Saga to sign an eclipse plugin with a code cert

Signing an Eclipse Plugin with a code cert should be simple right?

Well this is probably one of those cases that maybe it is obvious for others with more knowledge on how java code signing works, but I've spend the good part of two days trying to sign an eclipse plugin, and finally I was able to get it to work.

I will start with the solution (as executed in OSX), and then talk about the problem:

Book: Sum: Tales from the Afterlives

I just finished reading Sum: Tales from the Afterlives by David-Eagleman, which is a small and easy to read book with lots of great ideas and concepts.

The books is basically 40 mini sci-fi stories about possible scenarios that could happen after we die.

Ironically, and predictably, the side effort of reading these possible scenarios, is to appreciate even more the live we currently live on :)

David is also the author of  Incognito: The Secret Lives of The Brain, which is a book that I started reading on a Kindle, loved it, but never finished. This is another good example of why Kindle/eBooks don't have the same connection with the reader as physical book (see Physical Books are the best technology for reading for a better analysis of why I think that happens).

I have now bought a physical copy of  The Secret Lives of The Brain  and am looking forward to reading it property :)

Lockhart's Mathmatician's Lament, Math's should be treated as Art and the 'dangerous idea' that Zero is

I have a problem with how maths is being taught to our kids.

The best description of the problem I've read is Lockhart's Mathmatician's Lament since it really touches on the fundamental problem that we (as a society) have created:

Maths should be taught as Art, just like Music or Painting , instead of the current 'force feed abstract non-real-work complex set of instructions and concepts'

If you have not read his amazing paper (and you can just start with the first 10 or so pages), do it NOW since it might change how to think about Maths and how they are taught in school.

Updating GitHub Forks with latest commits from GitHub's 'parent' repo

One of the areas that tend to case some problems with GitHub 'Forking model' workflow, is the need to have the Forks updated with the commits that have been added to the Parent repo (i.e. the repo that was used to create the Fork from).

To see real-word examples (and pains) of this issue, take a look at these posts:

• How to update a forked GitHub repo (in this case tm-sme/Lib_Vulnerabilities) 
• Syncing all releases to the same commit and Tag (for TeamMentor v3.4) 
• Fixing the Merge conflict caused by one extra commit on TeamMentor master 

For the example show below, I'm going to update the DinisCruz-Dev/TeamMentor_Eclipse_Plugin repo which is a Fork of TeamMentor/TeamMentor_Eclipse_Plugin (here also referenced as the Parent repo).

Updating the GitHub repos for the 1.6.0 release of the Eclipse Fortify Plugin

As you can see by the recent eclipse related posts, I have been working on a Plugin for Eclipse that shows TeamMentor guidance to users that have access to the Fortify Eclipse plugin (and *.fpr files). We are now in the final stages of releasing the first public version (1.6.0) which is actually made of two parts: An Eclipse Plugin builder (which is Open Source) and a small 'Fortify Specific' code-mapping script. Very soon these will be in separate projects, but for now they are all hosted at the TeamMentor/TeamMentor_Eclipse_Plugin.

This post is just to document the current GitHub development model and where to find the main parts of this release.

On Java code formatting

As a variation of what I wrote in Formatting code for readability here is another example.

Which 'Java source equivalent files' shown below are easier to read?

This one (from FAQ How do I open an editor on something that is not a file?):

How to update a forked GitHub repo (in this case tm-sme/Lib_Vulnerabilities)

Today I helped to update the tm-sme/Lib_Vulnerabilities repo which is a fork of the TMContent/Lib_Vulnerabilities and is being auto-updated in real-time when changes made to the https://sme.teammentor.net/ server (i.e every time there is a content change in https://sme.teammentor.net there is a server-side git commit, followed by a git pull to tm-sme/Lib_Vulnerabilities (which is a pretty sweet workflow))

The issue we had was how to push the changes from tm-sme/Lib_Vulnerabilities into the TMContent/Lib_Vulnerabilities  repo, so that they can be synced back to https://vulnerabilities.teammentor.net

Note: this workflow would had been easier if the two repos where in sync, but it happened that there was one commit made to TMContent/Lib_Vulnerabilities (which is the master repo) on the 13th of Dec (d26f385) in between a bunch of updates to the tm-sme/Lib_Vulnerabilities repo (done automatically by TeamMentor). Bottom line: at this stage the repos are not compatible, which is why the GitHub Pull Requests don't work.

The O2 Platform is like a Microscope

Dennis Groove gave a really nice answer today on how he views the O2 Platform: "...O2 is in my humble opinion a tool not dissimilar from a microscope, it allows you to see what can not be seen. So yes, it does allow you to identify security vulnerabilities via static analysis and other methods. However, that is not really using the tool to its full potential..."

