Running as Root

I ran across a post in my RSS feeds today that referenced a paper on Bypassing Web Authentication and Authorization with HTTP Verb Tampering. What an awesome title. I'm immediately adding "verb tampering" to the list of things I randomly exclaim in meetings. The short version of the paper (that's represented pretty well by the other blog post) is:

• some developers secure URLs in their web application by URL and method (POST, GET, etc). Everything else is allowed (for some strange reason)
• some servers when they receive an invalid HTTP method or often HEAD will perform a GET and then just discard the body of the response. This is fine and is part of the RFC apparently, since the headers have to match between the two. I just wasn't aware of the fact
• there are still programmers that have non-idempotent GETs in their applications

The scenario is you find these applications / servers and do something like send a HEAD to the URL "deleteUser?userId=27" and then the server does it, despite the fact that you're not logged in.

I'm amazed that this is a problem, for multiple reasons. Who are these people that still don't understand that you don't use GET to do things like delete records from your system? I'd hate to see what one of those crazy internet spiders could do to these guys.

This is also a reason why I'm a big advocate of pushing your security checks as close to the data as you can comfortably stand. Certainly you should have protection at a service or DAO layer to prevent users with inadequate permissions (unauthenticated users fall into this category) from performing most operations in your system. This is also a good practice to ensure that different types of potential front ends don't accidentally grant access to the wrong users. The URL level of security is just icing and fluffery to make the application a little more user friendly.

Of course, that being said I work on an application that relies on mostly on URL level restrictions (I didn't do it and I'm working on changing it) and, if I remember correctly, so does my favorite Java web stack. I should point out that neither of these suffer from the problem described in the paper.

Sure, I could have named the post something like "Laying Pipe" but that's a bit obvious, isn't it? As my two blog readers have no doubt noticed (with some annoyance), I've been playing around with Bitstrips and throwing together the occasional comic (complete with my first comment directed at how shitty my "artwork" is). One problem with Bitstrips (other than the fact they co-own everything you do) is that they don't have an RSS feed for either your comics or your series. I opened a bug on the matter but rather than sit back and wait for it, I decided it might be time to have some more fun with Yahoo! Pipes.

The Plan

Bitstrips provides a link to a pseudo feed for each series. The series ID is passed in as a parameter and you get a paginated view of all of the episodes. I figured I'd just grab that page in pipes, create a title off of the episode title, grab the associated URL for the episode, grab the image of the strip for the episode, and throw the whole thing together to make a feed for my series.

Execution

Numerous problems occurred after I start implementing that simple plan–most of the problems being in the Bitstrips layout. I won't go into detail about it, but here's a summary of the steps I went through to get my feed:

• Get the series "feed" page – http://bitstrips.com/feed.php?feed=s_9713 in this case
• Find the URL of whatever page is associated with the "go to last" button – The feed page outputs the series in order. For the feed, I want the most recent stuff. There is no option to just go to the last page, so I need to find that button, grab its associated URL, and then retrieve that URL as my new starting point.
• Regex some fields – I use the regular expression module in Pipes to pull out values for the title field, the publication date, and the link for the item.
• Clean up the date – The date isn't in the proper format, so I need to use the Date Formatter and re-assign the value to "item.y:published". This is how you get a pubDate into an RSS feed from Pipes (thank you Yahoo! discussion forums). This all happens inside of a loop.
• Sort – I want to include this feed into a spliced super feed, so I want to sort it by publication date. However, the publish date in the comic has no time stamp. Luckily, the URL for the comic uses an auto-incrementing ID, so I just sort by that.
• Get the image for the comic – Now we follow the link that we got earlier that goes to the individual episodes. We do this inside of a loop to get images for each item. After that loop, we use a regular expression to get rid of all the extra HTML around the image so we're just left with a nice img element.
• Ship it! – We now have the title, a link to the comic, and the image of the comic. We're done.

Results

Here's what the pipe looks like from way up here:

You can see the results of the pipe here or even examine the "source code" a little more closely by editing it (requires a Yahoo! login and you can't actually edit my version, so there).

