link - Dave's Blog


Search

Tweet from David Risney

Apr 28, 7:21
Wired's pay readers get https: http://www.niemanlab.org/2016/04/wireds-making-the-long-and-slow-switch-to-https-and-it-wants-to-help-other-news-sites-do-the-same/  Sounds like you're paying for https but really its lack of ads makes https practical
PermalinkComments

Tweet from David Risney

Apr 28, 4:14
Coincidentally YouTuber on hacking dispute res by incl IP from diff large companies in same video http://kotaku.com/game-critic-uses-brilliant-workaround-for-youtubes-copy-1773452452 
PermalinkComments

Tweet from David Risney

Apr 28, 4:10
YouTube to change Content ID disputes to collect ad revenue and give to proper owner after dispute resolved http://youtubecreator.blogspot.com/2016/04/improving-content-id-for-creators.html 
PermalinkComments

Tweet from Lux Alptraum

Apr 26, 4:07
I *totally* consider my IUD a cyborg implant. http://fusion.net/story/294770/women-body-hackers/ 
PermalinkComments

Tweet from David Risney

Apr 26, 4:03
Use -Verbose in your .ps1: add [CmdletBinding()] to the top then use Write-Verbose "msg" http://stackoverflow.com/a/11275302?stw=2 
PermalinkComments

Tweet from Ryan Estrada

Apr 25, 7:05
The mayor of podcasts himself @PFTompkins plays Greg in http://BigData.show  and tries to save the internet!
PermalinkComments

Tweet from David Risney

Apr 25, 6:32
@Veronica pic.twitter.com/klOveSNVSg
PermalinkComments

Tweet from Bobak Ferdowsi

Apr 22, 4:40
Hi, you may know me from space, but did you know Earth is my favorite planet? Love it & each other.
PermalinkComments

Tweet from David Risney

Apr 20, 7:03
@ericlaw Wow, that is impressive.
PermalinkComments

Tweet from David Risney

Apr 20, 6:35
Hadn't considered https://twitter.com/berendjanwever/status/722882656996691968 
PermalinkComments

Tweet from David Risney

Apr 8, 4:52
@_lance_leonard @ericlaw First thought was confusion as to why Logo was getting used in production https://en.wikipedia.org/wiki/Logo_(programming_language) 
PermalinkComments

Tweet from Kumail Nanjiani

Apr 5, 11:22
Terrified that the will reveal I never beat Dragon Age: Inquisition.
PermalinkComments

Let's Encrypt NearlyFreeSpeech.net Setup

Feb 4, 2:48

I use NearlyFreeSpeech.net for my webhosting for my personal website and I've just finished setting up TLS via Let's Encrypt. The process was slightly more complicated than what you'd like from Let's Encrypt. So for those interested in doing the same on NearlyFreeSpeech.net, I've taken the following notes.

The standard Let's Encrypt client requires su/sudo access which is not available on NearlyFreeSpeech.net's servers. Additionally NFSN's webserver doesn't have any Let's Encrypt plugins installed. So I used the Let's Encrypt Without Sudo client. I followed the instructions listed on the tool's page with the addition of providing the "--file-based" parameter to sign_csr.py.

One thing the script doesn't produce is the chain file. But this topic "Let's Encrypt - Quick HOWTO for NSFN" covers how to obtain that:

curl -o domain.chn https://letsencrypt.org/certs/lets-encrypt-x1-cross-signed.pem

Now that you have all the required files, on your NFSN server make the directory /home/protected/ssl and copy your files into it. This is described in the NFSN topic provide certificates to NFSN. After copying the files and setting their permissions as described in the previous link you submit an assistance request. For me it was only 15 minutes later that everything was setup.

After enabling HTTPS I wanted to have all HTTP requests redirect to HTTPS. The normal Apache documentation on how to do this doesn't work on NFSN servers. Instead the NFSN FAQ describes it in "redirect http to https and HSTS". You use the X-Forwarded-Proto instead of the HTTPS variable because of how NFSN's virtual hosting is setup.

