gregh  2006-11-08 16:45  hosting_services  identity  Internet  Website   

'Supercerts' Aim to Highlight Legit Web Sites:

Over the past couple of years, dozens of companies have rolled out technologies designed to help computer users and companies better spot 'phishing' scams -- Web sites that try to trick people into giving away financial and personal data. But what about helping users tell for certain that when their browser tells them that they are at, say, BankofAmerica.com, that they're really at the bank's official Web site and not at some scam site?

That's precisely the aim of CA/Browserforum, a security effort by the major Web browser makers and certificate authorities, or companies who sell and issue Web site security certificates.

Today, pretty much any Web site owner can plunk down between $150 to $400 and purchase a secure sockets layer (SSL) certificate, a technology designed not only to protect the integrity of data submitted by customers but also to give visitors a modicum of assurance that the site takes their security seriously. By clicking on the little padlock icon in the browser that accompanies all SSL certified sites, visitors also can gain more assurances that the SSL holder is a legitimate company and that it at least has been vetted by a certification authority to some degree.

It wasn't too long ago, I was having a discussion with someone about this topic. The first time I tried to purchase a server certificate (from VeriSign), it was actually a labor-intensive process. I was working for Instinctive Technology (the makers of eRoom, bought by Documentum, who in turn was bought by EMC) and we had maybe 20 employees at the time. VeriSign rejected the application initially, because they couldn't verify that we existed. I had to come up with a D&B number, and I had to have a letter from an officer on company letterhead stating who we were and that the company was indeed requesting the certificate. Finally, I had to make several phone calls to finally get the thing processed. In the end, I was left pretty convinced that they knew who I was.

Obviously, that process wasn't going to work on a larger scale, and things became something of a joke. Now, certificates do little more then authenticate that someone presumably legitimate signed the data contained in the certificate. So, with this proposal, I guess we're taking some queues from the past. Imagine; people might actually have to get involved in an effort to prove identity.

gregh  2006-08-31 12:37  hosting_services  system_administration  Website   

Maybe you noticed that my server has been unavailable lately?

Since Saturday, my server has been randomly going down. I hadn't been able to figure out why. My logs bore no indications, I keep the system relatively up-to-date, and I don't run much on the server other than the webserver, ssh, and a tightly controlled proxy. I figured there might be some random hardware problem, or perhaps there was an unpatched denial of service targeted at my kernel, which I don't update as often.

Neither was particularly attractive to address. The reason I try to avoid touching the kernel is that the server is a rented machine, hosted by EV1Servers (yes, the company that took so much heat for buying an IP license from the SCO Group a couple of years ago.) I've not had an opportunity to test them with a tough problem, and hosing up booting by killing the system wasn't something I wanted to try. So, I've only patched kernels when it's been critical. Because the server lives in Houston, TX, and is actually owned by the host, that's another reason that troubleshooting potential hardware issues is difficult.

Of course, on-campus interviewing submissions had to be out Tuesday morning, so I didn't spend much time on it over the weekend. There's work and school during the week. I'm going out of town this weekend. In short, I wasn't sure how or when I was going to resolve this, and it's been driving me nuts.

And so, today it went down again, just as it had first on Saturday, then again on Monday morning, and Tuesday afternoon. EV1 provides a remote reboot capability, but it's never brought the server back up. I've always had to request a manual reboot. It never made much sense to me; after all, it's supposed to be power cycling the server. I just figured maybe it didn't really do what they claimed it did.

Things started to get odd when the second of my requests received a response like this:

8/28/2006 5:15:18 PM
DataCenter
Dear Gregory Haverkamp,
We are closing this ticket now for ther seem to be another issue being addressed on this server at this time. Please feel free to look into the other open tickets on this server for further details of the status of your server.

I reopened the ticket, noted that I had no outstanding trouble tickets, and that I really need the server rebooted. They complied. On Tuesday's request, no "other tickets" were mentioned. That subject did come up again today after I tried to reopen their closed ticket:

8/31/2006 2:25:10 PM
DataCenter
Dear Gregory Haverkamp,
We are closing this ticket now for ther seem to be another issue being
addressed on this server at this time. Please feel free to look into
the other open tickets or customer service on this server for further details of the status
of your server.

