's an amalgamation of various Asian art, history, religion, etc. that maintains a great story line.
Paprika
If you enjoyed Paranoia Agent you'll enjoy this movie in the same animation style and by the same director and writer, Satoshi Kon. Its like a feature length version of a Paranoia Agent episode in which a dream machine lets outsiders view one's dreams but eventually leads to blurring the dreams and reality.
Grindhouse Planet Terror
I didn't see either of the Grindhouse movies when they first came out, but of the two, Planet Terror is the more humorous and exciting gore filled parody.
Outsourced
A refreshing romantic comedy that still has a few of the over played tropes but is easy to enjoy despite that.
The King of Kong
A hilarious documentary on the struggle between the reigning champ hot-sauce salesman and the underdog Washington state high school science teacher to obtain the Donkey Kong world record high score. After watching, checkout this interview with the creators of the movie and the villain.
Primer
I've mentioned Primer before, but I put it on here again because its really good and you still haven't seen it, have you?
PermalinkCommentsmovie personal netflix

DSCN0854

2009 Apr 23, 10:31

sequelguy posted a photo:

DSCN0854

PermalinkCommentscalifornia napa

DSCN0847

2009 Apr 23, 10:30

sequelguy posted a photo:

DSCN0847

PermalinkCommentscalifornia napa
Older Entries Creative Commons License Some rights reserved.