RewriteEngine on
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^.*$ https://%{SERVER_NAME}%{REQUEST_URI} [L,R=301]

Turning on HSTS is as simple as adding the HSTS HTTP header. However, the description in the above link didn't work because my site's NFSN realm isn't on the latest Apache yet. Instead I added the following to my .htaccess. After I'm comfortable with everything working well for a few days I'll start turning up the max-age to the recommended minimum value of 180 days.

Header set Strict-Transport-Security "max-age=3600;" 

Finally, to turn on CSP I started up Fiddler with my CSP Fiddler extension. It allows me to determine the most restrictive CSP rules I could apply and still have all resources on my page load. From there I found and removed inline script and some content loaded via http and otherwise continued tweaking my site and CSP rules.

After I was done I checked out my site on SSL Lab's SSL Test to see what I might have done wrong or needed improving. The first time I went through these steps I hadn't included the chain file which the SSL Test told me about. I was able to add that file to the same files I had already previously generated from the Let's Encrypt client and do another NFSN assistance request and 15 minutes later the SSL Test had upgraded me from 'B' to 'A'.

PermalinkCommentscertificate csp hsts https lets-encrypt nearlyfreespeech.net

JavaScript Types and WinRT Types

Jan 21, 5:35

MSDN covers the topic of JavaScript and WinRT type conversions provided by Chakra (JavaScript Representation of Windows Runtime Types and Considerations when Using the Windows Runtime API), but for the questions I get about it I’ll try to lay out some specifics of that discussion more plainly. I’ve made a TL;DR JavaScript types and WinRT types summary table.

WinRT Conversion JavaScript
Struct ↔️ JavaScript object with matching property names
Class or interface instance JavaScript object with matching property names
Windows.Foundation.Collections.IPropertySet JavaScript object with arbitrary property names
Any DOM object

Chakra, the JavaScript engine powering the Edge browser and JavaScript Windows Store apps, does the work to project WinRT into JavaScript. It is responsible for, among other things, converting back and forth between JavaScript types and WinRT types. Some basics are intuitive, like a JavaScript string is converted back and forth with WinRT’s string representation. For other basic types check out the MSDN links at the top of the page. For structs, interface instances, class instances, and objects things are more complicated.

A struct, class instance, or interface instance in WinRT is projected into JavaScript as a JavaScript object with corresponding property names and values. This JavaScript object representation of a WinRT type can be passed into other WinRT APIs that take the same underlying type as a parameter. This JavaScript object is special in that Chakra keeps a reference to the underlying WinRT object and so it can be reused with other WinRT APIs.

However, if you start with plain JavaScript objects and want to interact with WinRT APIs that take non-basic WinRT types, your options are less plentiful. You can use a plain JavaScript object as a WinRT struct, so long as the property names on the JavaScript object match the WinRT struct’s. Chakra will implicitly create an instance of the WinRT struct for you when you call a WinRT method that takes that WinRT struct as a parameter and fill in the WinRT struct’s values with the values from the corresponding properties on your JavaScript object.

// C# WinRT component
public struct ExampleStruct
{
public string String;
public int Int;
}

public sealed class ExampleStructContainer
{
ExampleStruct value;
public void Set(ExampleStruct value)
{
this.value = value;
}

public ExampleStruct Get()
{
return this.value;
}
}

// JS code
var structContainer = new ExampleWinRTComponent.ExampleNamespace.ExampleStructContainer();
structContainer.set({ string: "abc", int: 123 });
console.log("structContainer.get(): " + JSON.stringify(structContainer.get()));
// structContainer.get(): {"string":"abc","int":123}

You cannot have a plain JavaScript object and use it as a WinRT class instance or WinRT interface instance. Chakra does not provide such a conversion even with ES6 classes.

You cannot take a JavaScript object with arbitrary property names that are unknown at compile time and don’t correspond to a specific WinRT struct and pass that into a WinRT method. If you need to do this, you have to write additional JavaScript code to explicitly convert your arbitrary JavaScript object into an array of property name and value pairs or something else that could be represented in WinRT.

