This site is a showcase for projects, research, philosophy/rants and gripes by Dennis Robinson and sometimes others. Be sure to check out the Blog section for posts, news, feedback etc. and the Projects page for a synopsis of Menasoft software projects. Please contact us at contact@menasoft.com with any questions or comments. My RSS feed can be found at http://www.menasoft.com/rss.xml

General philosophy of this site

I’ve decided to create this site in hopes of giving back a little bit to all that I get from the Internet. Whenever I want to learn about some odd new technical issue I just Google it up and oddly very often someone has written something about it in a blog somewhere. Sometimes no one has written about it. I’m going to try to keep a log of some of the odd technical research I do, hoping someone somewhere might benefit from it. Maybe I’ll gain some karma points, who knows.

I couldn’t help but want to make a page dedicated to my fellow software colleagues. I for one love what I do and have a need to make the world of software development a better place. I hope someday to actually find that perfect development team. I’ve come close a few times. So I’m going to rant and rave about the bad and good things I’ve seen and what I did and didn’t like about them. And of course the world will be a better place as a result. Most of my posts will likely be left completely unfinished and some topics are really just an outline and maybe some vague thoughts that came off the top of my head. Consider this to be a draft of a work in progress.

In general if you find some point I write about to be interesting, just ping me (email) for more information and I may continue working on any given topic.

http://www.menasoft.com/blog/?feed=rss

In my travels I’ve gathered a fair amount of information about public key cryptography, document and code signing and specifically (and more usefully) how this is performed for Windows development. I’ll give a brief (for dummies style) intro to signing and a walk through of how to buy and sign code from start to finish. (at least as far as it worked for me) Its my hope that this might be the only article a developer needs to read if they want to produce  a signed executable for Windows.

As usual (for my writing), this is the article i really wish i had found when i discovered I needed to do code signing. There are many paths branching off the course i describe. I found a process that worked for me. I’m sure there are other ways to do this.

Signing and Encryption in General:

Public Key Cryptography and document / code signing is based on the RSA algorithm for encryption plus a hash algorithm (usually SHA2).

There is  not shortage of simplistic descriptions of RSA on the internet. Its is basically an equation for taking 2 very large prime numbers and combining them to produce a public key a private key and a shared exponent. Producing the key, especially finding suitable prime numbers is a bit of a CPU intensive process. Most people are familiar with the ability to encrypt with the public key and decrypt a message with the private key. ala PGP messaging.  The often unappreciated trick here for code/message/etc signing is that the keys are arbitrarily interchangeable. This means that I can encode a message using the private key that only the public key can decode. This is what is used in the signing process. The private key encodes something about the original state of the document (like its hash code) that you can only decode with the public key.  The important part being that only the owner of the private key can encode  it in such a way that it will decode properly. NOTE: there are some brute force hacks to try to add data to the end of a document to force it to conform to the original hash. These attacks can be easily thwarted just by knowing the correct size of the file.

The hash is for reducing the size of the set of data needing to be encrypted. Since RSA is not a block cipher encryption like RC4, AES, Blowfish, etc it is extremely CPU expensive to use on blocks of data. It is combined with a hash code to encrypt data as a single large number. i.e. One single crypt/mathematical operation. This is analogous to how SSL will use RC4 or other block cipher in conjunction with RSA for optimization purposes.

How to get a code signing certificate.

Firstly, a code signing certificate is not exactly the same thing as a security certificate that you might get from say godaddy.com.

There are multiple “usages” for certificates. (called ‘Certificate Key Usage’) Most providers of certificates do not sell code signing certs. They usually just sell SSL certs. In fact ask Godaddy for a code signing certificate and they wont even know what you are talking about. (happened to me)  Even though the keys may look the same and all the same math applies. The validation chain will not allow a key to be used for something other than its declared (purchased) purpose/usage.

