Happy “Learn Your Name in Morse Code Day”
–jeroen
Audio via [WayBack] https://morsecode.scphillips.com/translator.html
Archive for January, 2018
ACME TLS-SNI-01 validation disabled due to vulnerability – Incidents – Let’s Encrypt Community Support
Posted by jpluimers on 2018/01/11
Now that so many sites depend on LetsEncrypt: maybe it is time for a second one.
We’ve received a credible report of a problem with ACME TLS-SNI-01 validation which could allow people to get certificates they should not be able to get. While we investigate further we have disabled tls-sni-01 validation. We’ll post more information soon.
Source: [Archive.is] ACME TLS-SNI-01 validation disabled due to vulnerability – Incidents – Let’s Encrypt Community Support
Via:
- [WayBack] Wie viel Internet kippt mittlerweile eigentlich um, wenn letsencrypt weg ist? Ein zweites letsencrypt wäre toll. – Stefan Funke – Google+
- [WayBack] Wie viel Internet kippt mittlerweile eigentlich um, wenn letsencrypt weg ist? Ein zweites letsencrypt wäre toll. – Kristian Köhntopp – Google+
–jeroen
Share this:
Posted in Encryption, Let's Encrypt (letsencrypt/certbot), Power User, Security | Leave a Comment »
19 Tips For Everyday Git Use
Posted by jpluimers on 2018/01/11
Great set of tips; I’ve included to intro and ToC here so it’s easier for me to find, but all the details are at [WayBack] 19 Tips For Everyday Git Use. For each paragraph, the ToC lists the relevant command. The article itself also contains some very insightful animated images of which I included one below to get an impression.
Share this:
Posted in Development, DVCS - Distributed Version Control, git, Source Code Management | 1 Comment »
Reminder to self – Fiddler for OS X Beta
Posted by jpluimers on 2018/01/11
Reminder to self: [WayBack] Fiddler for OS X Beta as it’s been on my list since about a year ago: Fiddler for OS X Beta « The Wiert Corner – irregular stream of stuff.
Note that reading the cerficicates can be done in a more simple way for the Current version of Mono:
/Library/Frameworks/Mono.framework/Versions/Current/bin/mozroots --import --sync
I forgot in which version the Mono installer has Current linked to the most recently installed Mono version but it works well.
Executing should then be somethig like this:
/Library/Frameworks/Mono.framework/Versions/Current/bin/mono ~/bin/fiddler-mac/Fiddler.exe
I expect quite some bit of trouble decrypting HTTPS [Arvhive.is] as that was troublesome on Windows in the early Fiddler days as well.
In case of trouble, there is always Fiddler Ideas: Customer Feedback for Fiddler by Telerik . Add a new product idea or vote on an existing idea using the Fiddler by Telerik customer feedback form via [WayBack] Tsviatko Yovtchev: “@jpluimers @ericlaw https://t.co/lRNXC88M1b is our feature suggestion/issue tracker portal. Fiddler itself notifies on new versions.”
Back to the reminder: [WayBack] Fiddler for OS X Beta.
Direct download https://telerik-fiddler.s3.amazonaws.com/fiddler/fiddler-mac.zip.
Downloading Fiddler for OS X Beta…
If your download does not start, please [WayBack] click here to retry
Getting started
If you don’t have the Mono framework installed on your Mac
Please download it from [WayBack] http://www.mono-project.com/download/#download-mac and install it. If you already have it installed, ensure you’re running the latest version.
If you just installed Mono
Please open Terminal and type in:
/Library/Frameworks/Mono.framework/Versions/<Mono Version>/bin/mozroots --import --sync(The Mono framework has its own trusted root certificates store. Currently (at mono version 4.2.4) this store remains empty after installing Mono on OS X. Fiddler uses the certificates in this store to validate the certificates of the websites visited. So you need to populate this store with a set of commonly trusted root authorities to avoid getting constant certificate warnings from Fiddler. The mozroots tool imports trusted authorities from the Mozilla LXR. )
Extract
fiddler-mac.zipto a folder you have write access to.It is recommended that the full path to Fiddler install folder does not contain any Windows path illegal characters. (At present it is possible that some Fiddler functionality, e.g. various file exports or Fiddler Script won’t handle such paths.)
Open Terminal and navigate to the folder you extracted to in step 3.
Type
mono Fiddler.exein Terminal.To further understand the benefits and limitations of Fiddler for OS X please visit [WayBack] this blog post.
–jeroen
Share this:
Posted in Development, Fiddler, Software Development, Web Development | Leave a Comment »
A way to bypass a Chrome interstitial page is to type a secret keyword…
Posted by jpluimers on 2018/01/10
Some sites do not have their TLS security set- up correctly. You can get around the page that Chrome then displays. This is called the “interstitial bypass”, you should use it with great care (not like one of the sites I visited a year ago that got themselves a nice ransomware attack), for instance on machines you can dispose off.
The mechanism has changed over time, from a simple button to a passphrase that changes every now and then.
Some historic links on this:
Via:
A way to bypass a Chrome interstitial page is to type a secret keyword. Until today, this not-no-secret keyword was “badidea”. And it just changed. So h… – François Beaufort – Google+
- [WayBack] You could bypass the false positive page in Chrome with a password. This password just changed, here is the new password. – Kristian Köhntopp – Google+
- [Cannot be archived] Change the interstitial bypass keyword (Id3250926) · Gerrit Code Review
- [Archive.is] 797344 – Change the interstitial bypass keyword – chromium – Monorail
- [Archive.is] 581189 – “danger” shortcut removed – chromium – Monorail
- [Archive.is] 569999 – Rotating / removing the HTTPS interstitial bypass word – chromium – Monorail
- [WayBack] ImperialViolet – SSL interstitial bypass rates
–jeroen
Share this:
Posted in Chrome, Google, Power User | Leave a Comment »
xs:choice element to C# – Google Search
Posted by jpluimers on 2018/01/10
Some links via xs:choice element to C# – Google Search.