However, the other direction you can do. An instance of a Windows.Foundation.Collections.IPropertySet implementation in WinRT is projected into JavaScript as a JavaScript object with property names and values corresponding to the key and value pairs in the IPropertySet. In this way you can project a WinRT object as a JavaScript object with arbitrary property names and types. But again, the reverse is not possible. Chakra will not convert an arbitrary JavaScript object into an IPropertySet.

// C# WinRT component
public sealed class PropertySetContainer
{
private Windows.Foundation.Collections.IPropertySet otherValue = null;

public Windows.Foundation.Collections.IPropertySet other
{
get
{
return otherValue;
}
set
{
otherValue = value;
}
}
}

public sealed class PropertySet : Windows.Foundation.Collections.IPropertySet
{
private IDictionary map = new Dictionary();

public PropertySet()
{
map.Add("abc", "def");
map.Add("ghi", "jkl");
map.Add("mno", "pqr");
}
// ... rest of PropertySet implementation is simple wrapper around the map member.


// JS code
var propertySet = new ExampleWinRTComponent.ExampleNamespace.PropertySet();
console.log("propertySet: " + JSON.stringify(propertySet));
// propertySet: {"abc":"def","ghi":"jkl","mno":"pqr"}

var propertySetContainer = new ExampleWinRTComponent.ExampleNamespace.PropertySetContainer();
propertySetContainer.other = propertySet;
console.log("propertySetContainer.other: " + JSON.stringify(propertySetContainer.other));
// propertySetContainer.other: {"abc":"def","ghi":"jkl","mno":"pqr"}

try {
propertySetContainer.other = { "123": "456", "789": "012" };
}
catch (e) {
console.error("Error setting propertySetContainer.other: " + e);
// Error setting propertySetContainer.other: TypeError: Type mismatch
}

There’s also no way to implicitly convert a DOM object into a WinRT type. If you want to write third party WinRT code that interacts with the DOM, you must do so indirectly and explicitly in JavaScript code that is interacting with your third party WinRT. You’ll have to extract the information you want from your DOM objects to pass into WinRT methods and similarly have to pass messages out from WinRT that say what actions the JavaScript should perform on the DOM.

PermalinkCommentschakra development javascript winrt

Retweet of evacide

Jan 19, 8:00
EFF litigates the US governnent into still more transparency into how it decides to use 0days, by @agcrocker. https://www.eff.org/deeplinks/2016/01/eff-pries-more-transparency-zero-days-governments-grasp …
PermalinkComments

Retweet of anildash

Jan 3, 9:59
Oh! @jsnell is way ahead of me: https://sixcolors.com/post/2015/12/the-best-christmas-gift-in/ … Programming BB-8 with a kid-friendly app! Thanks to @anoopr for the link.
PermalinkComments

Tweet from David_Risney

2015 Nov 18, 8:29
Next up: hacking phones with inaudible sounds that exploit bugs in this software http://arstechnica.com/tech-policy/2015/11/beware-of-ads-that-use-inaudible-sound-to-link-your-phone-tv-tablet-and-pc/ …
PermalinkComments

Retweet of xeni

2015 Nov 6, 12:26
Facebook's censoring me. Tried to post my @boingboing item re: http://tsu.co . Got blocked. http://boingboing.net/2015/11/06/facebook-is-censoring-links-to.html …
PermalinkComments

Retweet of groby

2015 Oct 21, 10:11
@ericlaw @fugueish not to be that person.. (Well, actually, yes, I'm that person :) - HTTPS hyperlinks start with HTTP as well.
PermalinkComments

Tweet from David_Risney

2015 Aug 23, 8:12
Got TAH Concert Film bday gift! Sparks musical ep, visual CLINK & more. So much awesome! https://vimeo.com/120857326  @ThrillingAdv
PermalinkComments
Older Entries Creative Commons License Some rights reserved.