Code signing certificates are expensive. I have heard that if you are an FOSS (open source) developer you can get a free certificate from Certum. But in most cases you have to pay someone to validate you are who you say you are. They are here to establish your identity so you can be trusted. I use Comodo since they seem to be the cheapest issuer in the default certification authority (CA) trees/root that are loaded by default on most machines/browsers. There are several other good issuers that are very expensive such as Thawte and Verisign.

The process of  the cert issuer checking you out and making sure you really are who you say you are can be long and require many back and forths to check all the boxes. For individuals you must give proof of you identity. For corporations you need proof you ar ea corp. If you list a domain name as yours, the physical (street) address on the certificate MUST match the address for the domain. I assume the more expensive code issuers must do a more thorough background check?

Comodo typically provides 2048 bit keys for code signing.

How to use a code signing certificate.

There are several file formats that can hold a certificate either in full format (public and private) or in public format. Microsoft (as usual for MS) has their own formats that are not directly compatible with everyone else (They need conversion). Certificates can also be stored in a “certificate store”, usually attached to your browser of choice.

Relevant file formats.

• pfx
• crt
• p12 – importable into Mozilla
• pem
• key
• cer
• pvk/spc

When you finally get your code signing cert it is usually in the form of a link to an encoded page on a web server. This server will add the cert to you local cert store on that machine.

If you are using Mozilla, got to the certificate store and export it to .PEM or Backup to .P12 format.

Start up I.E and import this PEM or .P12 format cert.

Export the cert from IE as a .PFX file.

You need to get the signtool.exe from microsoft to sign code/apps.

Code certificates can be optionally time stamped to make them last longer than the prescribed time period. For example if your cert expires on Jan 1 2010, not only can you not sign any new code but anything that is signed with your certs is now considered to be unsafe. The act of including a time stamp that is itself signed proves that the document/app was signed in the period when your cert was valid. For instance I use Verisigns signed time stamp service at http://timestamp.verisign.com/scripts/timestamp.dll

Signing with a cert held in a pfx file. (not very secure if someone can get read access to your system)

signtool.exe sign /v /f $(ProjectDir)..\DennisSign.pfx /t http://timestamp.verisign.com/scripts/timestamp.dll $(TargetPath)

Sign with a cert held in a pfx file that has a password assigned. (More secure than above from read snoopers)

Sign with a cert held in local cert storage. Cert is locked down on you machine.

How to see apps that have certificates:

In windows just right click on a file and get its properties.If you see a ‘Digital Signatures’ tag you now it is signed. Unsigned apps/docs dont have this.

To see certificates for all your running processes get a program called ProcessExplorer. It is downloadable from the Microsoft site. Turn on the ‘Verify Image Signatures’ mode in procexp and it will show all valid certificates for all processes that have them.

How to programatically validate a code signing certificate:

MS has provided some API calls for validating code certificates. Check out the WinVerifyTrust() API call.

Links to useful stuff:

comodo – the best price i could find for code signing certs.

BobsGear – has some interesting comments on the subject

Code Signing – Wikipedia

The have done a major ‘upgrade’ which in effect was not an upgrade at all. They consolidated their servers and removed features they didn’t feel like supporting anymore. They at least did send a warning email a few days before the switch saying they were doing this. I have to admit part of the problem is that i didn’t read it. Though they didn’t say exactly when the switch was. Truly amateur performance on their part.

As you might expect my site fell apart on the day of the switch.

My first gripe is the bullshit/lie that this was an ‘upgrade’. Since as far as i can tell it was not any sort of upgrade from any customers point of view.

They forced reconfiguration of all mail accounts and eliminated ‘catch-all’ support. Because i quote “It just increases spam” and all other hosts seem to be dropping support for it. Firstly, I don’t care what other hosts are doing. Secondly its total crap. I have never gotten much spam on any of the unused addresses on my site. That should be my problem anyhow. What the heck do they care?!