Of course, this is a very brittle and ill-advised way of doing things. As soon as Bitstrips changes their site my pipe will burst into flames and spew all sorts of errors into the feed. There is also probably an easier way to do it either in or out of Yahoo! Pipes, but I had fun doing it this way. I haven't decided if I want to put this feed into a jumbo super feed yet or not, but that is most likely the way I'll do it. For now, subscribe if you want but it may go away or be duplicated in a feed to be named later.

I'm enamored with the idea of Google Android. I briefly looked at the development kit and was very impressed by it. And then I did nothing with it. Part of the problem is that there is no Android capable phone at the moment. That takes some of the sex appeal out of developing for it. More than that is the fact that I don't have any ideas for applications that I'm all that passionate about.

This weekend I heard that Google acquired Grand Central. They're a company I've never heard of but they've got an impressive list of features. Grand Central is a "web-based voice communications platform". It'll let you do all sorts of cool things with your phones via a single number.

This got me to thinking about cool things you could do with Grand Central and Android. Where I work, we use a product called Contactual to route calls for our support number to any other phone number. You can also use their web interface to place an outgoing call and have the resulting call sent to your phone. This is in place so support technicians don't inadvertently give their personal phone number to a customer via caller ID. Once a customer gets a personal number they think that they have a buddy in technical support that can't help them out whenever they run into a snag, rather than going through the proper channels.

What would be interesting would be to see an Android/Grand Central application that would make a similar scenario as easy as dialing an ordinary number. Perhaps allowing you to select any of your phone numbers from a drop down when making the call.

Many of the other features listed on Grand Central's page also look like they'd be an excellent fit with an Android phone.

• Call Record – Use the phone to signal to the server that you want to record your current call
• Block Callers – Why not use Android to let you mark an incoming call's number (or current call) as a blocked number?
• Call Switch – Use your phone to transfer your current call to any of your other numbers.

All of these things are possible with Grand Central and become that much cooler if you can use your phone to do them more directly. It seems like a great tie in for an upcoming product and a recent acquisition all in the same related problem space. Of course, I'm far too lazy and stupid to code any of it, but it still sounds cool.

I bought Lisa a new laptop a couple of months ago and the only OS option was Vista. I can't get her onto the Linux bandwagon unfortunately. Yesterday she was trying to print something only to find out that I hadn't set up her printer on the new laptop.

We have an HP Photosmart 1215 which sadly doesn't have (and apparently never will have) Vista drivers. I tried the XP driver only to find that it didn't quite work. Luckily, I found this post saying that the drivers for the 7200 should work. I tried them and they did. Yay, internet!

I might point out that I had no problem getting the printer working with Linux–you know, the hard to use operating system. Gee, I don't know why people are hating Vista so darn much.

I read a post recently about how someone found a password via a search for its MD5 hash on Google. Within the comments someone mentioned a site that had a database and search engine for hashes. The part I found clever was that the database of hashes self populates whenever someone uses the site to calculate a hash off of a string of plain text. I'm sure they populate from another source as well, but the last just struck me as interesting.

I added The Linux Action Show! Podcast to my listening list today and got immediate benefits. I nearly stopped listening within the first minute since the two guys try and do the fake "radio guy" voice a little too much. Luckily they leveled off a short bit later and began to sound pretty much like any two random tech people I know. One of the items in their news section mentioned that a new version of VirtualBox is available.

I'd never heard of VirtualBox before, but I'm a big fan of virtualization and I liked the features they were mentioning. It came at a great time for me as I have been debating buying VMWare Workstation for home use, replacing the free VMWare Player (I also use VMWare server on a dedicated machine). I'd been getting a little irritated at the lack of snapshots in Player lately.

I'm on Ubuntu and I use a Windows VM for assorted applications that don't work under Linux (and are flaky under Wine). Occasionally I feel like trying a random Windows program out. I'd like the option to roll back the VM to a known good state in case anything happens. VirtualBox has an open source version and an enterprise version that is free for personal use–both have snapshot support. I tried out the latter, which also has an iSCSI feature I want to play with later (which is supported by FreeNAS). My initial impressions are very good. It supports snapshots, automatic guest OS desktop resizing, and automatic keyboard and mouse capture and release. Plus it's free for me. Those are the big things I want in a desktop VM application. The performance is also somewhat snappier for several of the programs I use regularly under the Windows VM.