I need them one day to better understand xsd:choice mapping to C# for both XSD and WSDL usage.
I have the feeling that the WSDL and XSD importer are trying to be smart, so for instance when you have multiple choices that come down to a common basic type like a derivation from xsd:string, it makes to two properties: a C# enumeration to select the type and a C# string value for the content referencing the enumeration through a XmlChoiceIdentifierAttribute.
- [WayBack] From XML to Strong Types in C# – CodeProject
- [WayBack] Representing xsd:choice element in C# | Dimitri Glazkov
- [WayBack] Choice Element Binding Support explaining the
XmlChoiceIdentifierAttribute. - [WayBack]
<xsd:choice>Element - [WayBack] Dealing with an XSD Choice when XSD.exe doesn’t add XmlChoiceIdentifierAttribute – MCS UK Solution Development Team
–jeroen
Share this:
Posted in .NET, C#, Development, Software Development | Leave a Comment »
Delphi: playing Chimes.wav as an external file or embedded WAVE resource in Delphi XE5.
Posted by jpluimers on 2018/01/10
As a by-effect, this article seems to one of the few that shows where Delphi uses the
.dresfile extension introduced around Delphi XE.
Recently I had to play some notification sounds in a Windows Delphi application where the application deployment should be as easy as possible: preferable copying the EXE around.
Playing a sound file seems easy, especially if it is a [WayBack] WAV file: just use the [WayBack] PlaySound or the (older) [WayBack] sndPlaySound API functions.
But if you start searching on the internet, you see lots of curious implementations for playing WAV resources through sndPlaySound.
The actual implementation is really really easy though, just make sure you follow the steps right and nothing can go wrong.
[WayBack] The full source code is on my BeSharp.net repository, here is how to to it step by step:
The steps depend on the
MMSystemunit, so most of the code translates back to [WayBack] Turbo Pascal for Windows (yes, the 16-bit Pascal days when theMMSystemunit was introduced) with the exception of theSND_SENTRYflag.The thing that more recent Delphi versions made a lot easier is embedding
WAVfiles asWAVEresources, more on that further on. Read the rest of this entry »
Share this:
Posted in Borland Pascal, Delphi, Delphi 2, Delphi 2005, Delphi 2006, Delphi 2007, Delphi 2009, Delphi 2010, Delphi 3, Delphi 4, Delphi 5, Delphi 6, Delphi 7, Delphi XE, Delphi XE2, Delphi XE3, Delphi XE4, Delphi XE5, Development, Pascal, Software Development, Turbo Pascal | Leave a Comment »
Damned ! var Comp : function(const s1, s2: string): Boolean; begin if CheckB…
Posted by jpluimers on 2018/01/10
One of my main gripes about lots of RTL/VCL/FMX code: conventions are often lacking.
Which means one of the below functions starts with Ansi (but does a Unicode operation) and the other has the parameters in reverse.
var
Comp: function(const s1, s2: string): Boolean;
begin
if CheckBox1.Checked then
Comp := ContainsText
else
Comp := AnsiStartsText;
end;
–jeroen
source: [WayBack] Damned ! var Comp : function(const s1, s2: string): Boolean; begin if CheckB… – Paul TOTH +
Share this:
Posted in Delphi, Development, Software Development | 2 Comments »
Autoregister attribute for Delphi | Jon L. Aasenden
Posted by jpluimers on 2018/01/10
Interesting idea:
[WayBack] Wouldn’t it be nice if Delphi has an attribute that automatically registers your class for you? – Lennart Aasenden – Google+
Source at [WayBack] Autoregister attribute for Delphi | Jon L. Aasenden
–jeroen
Share this:
Posted in Delphi, Development, Software Development | Leave a Comment »
SSLLabs security reports for some embarcadero subdomains
Posted by jpluimers on 2018/01/09
I hope this is a coincidence. Before Nick Hodges left, the TLS security of the various embarcadero https servers was increased, most from grade F. Now they might soon be grade F again.
Hopefully somebody in IT has time to take a renewed look as security needs constant attention.
- “This server is vulnerable to the Return Of Bleichenbacher’s Oracle Threat (ROBOT) vulnerability. Grade will be set to F from February 2018.”
- “This server uses 64-bit block cipher (3DES / DES / RC2 / IDEA) with modern protocols. Grade capped to C. MORE INFO »“
I’ve only included a fraction of their sub-domains, as really this is a job for the Embarcadero IT department.
Related:
- Oh nice: the compiler settings in your .dproj files are not reflected in what Ctrl-O O emits in XE7
- Positive: Delphi 10.1 Berlin is out; negative all Embarcadero HTTPS sites still vulnerable to DROWN attack
- RAD Studio 10 next stop: Berlin (via: The inheritance tree of all Fire Monkey objects) but would you really trust it?
- New Delphi product version: will it be Seattle or 10? It might be both! radstudiodemos/code/…/branches now has RADStudio_Seattle branch, docwiki URLs with Seattle exists and nice YouTube preview image!
Share this:
Posted in Encryption, HTTPS/TLS security, Power User, Security | Leave a Comment »
The Wiert Corner - irregular stream of stuff 