The reason that the catch-all is such a need for me is that i frequently give out unique emails for different sites i subscribe to in order to track who is giving out my address to spammers. I don’t bother to track what addresses i give out. I have literally hundreds of aliases that would have to be tracked down and email forwarders created for.

gate.com sucks. Sorry, I have to add this to the text since most people doing a search for gripes on something do a search for “XX sucks”. how fun.

gate.com seems to be run by total amateurs.

For those interested i have now switched to dreamhost.com. They are faster and support WAY more features than gate.com. Truly no comparison. They have a rep for NOT doing the sort of crap that other hosts do in this department. Its a little hard to get used to their control panel. It has an odd format but provides a lot of power. The nicest feature is that you may host multiple sites on the same account. Very nice.

Links:

Affinitys review of Gate.com – http://www.webhostingstuff.com/review/GatecombyAffinity.html

http://www.hostingsthatsuck.com/gate-com-sucks/

http://darksiren.net/node/126

http://www.complaintsboard.com/complaints/gatecom-c7326.html

Imagine a cross between Webex and Second Life, geared towards meetings and training. VenueGen.

The first on-demand enterprise web 3D conferencing solution that can be integrated into any web-based offering. The company deploys as a SaaS based web service to consumers and business customers that currently serve the multi-billion dollar distance learning, social networking, web conferencing, content publishing and live event markets. Founded in 2007, the Company offers the first practical application of web 3D technology that can be seamlessly integrated into its customers’ web offerings integrating their 2D content and delivered as an on-demand service. Venuegen is optimized to equip virtual presenters with powerful and intuitive communication capabilities that radically lower event costs and extend market reach.

Test the dressing room for VenueGen

A gallery of screen shots:

Others Links for VenueGen

http://www.workplace-mag.com/VenueGen-offers-a-virtual-and-fun-meeting-place.html

http://www.collaborate.com/?q=blog/2009/11/02/3d-presence-and-virtual-meetings

I decided to look around to see what my options were. I saw some adds for MagicJack for $40 a year. Installed it about a month ago and canceled my Verizon account.

I disconnected the Verizon service wires at the box in my garage. I plugged the MJ phone line into a house extension to support all extensions in my house. As a result all the phones in my house will ring as they used to. The caller id box downstairs doesn’t seem to work (not a huge deal). I can answer incoming calls but i had some trouble placing calls from other phones in the house.

Pros:
I get email when i get vmail messages on the MJ telephone number.

Cant beat the price. $40 a year is a not brainer.

Cons:
I didn’t get to keep my existing telephone number. They had to issue me a new number.

The popup you get a start up really sucks. Takes about 2 minutes to go away and it is topmost and cant be moved.

The call quality totally sucks. It is so staticy that the use as an actual phone is totally unacceptable. I will try to attach the MJ USB dongle to another computer in a less noisy part of the house and see if that fixes the static.

The MJ app has exited spontaneously several times. This leaves my house phone not working til i discover it and fix it. The only way to know this is to look at the computer it is running on and check. Or you notice messages going to voice mail when you didnt hear a ring. I tried installing the software update today. We’ll see how that goes.

No Linux support (yet)

Similar:
Skype is good as well for pc to pc calls. I don’t know if you get an actual telephone number with Skype?

Conclusion:

If all you want is voicemail that goes to your email box it certainly does the job. As an actual phone its not so cool. The call quality totally sucks. As I said this might be fixable. The software might be flaky.

Its a bit buggy but i must admit i haven’t decided to hate it yet.

I managed to totally avoid all contact with Windows Vista, but i decided i cant avoid Microsoft OS’s forever. XP is getting a bit old and creaky feeling.

I installed W7 on top of an existing XP machine. I did not use the update feature. It nicely copied the Program files, Windows and Documents and settings folders into a folder called ‘windows.old’ and replaced them with the much more sane ‘Users’, ‘Windows’ and ‘Program Files (x86)’ folders. OK, I’m somewhat impressed by how clean that was.