Here is the question asked on the O2 Platform mailing list:

Bill Gates would had changed to world more if he had bought and open sourced the Windows XP code base

I was reading the Wired Magazine that Bill edited and although Bill has done amazing things with his philanthropic activities, part of me things what would had been achieved if he had bought from Microsoft the Windows XP Operating System and Open Sourced it?

Here is an alternative reality that might had been much better for him and the world:

How to create (using Eclipse) JavaDocs that looks good? (My current approach is not working)

I want to create nice JavaDocs for the API I'm developing for TeamMentor's Eclipse Plugin Builder Kit (see here , here and here) , but at the moment I'm not having the results I want (see at the end of this post screenshots of the type of JavaDoc I want to create).

Here is the workflow I'm using to create the JavaDocs in Eclipse (Kepler):

Just donated £50 to Wikipedia

Similar to what I did last year (see Improved Wikipedia funding page, why OWASP needs something similar, and who buys OWASP Corporate Memberships  and Lovely 'post help' email from Wikipedia) I just helped keeping Wikipedia open and independent.

I really like their 'please help us' text:

The power of not being in power (and being ignored)

I think helps a lot to give clarity and focus to ideas when the 'idea maker' doesn't have enough power to 'force' their execution (or adoption)

I've talked about this before in You will not have your best ideas when you are in a position of Power and it is something that more and more fell that is needed.

As somebody who has a lot of opinions and ideas (see I wish that OWASP in 2014 ....) I think it is very healthy that once I Stepped down as Board Member I was able to (eventually) write freely about An Idea of a new model for OWASP

3 Patterns for deserialising Xml into Objects (1 good and 2 very dangerous (XStream and XMLDecoder)) and a bunch of questions on how to handle them

When me and Abe where at DefCon working on the final version of the slides for the RESTing On Your Laurels will Get YOu Pwned  presentation, we come up with a nice way to talk about the different approaches that can be taken when converting XML into Objects (the examples here are in Java, but this also applies to other languages/APIs).

Trying to add an 'EVIL bit' to java.lang.String (aka Java Taint Flag) and 'the first one has been set'

Following from the idea documented at the Java Tainted Strings post, Steven van der Baan is continuing his research, and at the last AppSec USA he had a break-though: we set the first 'Java EVIL bit' :)

This is a major development and if you are interested in this type of research, please join in the efforts (Steven is the one that has done most of the research so far, since I've haven't had the time to join in).

XStream "Remote Code Execution" exploit on code from "Standard way to serialize and deserialize Objects with XStream" article

At the DefCon 2013 I co-presented (with Abraham and Alvaro) the "RESTing On Your Laurels will Get YOu Pwned", which showed a number of PoCs on how REST interfaces and APIs can create a number a security vulnerabilities:

Since that time, I have blogged about a couple of the demos created:

• XmlDecoder JDK class: Using XMLDecoder to execute server-side Java Code on an Restlet application (i.e. Remote Command Execution)
• Groovy on Admin Interfaces: Neo4J CSRF payload to start processes (calc and nc) on the server 

We also showed a PoC using the XStream API (which had been reported to the XStream developers) which so far has not made it into a blog post (the PoCs presented at DecCon are here and here).

Since a quick search for 'XStream Vulnerabilities' only shows a couple examples (Spring Source OXM Remote OS Command Injection when XStream and IBM JRE are used, JAVA RESTful Services | Fuzzing Down the Rabbit Hole: Part One  and this git commit), I think it is fair to say that this is issue is still quite unknown.

Executing Eclipse Plugin JUnit tests in real-time without needing to restart Eclipse (with no mocking)

One of the key capabilities that I wanted to have after Programming Eclipse in Real-Time (using an 'Groovy based' Eclipse Plug-in), was to be able to run JUnit tests (including tests using STWBot)  in the live (under debug) Eclipse instance (called test Eclipse below).

This would allow me to code in a very quick/efficient TDD workflow, since I wouldn't have to wait 15s to 30s to see execution results for new JUnit tests or major/minor changes to existing JUnit tests.

The good news is that by using the GroovyExecution API that I wrote for the TeamMentor Eclipse Plugin, I was able to dynamically load and run the class files of the JUnit tests to execute, which was already a massive milestone, since that gave me 80% of what I needed. But it was only after Adding and using new API methods, that are consumed by an Eclipse Plugin under development (without Eclipse restart) and having JRebel enabled, that I had the full dynamic environment (where changes to the main plugin code and changes to JUnit test code did NOT require an Eclipse restart).

Here is a walkthrough of how it works (still a bit rough around the edges , but already a really powerful workflow).

