Technology

Broadly defined "technology" e.g. software, water pumps

Installing Jenkins - Quick, Easy, Somewhat secure

Submitted by greggles on

Step 1: firewall off port 8080

Jenkins, by default, launches on port 8080 and anonymous users have full rights. This would let anonymous users run arbitrary code on your server. That's great for usability for a tool that's usually launched inside firewalls, but if you have a machine without a firewall...derp.

So, my recipe that provides some flexibility and some security was:

sudo ufw allow 22
sudo ufw allow 80
sudo ufw allow 443
sudo ufw default deny
sudo ufw enable

That lets http, https, and ssh traffic from anywhere on the net get into the box, but denies all other traffic. Defaults of ufw also allow all outbound traffic (which is handy for apt-get and other similar stuff). To be ideal you'd lock down specific outbound connections and also only allow 22 (i.e. ssh) from known good IP addresses. I'm not into managing that closely for this particular server. Read more docs on ufw.

But then...how do you connect to port 8080 for Jenkins access? You use an ssh tunnel:

ssh -qNf -L8080:localhost:8080 [email protected]

Then you fire up a browser to http://localhost:8080 and it's being tunneled over ssh to the server. But...nothing is running there yet...step 2.

2. Install Jenkins on Ubuntu

I was installing this on an Ubuntu 11.10 server (Oneiric) but I think this is probably a good guide: Jenkins Wiki on Installing Jenkins on Ubuntu. They use their own package outside Ubuntu's repository so you have to add the key, but I found it to be much more user friendly than the default Jenkins that comes with Ubuntu. So, I'm using it!

3. Securing jenkins (basics)

Category: 
Technology
People Involved: 
Greg

Cross Site Request Forgery in Tumblr "Ask a Question" feature

Submitted by greggles on

This might be the first nerd-blog post in a long time, so my apologies if I startle anyone. As a quick update, I wrote a book on security in Drupal and then founded a company focused on Drupal security services and then sold that company to Acquia where I currently work.

So....Tumblr is a big deal. They apparently have 120million users and are totally awesome.

I was trying Tumblr out for a site and noticed that many of their interactions relied 100% on Javascript for a "delete/cancel" confirmation. I fired up my handy-dandy browser tools and inspected the http headers associated witih deleting a message. Turns out that it's vulnerable to a cross-site-request-forgery. In general Tumblr uses the token-synchronizer csrf prevention (as documented on OWASP). I'm not necessarily saying they copiedOWASP or were inspired, just that it follows the pattern of using a second form token that is sent on all requests for a session. They do not use a different token per form/action: once you get the anti-CSRF-nonce it's the same for multiple different operations. Their token is called the form_key.

Want to see the problem in action? I even made this handy dandy movie of the problem:

Category: 
Technology
People Involved: 
Knaddisons

Initial Thoughts on the Kindle Fire

Submitted by greggles on

So, a few weeks back my Kindle Fire arrived and I started jotting notes as I opened it and used it. Here's the collection:

  • The un-boxing was surprisingly pleasant: minimal plastic, lots of recycled elements, no user-manual (it's on the device!). The package was about 2.5 inches tall and about 2 inches of that was empty, with a small cardboard elevating the kindle above the empty space that contained a small USB cord.. Why ruin the experience with all that empty space?
  • The USB Cord...it's a "wallwart" with a micro-usb on the end. I'm super excited that the device uses the current standard micro-usb b as its source of power and connectivity but what a waste to send me a cable connected to a wall-wart. I'd be way happier with something like this wall-usb and standard usb cable.
  • I now have learned that this wallwart USB outputs more than normal power, so it can't be a normal device. That kinda...sucks. If it uses different power I would almost rather have a different plug just to make that clear (though apparently the size lets me power it up slowly via computer if I'm in a bind). I wish it would take normal micro-usb power form a normal cable even if that means slower charging.
  • The power button is on the bottom right next to the USB port and headphone port which makes it easy to accidentally press it when you connect/disconnect your headphones/usb plug. To solve this, I've started using it upside down which means I type my password upside down when I unlock it. Of course the screen flips once it's unlocked, but now the sound comes out the "bottom" and gets my stomach messy with it's messy, messy sound.
  • The screen is pretty awesome. Very bright and crisp.
Category: 
Technology
People Involved: 
Greg

Android Apps I actually Use

Submitted by greggles on

I recently had to reset my entire phone deleting all contents (different story). In the process I wrote down the old apps I had that I liked so I could reinstall them after wiping it. I was surprised how easy it was to do that and how all my contacts/mail/calendar being associated with my Google account made the whole process simple.

So, in case you're interested, here's the list of apps I actually reinstalled:

Category: 
Technology
People Involved: 
Greg

How to write an email to piss off your developer

Submitted by greggles on

I'm writing this so other developers can share in the laughter (ha!) and designers/managers can learn.

I've seen this a few times. It feels like there's a mad-libs form that designers/managers use to communicate things in a software project.

Hey:

$normal_behavior_of_our_product_for_the_past_year, $insulting_phrase, $client_need_never_mentioned_before_this_month, $high_stress!!!!!

Thanks,
$designer_or_manager

So, an example letter:

Hey:

Category: 
Technology
People Involved: 
Greg
Friends

Pages

Subscribe to RSS - Technology