Bugs:

Here’s a list of the problems i experienced in the process. Some of the first problems i saw with the RC went away after I did ‘windows update’ so make sure you run the patches.

Cant customize instances of File Explorer like XP could. Single instances of File Explorer used to remember their settings. Now it seems the settings just revert to the last usage. For instance if you resize the file explorer window or decide to view a particular folder as icons instead of details, etc.

Once the File Explorer turns off the folder view (Navigation pane), I had a lot of trouble figuring out how to turn it back on again. Hello microsoft ! properties for an app should be controlled from within the app !! Maybe the ‘View’ menu would be a good place for this option. Its ‘hidden’ in a menu you can only get to via icons.

Some old installer files become mysteriously locked and unusable. I overwrote my machine with W7 from XP. I have a habit of placing any new programs i install in a folder called ‘installs’. Just in case i need to reinstall them. Some of these files now give me the mysterious message ‘Windows cannot access the specific device, path, or file. You may not have the appropriate permissions to access the item ‘.  (I have admin rights, so this should not be true) I can download them again from there original source and they seem fine. It is not obvious why i cant use the existing files. The ‘Toubleshoot compatibility’ option seems like it would be promising but ultimately does nothing. Pressing the ‘Start the Program…’ button makes the app just blink at me. I finally discovered that the issue was security right assigned to files. Not obvious. Just assign full permissions for that file to the ‘Users’ user group and the problem goes away.

No support for displaying 32×32 icons which most older apps prefer. So almost all apps look weird with stretched icons. Visual Studio 2005 looks weird.

Simple drag and drop doesnt work if the app is running as administrator. I used to be able to drag files from file explorer over to Visual Studio 2005. That doesnt work in W7.

Windows Search got introduced in XP. It is wonderfully useless. Most of the time i just want to find a file by its name.� This feature seems to have been removed in W7. Remember the old fashioned ‘find a file by name ‘ in File Explorer with the irritating dog mascot? Both seem to be gone.

The UAC (User Access Control) warning messages when starting applications is every bit is annoying and useless as the Apple commercials describe for Vista. Microsoft still has not figured out how to make these less annoying. I have read there is a well hidden option to turn off UAC for trusted applications but I have yet to find it. Ideally it would be a button on the warning popup dialog, saying something like “always trust this app” but that would be way too easy. At least maybe for signed apps ?

OK Here’s one i really hate. Microsoft has created in Vista the notion of ‘Junctions’. It remaps directories to other directories. This is similar to the Linux concept of symbolic links, which is fine. The Windows File Explorer just gives the error ‘Access Denied’ when you try to open them. They are sometimes drawn as slightly grayed or have a tiny link arrow square on the icon to show they are different from normal directories. (ex. ‘Documents and Settings’) This would lead one to believe that it’s a security problem, which it is not. There is no good way to figure out where these junctions go from WFE. Right click and bringing up the properties dialog does not show any useful information. Still looking into this.

Conclusion:

Its hard to not prejudice myself against W7 just because i’m not used to it. Ultimately I think Microsoft needs to find themselves some fresh focus groups to point out the blatantly obvious non intuitive user interface issues. Maybe Microsoft has become so insular they dont ask opinions from people who aren’t microsoft employees ?

On the flip side it really has some things that have been smoothed out from previous versions of Windows. When a file is in use by another app and i cant delete it, W7 now tells you what file has it locked. That has always been a big pet peeve of mine from XP.

I’m going to keep using W7. Some of the issues really are just a matter of getting used to it. Speed wise I’d say its about even with XP. Much prettier ‘Aero’ glassy look. For any who wonder if they should upgrade. I’m not seeing a huge compelling reason to do so, unless you are like me and need to debug apps that have Vista/W7 specific issues.

I suspect cost might be a big issue for people. The trial of RC1 is so far free. Vista was WAY too expensive. It was much more than XP. It is rumored that W7 will be even more expensive and come in more pointlessly confusing varieties. We’ll see. The Apple commercials do a pretty good job of describing how ridiculous this is.