I'll probably still need VMWare player for some more exotic operating systems that might not work 100% with VirtualBox, but that's fine. I'll be sure to update this if anything starts to go badly wrong, but for now it looks like I've got a new VM solution at home. Color me happy.

I ran out of space on my home file server about 4 or 5 months ago. Since drives have become so cheap I went out and got a pair of 500GB Seagates with the intention of running a software RAID (level 1, two drive mirroring–let's have the 4/5 debate some other time). As long as you're not doing a software RAID using Windows, my understanding is that it'll be stable and reasonably performant. Besides, I'm not an IT shop, just a home network and I also didn't feel like purchasing and dicking around with new hardware for this project. Of course, being lazy I just now got around to actually doing the work.

My first idea was to just put good old Ubuntu server on there and set up Samba, SSH, etc myself. It's not all that difficult to do. Then, I ran across a project calls FreeNAS. It's a FreeBSD-ish network attached storage project that borrows some of the configuration pages / scripts from m0n0wall (another project I started using instead of Freesco or Coyote Linux for my routing and firewall needs).

After deciding to give FreeNAS a try I pulled down the live CD, currently version 0.685RC1, and burned a CD. I slapped the drives into the old box (400Mhz Pentium leftover), threw in a CD and booted up. Running in this configuration I would boot from the CD each time, read the specific configuration from a floppy, and use the full space of both drives for data. It took a few minutes to figure out the correct order of doing things (add drive to configuration, format drive, create raid volume, format raid, create mount point, configure CIFS, configure SSH, add users and groups) but the whole thing took well under an hour. You have the option to use the web interface to configure everything, back up your config floppy, and even add and rebuild new drives in the RAID.

Once I was done with all of that I had a file server I could access from both Windows and Linux. I moved some files out there and played around testing the performance. Everything seems good. Yay. Finally a home IT project that wasn't a huge pain in the ass. If nothing breaks I'm a convert. I'll just have to move over the old files at some point and I'll be fully done.

In the Future, Everything Will Be Glue

The entry title is from Weird Science, by the way:

Gary: I was crazy for this little eighth grade bitch.
Wyatt: Crazy, Insane!
Gary: I was dedicated to this girl, I called her every damn night!
Old Pimp Dude in the Bar: You called her every night? On the telephone?
Gary: On the telephone? What's he mean on the telephone, course it was on the telephone!

In my work life, the team I'm on has been working for quite some time fixing the architecture for an existing product. One of the things we've been doing while we've been fixing things is to add a REST API. You can save the REST vs WS-* debate for some other time and place.

Meet the New Product, Same as the Old Product

Unfortunately, there was a distinct lack of excitement about the new stuff we'd been doing from other areas of the company. Programmers seem to immediately "get" why exposing all of the CRUD functionality of your system through a web API is the sheer sweetness in terms of application integration. Sales and executive staff don't always see the possibilities. They saw the new version as architecture changes that improved performance and scalability while maintaining functional parity with the shipping version. That didn't scream sexy.

The programmers, ever fearing being a cost center with a very killable project, decided to start creating proof of concept integration examples that would create internal demand for the nearly finished version.

Pretty State Machine

As background, our system has an operational state that changes the way almost everything behaves. The change in this state is typically user driven. Someone using the software would decide to change the operational state due to an external event such as a Martian invasion. The software has a web interface but we had the idea that it'd be much cooler to change the operational state via a telephone.

We can change our operational state via the REST API by putting (as in HTTP PUT) an XML document representing the system status to the server. The system status has an element that represents the operational state. Now, our IT guy is always telling me the crazy stuff he can do with his home VOIP system. He runs a virtual machine with Asterisk and other assorted software an combination with an IP phone. I ran the idea of executing a shell script from a phone menu by him and he assured me it should be easy to do.

