Why do client certs have to be so difficult?

8 Comments

Now that Resteasy 3.0-beta-1 is out, I’ve been thinking a lot about some custom security protocols I’d like to prototype.  Client cert authentication has always been a part of that thinking, but when it comes to browsers, client certificates are complex and even scary for most users.  Why does it have to be this way?

Current web authentication uses cookies to set up a secure session between an authenticated user and his browser.  Cookies are allocated and stored per-domain and forwared with HTTP requests to those domains.  Why can’t we do something similar with SSL and client certificates?

For example, what if when you registered at Google.com, it asked you, “Do you want to authorize this device?”.  You would click on a “OK” button and Google would generate a key-pair and a digitially google-signed certificate for your device.  The HTTP response to clicking that “OK” button would provide a base 64 encoded headers that contained the generated private key and signed certificate:

HTTP/1.1 200 OK
Content-Type: text/html
Set-Private-Key: 23423ab1123affaccde12312
Set-Certificate: 11ab332789dff


<h1>All Set</h1>
<p>Your machine is now authorized</p>

For the google.com domain, your browser would store the private key and certificate in your browser’s persistent store.  The next time your browser makes an HTTPS connection to google.com, it would use this certificate to connect.  When you think about it, this isn’t much different than google setting a persistent cookie to remember who you are.  Now its remembering you in a much more secure way.

Additionally, what would be cool, if this google-generated client-cert could be negotiated and sent to other domains/websites on the internet.  For example, let’s say you had a social media site that exchanged sensitive information and wanted to use HTTPS.  The social media site could send a redirect, with an additional certificate negotiation header stating which client-cert domains it prefers

HTTP/1.1 307
Location: https:/.../
Accept-Certificate: google.com, facebook.com

Here, the server is redirecting us to an HTTPS based URL.  The Accept-Certificate says that it requires a google.com or facebook.com generated client certificate.  The browser would then make an SSL connection to the redirect URL using a stored client cert from one of the preferred domains.

There’s a bunch of cool things about this.  For one, you could have SSO to multiple different social media sites and applications without the need to enter one password.  Secondly, there’s a lot of secure protocols you could implement on top of this to make the internet as a whole, more secure.  Most importantly, there’s no knowledge the human user has to have as to install a client certificate.  It really sucks that the microsofts, mozillas, apples, and googles of the world haven’t put much more thought into client-certs and making them easier to use.

Resteasy 3.0 Beta 1, JAX-RS 2.0 Preview

4 Comments

Now that JAX-RS 2.0 is in Public Draft and has stabilized a bit, API-wise, we finally released Resteasy 3.0 Beta 1.  This release implements almost all of the features defined in the JAX-RS 2.0 Public Draft.  Many of the key features in Resteasy 2.x have now been standardized in JAX-RS 2.0.  There’s a new client API which is similar (actually better) than the current Resteasy 2.x client API.  Interceptors have been added to the spec.  You’ll find that they map very closely to Resteasy’s.  I pushed really hard for this.  Finally, there’s the async HTTP apis.  Also very similar to Resteasy’s.  All and all, if you’re using some of these features currently within Resteasy, you shouldn’t have much problems migrating to the JAX-RS 2.0 equivalent APIs.  The only thing we’re missing is the client proxy support, but I couldn’t get other experts to agree it was a good idea to add. :(

This beta has a few JAX-RS 2.0 examples with the distribution.  The Resteasy documentation regarding JAX-RS 2.0 isn’t where I want it yet, but we’ll get there as we get closer to a final release of 3.0.  To learn some of the new features, it may be best to take a look at some of the features within Resteasy that take advantage of these APIs.  I’ve linked them all below.

java.dzone.com/articles/whats-new-jax-rs-20

Resteasy 2.3.5 Released

2 Comments

After a bit of delay, Resteasy 2.3.5 is finally out.  It is pretty much a maintenance release.  I want to thank Ron Sigal and Wei Nan Li.  They did almost all the work for this release (minus patches submitted by users).  Resteasy 3.0 beta later this week!

Go to Resteasy website for links on how to download, you can check out the release notes too.

What should be in next Restful Java Book?

9 Comments

JAX-RS 2.0 is around the corner. We’re ironing things out in the JSR group and alpha implementations should be out soon along with the public draft. I talked to O’Reilly and the sales of my Restul Java book were good enough to justify a revision. So…

What do you want in Restful Java 2.0?

The obvious things are new spec features, specifically new chapters on:

  • Client API
  • Filters and Interceptors
  • Asynchronous HTTP

There’s a few other minor features that will be sprinkled about in existing chapters of the book.  We’ll also need to update the Java EE integration section as when the book was written, it hadn’t really be finalized yet.