Ok here are a few recurring problems i want to gripe about. Problems that have been in multiple generations of MS Windows that have never really been addressed.

1. My computer is completely lagged, I can’t move windows around or click on anything. The CPU bar shows less than 5% CPU usage. Sometimes even the mouse stops moving. I suppose it must be a disk bottleneck. But there is no system tools that can tell my what is going on.
2. I tried to open a network share for a computer that is offline and my system locks up for 5 minutes. MS has never been able to deal with such a simple problem as this ever since Windows 3.1. I’m trying Windows 7 now to see if it is any better.
3. I try to delete a file and windows says i cant because it in use by some other application. There are no other applications open. I think Windows 7 might have acutally solved this problem. Can you beleive it ?

I remember reading some old scifi books years ago where people had a ‘house computer’ that would monitor their needs and talk to them, take their calls, make sure the house was ok. etc. Is anything like that possible for reasonable money today?

I’m toying with the idea of a trying to build this home server for my next machine. I’ve a number of ideas for it. But lets let the imagination run a bit wild for what this is supposed to do.

Free Association:

Imagine this machine. 24/7 availability. On all the time.

low power consumption. based on possibly the Intel Atom. Would be nice to have 20Watts of power or less. getting the most processing power for the watt. The atom 330 is the dual processor, 230 is the single.

Run Linux. Is free, has samba shares and VNC control. Can act as a domain controller for all other machines in the house ?

Runs house phone system via Magic Jack or Asterisk? Ideal that it would just be a cheap internet phone system. voice mail accessed via web browser.

Media server with 1TB of possibly RAID configured drives. 3*500GB drives? Must support 3.5 inch drives since 2.5 inch drives don’t come large enough. music plus video served to any player boxes in the house that ask.

Video capture or tuner card for incoming cable DVR? mp4 encoding in real time might be more processor power than this can handle ? tuner might be power hungry.

torrent client for file downloading from the net.

Truecrypt secure drive for crypt of all data.

Ideally its something that is a fully sealed fanless case. It should have 2 wires going in. Power + network. maybe video cable input ?

Bury this in my basement for thermal heat transfer into the ground.

Manage house security cameras/monitoring via network or wifi. Ideally the video stream is archived locally but pushed immediately to remote servers over the internet. i.e when someone breaks in and steals the home server the video of their act is not also stolen.

maybe take over functions of the router or cable modem. Act as a whole system smart firewall?

Basic web server ?

Results of Search for described machine:

I found a link to a like minded persons site: http://gcleric.wordpress.com/2009/01/24/planning-ubuntu-based-fanless-media-front-end-box/

http://www.klopfenstein.net/lorenz.aspx/fanless-intel-atom-d945gclf2

http://blog.scottnolan.org/2008/12/08/grumble-intel-atom-330-is-close-but-not-quite-there/

It just doesnt look like the low power version of this is quite ready yet. At least not for reasonable money.

The Intel Atom 230 is a decent lower power cpu, but the 330 is better. They are both X86 compatible making software compatibility a non problem. The big problems is there isnt a good low power support chip set to go with it. Intel insists on bundling it with the total pig Intel 945GC. Making it totally pointless. (i.e. it still needs a fan) The NVIDIA ION platform might be a solution to this. But it doesn’t seem like any systems are quite ready yet.

http://www.newegg.com/Product/Product.aspx?Item=N82E16813121359 – Close to what i might want.

http://www.aleutia.com/products/p1 – very close.

http://smart-home-blog.com

Being me, I now have to figure out how every bit of it works.

For anyone looking at phones and is considering an iPhone I’ll try to do a mental dump of what I’m seeing. Ultimately i recommend it but there are some things that might be a turn off for some.