Thank You
joyce o
Webhosting Server Support Technician
Ev1Servers

8/31/2006 2:42:46 PM
DataCenter
Dear Gregory Haverkamp,
Your server is under abuse investigations right now.It is for this reason that we are unable to reboot your server.We are sorry for any inconvience costed.Please refer to escalation # 1307120.Thanks you for your patience.

Thank You
joyce o
Webhosting Server Support Technician
Ev1Servers

And so I contacted customer service:

[16:26:06] Janelle W : unfortunately, I believe there has been a
mistake made on your account. The ticket number that they have
refrenced does pull up an abuse issue, but it is not on your account.
It is on someone else's account.
[16:26:40] Greg : Hehe. It's probably the same mistake they made
two days ago, too, when they initially told me they couldn't do it.
[16:27:01] Greg : Could this also be involved in my server appearing
to occasional drop off the network?
[16:27:09] Janelle W : let me check one more thing, and if I still
cant figure it out, I will forward you to technical support, since
they are the ones that e-mailed you
[16:30:13] Janelle W : I believe we might have figured out what the
problem is. can you hold on just one moment while I confirm it?
[16:30:26] Greg : Certainly.
[16:34:08] Janelle W : thank you so much for your patience, it will
be just one more moment
[16:40:15] Janelle W : Thank you so much for waiting. Our abuse
department is investigating this issue and someone will get back with
you either by trouble ticket, or e-mail

And so, around 4 hours afters it originally went down again:

8/31/2006 3:53:58 PM
Abuse
Dear Customer,

Your server is online and responding to ping and ssh. After reviewing the situation, it appears that your server was unplugged incorrectly due to human error. We sincerely apologize for any inconvenience this issue has caused you. No AUP violation has occured on your server, and we will be notating your account to indicate that. Once again, we apologize for the error and will be reviewing the matter so that it does not reoccur.

And so, they had mistakenly tied my server (but not my account) to an abuse investigation. This apparently resulted in repeatedly unplugging my server without any notification. From what I can tell of the reboot history of this machine since Saturday, others probably could have noticed something was amiss and said something about it, but no one did.

Mistakes do happen, and I'm glad they cleared it up quickly once they discovered there was a problem. Right now, I'm just hopeful that this ends the recent string server deaths I was seeing, that this actually was my problem.

gregh  2006-05-23 00:10  Blogging  Drupal  Internet  Website   

I finally upgraded to Drupal 4.7. The site was bouncing around a bit, as I was making some changes to some of the hierarchy along the way. It's still a hideous mess, but at least it's a little bit manageable.

Right now, I'm mostly looking forward to posting right out of MarsEdit without an error every time. Until this, the process had been draft, post, refresh, edit, re-add categories, and re-send. Only then would content make it out. I was too lazy to track it all the way down. Mired down in the old xmlrpc.php, I eventually just decided I didn't care.

Next, I need to figure out how to dynamically add tags (Categories) from MarsEdit, so I can use it to freetag.

gregh  2006-05-02 11:53  Collective  Law_School  Website   

Otherwise Alienating:

In this case I agree with Greg completely, but in more general terms I like listening to debates about Constitutional law and the such. I find it all intensely interesting. Enought that occationally I find myself thinking that law school would be a hell of a lot of fun.

And then I remember that I have the memory capacity of a walnut, and if I can't derive what I am supposed to remember from first principles I am hopeless, so if I had to remember case references and specifics of laws and procedures without having them right in front of me, I'd be done for.

That was Sam, in response to an earlier post of mine.

First, it always pains me to see a snippet of something I've written posted somewhere with a typo. I didn't put a whole lot of effort into editing this particular rant, but it would still be nice to avoid such things. In the section quoted, there was at least one clear typo and a couple of sketchy (requiring further analysis) grammatical choices.

For Sam and others, it is important to keep in mind that there's not a whole lot of actual argument (or even intellectual discussons) in law school. This particular rant came from a companion site on Westlaw's TWEN (The West Educational Network), which we were required to participate on (More of my take on TWEN happenings here and more generally, here.) What I've found is that many of my classmates appear completely unwilling to take on these topics energetically. There were actually two more responses by the guy I questioned in this post, but that was pretty unusual, including for him. In fact, my style was intentionally somewhat different here. You might note that I actually questioned his views, rather than writing a more detached response. I was largely hoping to elicit a response.

In class, almost all discussion focuses on the case decisions being analyzed. There's not a lot of debate or even philosophical discussion, though we did touch a bit more on that in Con Law than in others.