For the filters and interceptors chapter, I was thinking about walking through (with code examples) the use cases that were the inspiration for these features in the spec.

For the asynchronous HTTP chapter, I was thinking of using/implementing  a slimmed down simple version of the HornetQ REST interface.  That way I can throw in bits about Atom as well as some useful restful patterns.

For security, I was thinking of talking a bit more about Resteasy’s S/MIME and DKIM support and how they fit into the security picture.  We could also talk about OAuth too.

What else?  Please comment.

Xoticpc/Sager/7970m Horrible – Mythlogic/680m Great

15 Comments

If you read my last blog you know that I was in the market to get a souped up gaming laptop.  It has been a 2 month long adventure…

Summary

  • Xoticpc is a worthless middleman that provides zero value-add.
  • Sager doesn’t test their machines very well
  • AMD 7970m is not ready for primetime
  • Mythlogic  is a great vendor.  Worth every penny.  Highly recommend.
  • Nvidia 680m works like a charm

The miserable XoticPC/Sager experience

Ordered a sager np9170 with latest and greatest Intel Ivy Bridge CPU and AMD 7970m GPU.  I had a few questions and had a decent, relatively prompt, email exchange with XoticPC sales. Order fulfillment was strange. When I initially placed the order, Xotic emailed me saying they needed me to email a scanned image of both sides of my credit card and driver’s license.  I was a bit uncomfortable doing this, so I refused this request.  I’ve bought computers online for years and years and never have been asked to do something like this.  Xotic calls my credit card company, Bank of America, who tells them to do the reasonable thing:  call me on my home phone and that would be enough to verify my identity.
I got the machine within 2 weeks.  This is when the problems started.  Firstly, the accessories I ordered with the laptop did not ship with the laptop.  I thought this odd, so immediately called XoticPC.  Their response was that accessories are a separate shipment.  Suspiciously, within a few hours of the call, I receive an email that my accessories have shipped along with a UPS tracking number.  I get the accessories a week after this call to find that one of the ordered accessories was missing.  At least one, probably two screw-ups on order processing.

Ok, now onto the laptop itself.  I unpackage it, turn it on.  Within 10 minutes of turning it on as I’m downloading various things I need for the laptop, it crashes.  Basically a screen freeze.  I have to unplug and also remove the battery to re-boot.  Standard stuff.  Computer hangs again 10 minute later just browsing the internet.  Reboot.  I’m ok for another few hours, actually get SWTOR installed and running.  Am playing for like 5 minutes, again…crash.  This time though, the computer will not reboot and can’t even get to the BIOS splash screen….So my nightmare is realized.  I purchased a machine that doesn’t work.

It’s still working hours so I call XoticPC support.  I explain the problem to the support engineer.  My answer is: [total silence for 5 seconds then...]  “Huh….wow….Well, sounds bad.  Not something I can help you with.  Email support@xoticpc.com and they will definitely be able to help you.”  I’m speechless…I hang up and immediately send out that email to support@xoticpc.com.

Since Xotic is a Sager reseller and their 24 hour service number is actually a Sager 1-800 number, I decide to call Sager.  I actually get somebody pretty quickly surprisingly and explain to him the problem.  His response is: “It’s probably the GPU, but maybe also a fan/heat problem.  You’ll have to work with XoticPC and send it in for repair.”  Again, speechless.  How the can Sager send me a laptop that doesn’t work!!!!  Do they have any QA?!?!  This is the same crap I went through with Alienware back in 2006.  How hard is it to send a product that actually works?

I got too much work to do the next day, but I finally get a response back from XoticPC.  After a brief exchange and description of my Sager support conversation, XoticPC agrees that the machine must be sent in for repair.  I tell them I’m not dealing with a defective product or company and say I want a full refund.  Luckily, they get me an RMA pretty quick and I send back the laptop (to a Sager address) on 7/2/12, I have to pay shipping with insurance though, about $125.

On 7/27, I haven’t received my refund yet or any notification from XoticPC, so I email sales.  I get a response that a refund for $65.00 has been processed.  I tell him that that is the refund for the accessory they decided never to ship me.  He tells me that ok, yes, I’m right, and that my laptop refund is still being processed.  7/31, I finally get an email saying my laptop refund has been process.  As of today 8/7, I’m still waiting to see it on my credit card.  So, I email Xotic PC asking WTF is going on.  Their reply is that they have submitted the electronic refund and that it is out of their control and that I have to contact my credit card company.  I ask if there is a way to track this.  Their reply is that they don’t have that information.  So, I call my credit card company they say Visa sometimes takes up to 15days.