Jail breaking:

The locked in nature of the iphone is very unsettling for us engineers. I can only do what Apple has decided i can do. I have considered jailbreaking it so i can run an actual SSH shell and possibly using the file system on it directly but I’m just not quite ready for that level of commitment. Once the phone is jailbroken its unclear how apple upgrades will work in the future. In the past once you jail break a phone it seems you are locked out of all future apple software updates. It is possible that a jail broken phone could be restored to apple original condition before being upgraded.

Iphone Lacks (in rough order of importance (to me))

• Poor battery life. If you are on vacation and actively using maps etc, expect the phone to die half way through the day. This has somewhat improved with software updates.
• No stereo blue tooth. A2DP is not available. Promised for v3.0 software.
• No Cut and Paste between applications. Must retype all text.
• Has a weird new connector. only chargers and docking stations specific to 3g will connect . All your old ipod and iphone stuff is not usable.
• Needs a decent camera. The current 2MPix camera is just not very good and is very motion sensitive.
• Needs ‘voice dial’ Feature. I cant speak “call home” or “play a song” etc.
• Needs spoken turn by turn directions for the map. I must look at the phone to read directions as i drive.
• No video recording.
• Does not give directional orientation for the map. I have no idea which direction i am looking in relation to the map displayed.
• Poor speaker volume.
• Tethering is not allowed in the US at any price. This is more of and ATT issue than Apple issue.
• Would be nice to have auto answer function for when listening to music.
• Restricts ringtones to itunes paid only. I cant use my own tunes for ring tones.
• No native voice recording – there are some 3rd party apps that do this so i hear.
• A removable SD card would be nice, or at least have the phone act as a stoarge drive so i can place random files on it,

read more at: http://iphone.macworld.com/2007/06/obvious_missing_features.php

Useful Links:

http://www.appleinsider.com

http://www.iphonehacks.com/jailbreak_iphone/

The hot trend in software for the last 2 years has been the idea of SOA or Service Oriented Architecture. Instead of allowing your customers to take a copy of your software and run it on their own machines, you can run the software yourself on some machine under your control and just rent the usage of your software to your customers. They interact with your software only over the internet, either by a web page or via some sort of internet protocol web service. This moves the worry of configuring and maintaining the hardware that the software product runs on from the customer to the service provider or software vendor.

Another related term used for this concept is SAS (software as a service).

Sounds like a great idea. You don’t actually have to own lots of computer equipment, you can just rent big machines on the internet as you need them. So do we get rid of our home/personal computers ? That has some great benefits but also some drawbacks. One big one is that you lose some control over the data. Companies can get sold, go out of business, change their pricing/policies at any time without asking you. Having a trusted home server might help to balance out those issues.

The concept of computing clouds is similar and complimentary to SOA. This allows a third party to enter the picture. The computing cloud now provides the platform and hardware for the software to be run. It creates a set of standard OS environments for the software to be run. The cloud provider maintains the hardware and provides a set of standard API’s to run whatever software the users might want. In the SOA case, neither the customer (end user) or the software vendor (service provider) needs to worry about the physical hardware the is running their service (SOA) software.

Imagine for instance you have created a software product as a SOA that has heavy usage but only during certain hours of the day. Before CC you had to own as much hardware to support the maximum load that you would imagine you needed, plus a little more to allow for failures. With computing clouds you now just need to trust the CC provider to provide you with this hardware when you need it. This can provide theoretically infinite scalability.

Amazon seems the farthest along on providing these services with a workable pricing model. They have data storage called S3, virtual Linux machines called E2, and even billing services.

I am in the process of evaluating this technology for my current projects. I’ll update this post when i get more information on it.

Some possible issues:

Monitoring tools.

API wars between CC standards

Internet lag, latency – with little control over where the servers are physically located.

Pricing – If you have 100% utilization of a server, does the price of CC compare to the price of a traditional dedicated server. For instance running a small scale windows Amazon server for a full month costs ~$90 and renting a dedicated equivalent server at ultrahosting.com is ~$40. So the key is that if you know you are going to fully utilize a dedicated machine then traditional hosting still makes sense.