Groovy Script to create a view that shows the images available in the ISharedImages class

Today I needed to add a couple icons to the Eclipse Plugin I'm working on, and after a quick Googling a bit, I found that Eclipse already includes a number of images with its release, namely via its ISharedImages class.

As with the question at Overview of ISharedImages? I wanted to see a full list of images available, and although that answer points to a couple blog posts that have it (see here and here) that didn't answer all my needs, since (for example) I also wanted to know if the images were available in the Eclipse versions we currently support (Indigo, Juno and Kepler).

Football group photo from last Saturday's game in Chiswick

As often I am able to make it, I join a great group of guys in Chiswick's Rocks Lane on Saturday for a 1:45m non-stop game of Football (soccer for the US readers)

This is a great way to keep in shape, and I hope I'm able to play for many more years (I also play in  Rocks Lane on Tuesday and Wednesday league games)

Here is a photo of the group that played last Saturday (some of these players are REALLY good, and it is a great honour to play with them)  :

Adding and using new API methods, that are consumed by an Eclipse Plugin under development (without Eclipse restart)

This is a variation of the example shown in Using JRebel to HotSwap new Static String fields in an Eclipse Plugin (without Eclipse restart) and its such a cool/powerful workflow that it deserves a dedicated blog post.

Part of the Eclipse Plug-in development toolkit I'm working on, are couple APIs that are inspired/based on my previous work at the OWASP O2 Platform's FluentSharp APIs (available from NuGet).

The core idea of these Fluent APIs is to simplify to the maximum the code required to perform a particular action.

Using JRebel to HotSwap new Static String fields in an Eclipse Plugin (without Eclipse restart)

After Installing, compiling and failing to use DCE VM for Eclipse Plugin development it was time to give JRebel a go (which is a commercial plugin that costs about ~300 USD per year).

TLDR: It worked and I was able to run an Eclipse Plugin, make big changes in a class already loaded (like adding a new field/method), and have access to those changes without needing to restart Eclipse.

Installing, compiling and failing to use DCE VM for Eclipse Plugin development

Last night I tried to use the amazing DCE VM tool (DCE = Dynamic Code Evolution) to apply hot fixes to the APIs I was creating for the open source Eclipse API Tool Kit I'm working on (as part of the TeamMentor Eclipse Fortify Plugin).

I was trying to address the limitations of the JVM's HotSwap technology which only works on certain inline code changes, and doesn't support at all the addition and changing of new methods.

TLDR: this post doesn't have the solution for this problem (see next post which shows JRebel in action).

In this post I'm going to show the workflow/steps that I followed to:

• create a version of DCE VM that worked on OSX Mavericks (after failing to use the provided binaries, and needing to compile the DCE VM code),  
• run eclipse under the modified/patched JDK 
• get a 'hang' in Eclipse when one of the dynamic code changes was applied.

Installing Gradle on OSX

Gradle is a build automation solution which can be downloaded from http://www.gradle.org/downloads and is an really powerful 'Groovy based' way to automate builds.

The download is made available (in Dec 2013) as a zip file, but for OSX there are is not 'installer script', so here is how I just set it up on my dev OSX laptop:

What if minecraft was open source? (it would be an amazing learning tool)

Last week I did my 2nd CodeClub session where we tried to use a Minecraft server in the class (see Setting up a CraftBukkit based Minecraft server on OSX (Nov 2013) )

And it was a painful experience.

There where a ton of technical probs and most (if not all of them) were caused by the fact that MineCraft is not open source and needs to have a 'call home' function to make sure the clients have a valid license (i.e. there is an authentication step when connecting to a Minecraft server which forces the clients to be online, and introduces a number of issues).

This got me thinking about the hidden costs of the 'Minecraft closed' world, and how much more of an impact it would have if it was open source (and freely available to more kids).

The hidden costs of closed words (in reference to Disney/Pixar animations)

I just watched the Disney movie Frozen (with the kids), which is basically a re-cast of the characters and technology used on the Tangled movie.

What I really found interesting was how the kids (8 of them) really had no idea what I was talking about when I mentioned "...well ... they grabbed the same Software and Character's Programming used in Tangled, added a change of clothes and programmed a new story..."

Basically the concept that there is a HUGE amount of programming and technology behind these movies (Pixar, Dreamworks Animation, Walt Disney Animation, etc...) is completely alien to them.

Blogger search is still broken and workaround to create a simpler (but working) blog search

I was trying to ignore this and see if Google Blogger team would fix it, but after a couple weeks (or more) it is still broken, and is starting to affect me (because I blog so that Future Self is able to find those ideas (like my Today Self, which is not able to find for what It think it is there).