Actually, Prof. Adler, our Con Law professor, encouraged more such interaction than most. He mandated participation on TWEN, and he also held 5 class exercises, and in all but one exercise, students represented either Supreme Court Justices or attorneys representing parties in simulated oral arguments. I participated for the first time in one of these last night as, after some lobbying -- thanks, Mr. Peters, Justice Scalia. (I felt we hadn't had enough Scalia injected by previous Scalias, so I did my part to try to inject a little more Scalia than usual.) These exercises gave us more opportunities to actually treat these things more philosophically.

Despite my general distaste for TWEN's technologies, I also appreciated having that avenue to discuss these things. I tend to like to see my ideas before speaking about them, and class discussion doesn't really lend itself to that. Using TWEN, I can write out hopefully cogent arguments. If someone comes back and can convince me I'm wrong, so much the better. I've learned. Or, I can write a response back, clarifying their points. Again, hopefully, we've both benefited by seeing other views, being questioned, and having to defend our perspectives. (Prof. Adler mentioned that he was pleased they occasionally even got feisty... and then looked at me.)

At the end of class, during the usual process of telling us how much he enjoyed the semester, Prof. Adler pointed out that this was the last time our section was going to be together as a group. With the exception of a few who have dropped out, and a couple we picked up for one reason or another, all but two of my classes this far have been with the same group of students I started with 4 semesters ago, in the fall of 2004. Last night was the last regular meeting of our scheduled required classes (we meet for a Crim Pro review session tomorrow night.) He handed out copies of our seating charts to memorialize the group. It was right up there with Prof. Travis handing us keys (a different story.)

I don't believe I've previously posted this here before, but if you're curious to see the sort of folks I've been hanging out with the last couple of years, here's a photo Professor Osborn commissioned of us, as we ended the second of our two semesters of contracts with him (click for the full-sized version):

Starting next semester, we go our separate ways in scheduling.

gregh  2006-02-02 13:19  Internet  Website   

Google is not playing along.

gregh  2005-08-09 13:53  Blogging  CCLP  Internet  Law_School  TV  Uncategorized  Website   

From the web logs:

• http://www.google.com/search (diet coke nectar of the gods)

Clearly someone thinking the right way.

• http://www.google.com/search (coalition of concerned legal professionals)

I'm pleased to see some folks able to find something out about this group before getting involved. There have been as many as 4 or 5 hits on this search a day, just in what comes in with referer's (a dying feature, unfortunately.)

• http://www.google.com/search (peter jennings desperate housewives cancer)
• http://www.blingo.com/search (peter jennings interrupt)

Apparently, I wasn't the only one irritated.

And then there are the random people hitting my class notes from last year:

• http://www.google.co.in/search (indian contract act,carlill vs carbolic smoke ball co.)

Like this person, who appears to be looking for two different things related to contracts. For those unaware, the Carbolic Smoke Ball case is a class contracts mainstay. So classic, people have built a business around its name. Likely, few people other than law students and lawyers are going to ever find it.

There's also the confused, like this person, who can't quite remember the name:

• http://www.google.co.in/search (carlill vs carbolic gas company)

Lots and lots more cases. I won't go through all of them.

gregh  2005-07-29 02:47  Blogging  Collective  Drupal  Motorcycling  Website   

I just flipped the switch on the site, so that it now runs Drupal. I had been running WordPress.

Why the change? Well, the principal reasons revolve around the features of Drupal and how I believe they can be used for my Law School Collective system, as well as for a little project I'm working on for BMWSportTouring.com. In addition, I tend to believe that it may well fill the roll at work we're currently looking at a wiki for... And I think it can do it in a more user-friendly, integrated way. In fact, there's even a person we've not entirely helped yet who I think could make use of the integrated service.

A replacement for a wiki? Well, principally, I'm looking at the collaborative book feature. We're primarily looking at a wiki to handle FAQ's at work. The collaborative book feature seems to take care of that, and it's in a much more natural form for users than a wiki is. We still get to track the changes, who made the changes, etc.

But we've also been talking about blog services. So, Drupal can subsume both most of the wiki functionality and handle the blogs, already configured to do so in a multi-user environment. Plus, it will happily hand us RSS feeds of every posting.

Then, there have been some who want message boards and notifications. Yup, it's in there.

I'll go into the BMWSportTouring.com stuff a bit later. This has run later than I anticipated.