I was working under a deadline (of course) so I created three versions of the XML (one for each state I would be changing to) and got a copy of cURL installed in the Asterisk VM to PUT each document to our server, hopefully in response to someone pressing a button on a phone. After hitting a very serious dead end and wasting several hours trying to get an IVR working (that's what phone people call those voice menus) I finally found an example of an Asterisk iTunes controller. To use it you dial an extension, hear a beep, then press a button to do something. The script in Asterisk then calls a shell script in response to your button press. Five minutes after finding it I had a working example of changing operational state in our product via a telephone (actually a softphone but who's really keeping score at this point). Booyah! Sure it only took me 10 hours discover how to do an hour or so worth of work but then that's the plight of the knowledge worker.

Demo Day

The next day we invited additional people to our iteration demo meeting (really it's just the people that were supposed to be going all along but weren't) and showed the phone demo as our finale. Suddenly, people seemed as interested in our new version of the product as the developers are. There was a palpable sense of excitement. There were tears of joy. The developers were hoisted up onto the shoulders of sales and management and carried out into the streets (think about the scene in Dragon: The Bruce Lee Story).

I'm exaggerating a little bit perhaps. Of course there are all sorts of negatives preceding and following this event, but can't we just bask in the glory of this one little success for just a few moments? On the telephone.

How I waste my free time

In between trying to get a simple Arduino project thrown together and farting around with the Yahoo! UI Library, I took a timeout to play around with Firefox add-on (back in my day they were extensions) named Stylish.

The subject came up on Jyte that black text on a white background wasn't the friendliest design for some people. Unfortunately, most sites don't support user specific skins so if the site's design causes you problems, from a vision related impairment for instance, then you're just shit out of luck. That's where Stylish comes in. It lets you create custom CSS overrides on a per site basis.

Can you see me now?

Yet another thing to do when you're bored: see if you can completely change the color scheme of a site to make it hideously ugly for no good reason. It took a little work, but I managed to make a really nasty looking blue and purple on black style for Jyte.

Most of the work was just finding all the nasty little inherited background colors, background images, etc. One interesting problem came up because Jyte has a set of menus that are images of text. They have a white highlight built into them and look like complete crap on the new black background. I thought it wouldn't be a problem to turn links with images into links with the image alt attribute as the link text and then hide the image.

Let the CSS fun begin

I thought maybe some sweet CSS action like this would work:

.nav_item a img:before {
  content:attr(alt);
}

.nav_item a img {
  visibility:hidden;
  width:0;
}

Oh, how lovely that would be. Apparently it'll work in some builds of Firefox but got turned off in later versions. I think it was a feature request specifically to make my life more difficult. :before and :after pseudo elements for other elements work fine, just not images.

So, with a lot of trial and error I wound up with the less than ideal:

.nav_item a[href="/home"]:before {
  content:"Home";
}

.nav_item a[href="/home"] img {
  visibility:hidden;
  width:0;
}

Since I no longer had access to the alt attribute on the image I had to manually insert the correct link text for each menu item. I did this for each menu by using an attribute selector to find each link by its href attribute, then hard coded the content to the correct text and finally hid the image.

You nasty, nasty boy

Oh, it's nasty all right, but it works. The only problem is I was trying to make the CSS overrides generic and there's a dynamic menu that includes the user name. Luckily there's only one such dynamic menu so I just made an entry to handle all such menus as the dynamic one and let the more specific rules clean up after the fact. Ta da! A custom, site specific CSS override that no one will ever use because it looks like it was beaten with a bag of hammers and makes your eyes hurt to read.

The interesting thing is that there are now ways for users to make the sites they frequent more appealing and possibly more accessible via add-ons like Stylish and Greasemonkey. It's not ideal for non-technical users, but sites like Userscripts and Userstyles can help by acting as repositories with aids created by the more technical members of the community.

It was too simple to do, but here's a Greasemonkey script to add access keys to the claims page on Jyte. The keys are set to "n" and "p" for next and previous respectively. Under Firefox, access keys are accessed using Shit+Alt. So, Shift+Alt+N will take you to the next 10 claims on Jyte while you're on any page like http://jyte.com/claims. Another thing to do when you're bored. Write Greasemonkey scripts that will be made rapidly obsolete whenever a developer has a spare 30 seconds. Whee. As always, please excuse the crudity of this script as JavaScript is not my forte.

Here it is if you care.