The RSS feed for Ian's blog
I was quite surprised when Bethesda announced an update to Starfield alongside a new DLC this late into the games life. After all, Starfield launched nearly 3 years ago in September of 2023, and we're now only getting the second bit of DLC for it? While some games do receive new DLC many years after their release, Bethesda has typically been quite quick in releasing the game and then DLC shortly…
On March 30th 2016 the first commit of TLS Inspector, back then called Certificate Inspector, was made - and just shy of two weeks later version 1.0 was released. Now, 10 years later, TLS Inspector celebrates its 10th year, and I've got some exciting changes to share with you all. A Not-So-Quick History The original idea for TLS Inspector came about when I was travelling on a passenger ferry…
Turns out buying Air Pods from eBay is risky, who knew? Well, clearly I didn't because I totally fell for one. I was looking to pick up some used AirPods Pro 2 to use while out on walks or whenever my usual over-ears wouldn't be comfortable. I found a decent-enough looking listing that was selling a "opened and used once, but otherwise new" set for only 30% off what Apple is asking. Seems fair,…
A few months ago, I very briefly mentioned that I've migrated all my web infrastructure off Cloudflare, as well as having built a custom web service to host it all. I call this new web service WebCentral and I'd like to talk about some of the steps I've taken and lessons I've learned about how I secure my infrastructure. Building a Threat Model Before you can work to secure any service, you need…
I've been wanting hardware-accelerated video encoding on my Linux machine for quite a while now, but ask anybody who's used a Linux machine and they'll tell you of the horrors of Nvidia or AMD drivers. Intel, on the other hand, seems to be taking things in a much different, much more positive direction when it comes to their Arc graphics cards. I've heard positive things from people who use them…
According to the Wayback Machine, I launched my website over a decade ago, in 2013. Just that thought alone makes me feel old, but going back through the old snapshots of my websites made me feel a profound feeling of longing for a time when having a website used to be a novel and enjoyable experience. The Start Although I no longer have the original invoice, I believe I purchased the…
As an open source developer I frequently get emails from GitHub, most of these emails are notifications sent on behalf of GitHub users to let me know that somebody has interacted with something and requires my attention. Perhaps somebody has created a new issue on one of my repos, or replied to a comment I left, or opened a pull request, or perhaps the user is trying to impersonate GitHub security…
The staff running Cohost have announced ( archived ) that at the end of 2024 Cohost will be shutting down, with the site going read-only on October 1st 2024. This news was deeply upsetting to receive, as Cohost filled a space left by other social media websites when they stopped being fun and became nothing but tools of corporations. Looking Back I joined Cohost in October of 2022 when it was…
Recently I have received some questions from users of both TLS Inspector and DNS Inspector enquiring why the apps aren't available on Apple's new Vision Pro headset. While I have briefly discussed this over on my Mastodon, I figured it might be worthwhile putting things down with a bit more permanence. There are two main reasons why I am not making these apps available on the platform: exclusivity…
iOS and macOS developers will be familiar with the dreaded distribution certificate, a codesigning certificate issued to you by Apple for signing your release artifacts before you distribute them. Protecting that signing key is important, as Apple must blindly trust any binaries signed using that key when being distributed. If that key were to be compromised, then an attacker could sign a…
Today I learned something fascinating about how Windows deals with trusted root CA certificates. It might surprise you, and it certainly did for me, but out-of-the-box Windows doesn't come with a set of root CA certificates sufficient for web browsing. You can see this for yourself if you install a fresh copy of Windows without a network connection and view the machine certificates: The…
It is my joy and pleasure to present to you: the Zune "HD". The final device to wear the Zune name, released by Microsoft in October of 2009. A direct competitor to Apple's wildly successful iPod Touch, the Zune HD was the first Zune to feature a multi-touch display, full web browser, and "app store". Background When Apple released the iPhone in 2007, they also announced the first iPod Touch…
Let's talk about some of the simple & practical steps you can take to improve your GitHub account security. There's plenty of good reasons why you should try to keep any online account safe, but I feel that GitHub deserves special attention among developers. With automation through CI and CD taking center stage, it's not only important to you but also anybody who might rely on your code to ensure…
The concept of a "Snapshot" In computing, a snapshot is a point-in-time copy of data or state of a machine. You ever end up doing something like this? Each one of these files is a snapshot, as it's a copy of your essay at the point-in-time when you saved it. Snapshots provide us with an easy way to undo changes and backup systems. How Cassandra Stores Data Cassandra breaks its data down by…
The online certificate status protocol, or OCSP for short, is a way for TLS clients (like your web browser) to check if a certificate has been revoked or not. Certificate Revocation? With asymmetrical encryption, your encryption is only as good as long as your private key remains private. This is often not the case and private keys end up exposed. This is just one of the many possible reasons why…
Heads Up You should not be using C or OpenSSL to generate certificates or handle private key material. Memory safety is extremelly important, and C and OpenSSL fail to provide either of those. I strongly recommend you disregard this post and instead use a modern, memory-safe language for working with certificates. Recently I found myself needing to generate a HTTPS Server Certificate and Private…