The Mythlogic Experience

After sending in the RMA to Xotic/Sager on 7/2, I decide to look for another vendor.  My goal this time is to find somebody that actually tests and QAs their products before sending them out.  I read a bunch and actually post my situation on forum.notebookreview.com.  A few people point me to Mythlogic.  They are not resellers, but instead, actually build their own machines.  After reading a few forum posts about the company and the insane amount of QA they do, I email their sales asking them a few questions about the quality of 7970m  at about 10pm at night.  Surprisingly, I get a response with 2 minutes.  Over the next 3 hours (1:30 am) we exchange a few emails.  I was surprised their guys are up until then!  I’m impressed enough to place my order on 7/3.  The specs are identical to my Xotic order: Intel Core i7-3920XM 2.90GHz, AMD 7970m, and dual Raid 0 Intel 520 SSDs.

On 7/23 I’m still waiting for my machine to get out of the “Pending Parts” phase.  I email Mythlogic asking them what’s going on and get a response within 2 minutes saying that they have had trouble getting the AMD 7970m GPU in stock, but that my machine is scheduled to be built this week.   Later that day my order status changes to burn-in/QA.

Three days later I get this email:

I’m afraid I have some bad news, the 7970M that is in your laptop is performing out of spec (high temperatures, unstable performance) and we are going to have to replace it to enable your laptop to pass QA. Because of the high level of demand for these cards, we do not have any extras on hand, but we are working with our partners and vendors to get a replacement as soon as possible. When we have a specific ETA on when we can get a new card, we will let you know ASAP.

Meanwhile, there are alternate options available if you would like to consider them. If you would like to upgrade to an nVidia 680M, you can do so for $250, and we can have that ordered and through QA by the end of next week.  If you would like to downgrade to an nVidia 675M (performance loss of about 20%), you would receive a refund of $125, and we could continue your build immediately as we have that part on-hand.

This is why I went with Mythlogic!  I wanted a company that would find problems up front to avoid receiving a defective product.  At this point, I’m pretty worried about the AMD 7970m.  Its probably a similar problem to my XoticPC/Sager machine.  I do a bit more research online and find that numerous people are also having problems with the new AMD 7970m.  So, I email Mythlogic back and tell them I’ll upgrade to the NVidia 680m.

My order ships a week later and I got the machine on Monday. One cool thing was that the machine shipped with the results of the QA done on the machine. 4 different 3DMark and PCMark benchmarks were done. Battle Field 3 was played on my machine and graphs of temperature, power, and voltage were taken while the game was played. IOTests were done on external IO ports (USB, etc.). And the display calibration results were attached.

So far the machine works great.  Graphics switching works flawlessly and all my games perform the way I want.  I did have one problem though.  I randomly got a dialog box popping up saying “? Bad quality”.  So, I emailed Mythlogic support at about 7:30pm at night.  Received a response at 3:00am saying that it is a problem with lack of light for my fingerprint reader. What?!?!  Support that actually figures out my problem?!!!  :)   So, I disable the fingerprint reader and now I’m all set!

[Edited 5 days later] Things still going great. One thing I’ve noticed is how cool, temperature wise, the clevo, intel i7-3970, and nvidia 680m combination runs. In an apples to oranges comparison, my 2009 Macbook Pro ran insanely hot.

Moral of the story

I think it is a matter of probabilities. Normally, people are happy with Xotic/Sager because they got a cheap gaming laptop and because the probability of getting a bad component is really low. So, whether or not Sager’s QA is poor doesn’t really matter because systems are usually built with functioning components…

But, Since such a high number of 7970ms were bad, the probability of building a machine with a bad component shot up dramatically. So, the poorness of Sager’s QA process (or lack of QA) and the coolness/thoroughness of Mythlogic’s QA process were made blatantly obvious.

Edited Tuesday 10/16

Update more than 2+ months later.  My Mythlogic machine is still working great.  I did get a refund from Xotic about 2 weeks after this blog posting.  One more thing, after returning my broken XoticPC/Sager machine 2+ months ago I just got this email today from XoticPC:

“Hi!

We just wanted to check up on the laptop you purchased from Xotic PC.  Since you have now had some time to use your new laptop we would like to get your feedback on how everything has been going. We hope you are happy with your new laptop and the service you received from Xotic PC, and your satisfaction is our utmost priority.   If you can spare a minute please reply back to me that you have received your new system ok, as well as feedback on the service that you received from Xotic PC.  Additionally please let us know if you have any questions,  issues, or concerns about your new system. Good or bad, your feedback helps me, as Service Manager, try to meet your expectations.

 I look forward to hearing from you. Thank you again for choosing Xotic PC for your new computer purchase.

Bleepin idiots….

BTW, here are the final specs of my awesome Mythlogic machine after ditching 7970m/sager/xoticpc:

Mobile Chassis: MYTHLOGIC Nyx 1712 Chassis (Clevo P170EM) with backlit keyboard
Mobile Display: 17.3″ Full HD (1920×1080) Glossy 90% NTSC Color Gamut LED Backlit LCD
Dead Pixel Guarantee: MYTH Pixel Perfect Guarantee
Monitor Calibration: Free MYTH Professional Monitor Color Calibration
CPU: Intel Core i7-3920XM 2.90GHz, 8M L3 Cache, 22nm, DDR3-1600MHz, Extreme Edition Mobile Processor
Thermal Compound: Free IC Diamond Thermal Compound
System Memory: 16GB (2 x 8GB) , PC3-12800, 1600MHz SODIMM (Patriot)
Video Adapter: NVIDIA 680M 4096MB GDDR5 DX11 GPU with Optimus Technology
Optical: Notebook Black 8X DVD+RW/CDRW Combo Drive
RAID [Requires Identical Hard Drive Selections]: RAID 0 | 2 Disk Min. Striped set, improved performance, additional storage drive highly recommended
Hard Drive: Intel 240GB 520 Series SATA III 6Gb/s Solid State Drive Sandforce Powered
Hard Drive: Intel 240GB 520 Series SATA III 6Gb/s Solid State Drive Sandforce Powered
Keyboard: Backlit Chiclet Keyboard – English Only
Network Card: Onboard Gigabit (10/100/1000 Mbits/sec) LAN subsystem
Wireless Card: Intel Centrino Ultimate-N 6300 3*3 802.11 a/g/n 450MB Total Bandwidth
Bluetooth: Integrated Bluetooth 4.0 Only With Intel 2230/6235 AND Killer 1202 Wireless
Wireless Router: Netgear N900 (WNDR4500) 450 + 450 Mbps
Operating System: Windows 7 Home Premium:
Anti-Virus Software: Microsoft Security Essentials
Productivity: Microsoft Office Home and Student 2010
Extra AC Adapter: Extra AC Adapter (Nyx 1712)
MYTHLOGIC Assurance: MYTH Lifetime Assurance with Lifetime Labor + 2 Years Parts Warranty, 2 Yrs 2-Way Shipping Cont US
Phoenix Upgrade Plan: Lifetime Phoenix Upgrade Plan

No 17″ Macbook means I need a different brand

4 Comments

My Macbook Pro 17″ is about 3+ years old and I had great anticipation for WWDC today.  Boy was I disappointed!  No more 17″ Macbook Pro!  17″ is a must for me and their graphics card (as usual) is middle of the road.  The big thing is the Retina display, but you may not be able to see a difference.  I’m actually kind of really pissed off.  So much so, it may be time to ditch Apple.  The only things that may keep me are:

  • High quality product and high quality support.  Apple is 2nd to none in both of those categories (at least in my experience).  I’m willing to pay big bucks for both of these things if they are a reality.
  • Commercial Unix.  The High quality product/support combined with  a unix-based laptop.
  • No-thought/knowledge-required Windows dual-boot (Bootcamp).
  • The awesome touchpad
  • Automatic iphone sync/backup

I’m looking for a gaming laptop alternative, please offer recommendations!

If I have to go back to Windblows, its got to be with a kick-ass gaming laptop.  I took this route back in 2006 and purchased an Alienware beast of a laptop.  I returned the initial shipment because it was not assembled correctly (hard drive wasn’t fully connected) and just broken in general as well.  Got a replacement, but that died in less than 1 year.  I tried to get help from Alienware to fix it (my warranty was still valid), but gave up after 1-2 weeks of getting the run-around from their support.  Bought a Macbook and have been happy every since, until today…Before 2006 it was also an endless string of crappy Dell notebooks.

Can anybody recommend a kick-ass 17″+ gaming notebook that they have bought in the past year that wasn’t broken when you got it and doesn’t have horrible support and is decent quality?  Maybe Alienware has improved?  Asus? Hp Envy?  Its hard to tell who is a good company and who isn’t when dealing with these high-end laptops.  I’ve spent a few hours searching and reading, but can’t really get anything definitive on quality of product/support.

Solar Powered iPhone

Leave a comment

This has got to be the coolest mobile phone accessory ever

 

 

Older Entries Newer Entries

Follow

Get every new post delivered to your Inbox.

Join 612 other followers

%d bloggers like this: