Tag: Web Browsers

  • Working with legacy tech: accessing old web portals that use an insecure TLS version

    Working with legacy tech: accessing old web portals that use an insecure TLS version

    In my last post, I wrote about importing MiniDV tape content to a modern computer. That leads nicely into today’s topic… because modern computers tend not to have huge amounts of local storage. We generally don’t need it, because we store our files in the cloud, and only use the local drive as a cache. But what about when you’re importing large amounts of data (say video), and you want somewhere to stage it locally, with a little more space?

    I was about to throw away an old NetGear ReadyNAS Duo unit (that’s been in disgrace ever since a disk failure taught me the hard way that RAID1 is not a backup…), but then I thought it might be useful to stage some video content, before moving it somewhere safer.

    Accessing the ReadyNAS

    First problem was knowing what IP address it had. I managed to find that using NetGear’s RAIDar utility. But, to change the IP address (or any other settings), I needed to use the admin console. And that gave me a problem: my browser refused to connect to the site, saying that the connection was not secure and that it uses an unsupported protocol.

    Well, it’s better than a modern cutesey “Something went wrong” message. It gave me a clue as to the problem – SSL version or Cipher mismatch – sounds like out of date TLS. Indeed it is, and Gøran B. Aasen wrote about the challenge in March 2022, along with a potential solution for certain ReadyNAS devices.

    I’m not bothered about upgrading Apache to support TLS 1.2 – but I did still need to administer the device. I tried messing around with browser settings in Edge, Chrome and Firefox but had no luck. The transition period is over. TLS 1.0 is not supported at all. Then I had an idea… what if I installed an older browser version? And instead of installing it, what if I used a portable app version?

    Tada!

    Firefox 73.0.1 being used to access the ReadyNAS admin console

    So, here we go, Firefox 73.0.1 from PortableApps, via SourceForge. And I’m successfully accessing the ReadyNAS admin console.

    The risk statement

    For security folks who will tell me why this is a really bad idea, I know. So here’s the disclaimer. You’re only at risk when you’re using that old browser, because you didn’t install it on your system – it’s a portable app. And you’ll only use that old browser to access this one website, so when you’re not accessing the website, you’ll have closed it down, right? That way you are taking a calculated risk and mitigating it by minimising the time you have the old software running for.

    As for publishing an internal IP on the web… yes, you’ve got me there…

    Featured image: author’s own.

  • Running the Pixlr Editor (or other Adobe Flash-based apps) in a modern browser

    Many people will be familiar with the Pixlr browser-based image editing tool, Pixlr Editor. Unfortunately, it’s developed in Adobe Flash, a technology that’s rapidly falling out of favour with developers (about time too!) and losing browser support.

    A few weeks ago, I tried to run Pixlr Editor in Chrome and found it wouldn’t work. Same for Safari. Edge gave a similar experience – in fact only Internet Explorer would play nicely!

    Then I found Paulo Amaroso’s Google+ post about the issue (yes, Google+!). It seems that what I needed to do was click on the “omnibar” (the secure padlock or info button to the left of the URL in the browser) to open up Chrome settings and select Flash then Always allow on this site.

    Interestingly, I’m now seeing browsers prompting me to enable Flash for the website… I suspect Pixlr have updated their website to improve the user experience.

    Allow Flash for pixlr editor website in Chrome

  • Authentication issues with SharePoint in Windows Explorer mode resolved with browser proxy settings

    Every now and again I get infuriated by our Microsoft Office SharePoint Server (2007) platform as it prompts for credentials (before failing to authenticate and repeating the process) when I go to open a document library in Windows Explorer mode.  Today I found the cause of that issue.

    I’d been working at Microsoft’s offices yesterday and had disabled the proxy server settings in my browser.  After returning home and VPNing to our network, I was able to access both Internet and intranet resources as normal and I forgot about the proxy server change. Only when trying to work out why I was being asked for authentication as I tried to use SharePoint in Windows Explorer mode did I remember to turn it back on again – after which everything worked as it should.

    It may be peculiar to our infrastructure, or it may be a wider issue that’s worth mentioning so, if you experience authentication issues when trying to open a SharePoint library in Windows Explorer mode, double-check your browser’s proxy server settings!

  • Faster websites, better photography, a better browser, great conferences and a better life (#MKGN)

    Last night was the fourth of the tremendously successful MK Geek Nights (MKGN), organised by David Hughes (@DavidHughes) and Richard Wiggins (@RichardWiggins).

    And what a night it was.  Interesting and inspiring talks from great speakers, as usual – and I promised I’d write a summary blog post so here it is, albeit a little longer and a little later than planned…

    Adventures with Google PageSpeed

    Kier Whitaker (@kierwhitaker) kicked off the evening, with a few tips for speeding up websites:

    1. Make fewer HTTP requests:
      • Each JS or CSS file and every image is a round trip across the network. The fewer trips made across a congested network, the faster the page loads.
    2. Use Minify to compress and concatenate CSS and JS files :
      • Codekit is one option for embedding Minify in your workflow; there are command line tools too.
      • Consider using a master file with imports and then minify to compress the output (might not be so useful as an approach when working in teams).
    3. Optimise your images:
      • ImageOptim is one option – and even that 50-60-70% the images can still look great.
      • Apparently, Photoshop’s Export to Web functionality is not so good [damn!].
    4. Only use what you need:
      • When working with libraries, you don’t have to use all of Modernizr, jQuery, etc. – maybe just include the parts that you need (e.g. AJAX and not the whole library).
    5. CSS at the top, JS at the bottom:
      • This is a simplistic rule and you might need to break it sometimes (e.g. to stop a flash of unstyled type when using Typekit).
      • It’s about percieved speed rather than actual page loads [but perception is reality].
    6. HTTP compression:
      • Use GZIP compression on the server. On Apache this can be configured using .htaccess or in httpd.conf.
    7. Browser caching:
      • Make the browser keep a copy of the file – if only a page is only updated infrequently, you can cache for longer. Images, etc. can have long expiry but it’s not so great on dynamic sites!
      • Have a look at the HTML5boilerplate .htaccess file for inspiration – and read up on “cache busting”.
    8. Enable HTTP keep-alive:
      • By keep the connection open for a few more seconds, you can lose the overhead of additional requests.
    9. Cache dynamic content:
      • WordPress is quite heavy and can have 15-16 database queries on a simple home page. If you can cache the output then serve a flat file, this can save time.
      • Rails and many PHP frameworks have similar concepts.
    10. Use a content delivery network:
    11. Beware of boilerplates:
      • Boilerplates can leave behind a lot of unnecessary resources (e.g. favicons) – and these might even be downloading your 404 page if they are not present!
      • Check to see that all the assets you reference actually exist…
    12. Test widely:
      • Try a few sites to help optimise your code (e.g. Google PageSpeed; Yahoo Yslow; WebPageTest.org).
      • Kier likes the detail with WebPageTest.org and it provides two views – one for a fresh request and another to see how effective caching is.
      • Beware that the sites might contradict each other.
      • Also use developer tools in browsers, like the Google Chrome Inspector – look at the network tab and see when resources are loaded from cache, etc. (examine the headers too).

    Once you’ve implemented a few tweaks, you might find that the last few percent to get to perfect are difficult – there are some things that you just can’t control. But, on a big website, incremental changes add up to big improvements – you might want a strategy to tray and work things out.

    My site scores 84/100 on Google PageSpeed so it looks like I have some work to do…

    Better photography by design

    I’ve been taking photos for nearly 35 years and I’m still rubbish at it. Well, maybe not rubbish but I maintain there’s two sides to photography: anyone can learn the technical stuff; but, to create great images, you need to have a creative eye…

    Al Power (@alpower) gave a great 5 minute talk on taking better pictures – not rocket science but some simple steps that everyone can take to get much better results.

    “So, what makes a good photo?” asked Al:

    • Is it camera gear?
      • Not really, you can probably push your existing one. It’s often said that the best camera is the one you have with you… whether that’s a smartphone or a DSLR.
    • Composition plays a big part and Al showed four examples:
      • A skater: moving from left to right, gives a sense of motion. Leave some negative space for the skater to move into. And their legs and arms form triangles.
      • A spiral staircase: the shape and lines of the staircase lead the viewer into the picture. Repeated shapes and patterns work well.
      • A jetty: lead-in lines capture attention and bring the viewer into the image.
      • A beach: using the rule of thirds to divide the image into nine segments, and to place things on grid lines/intersections.
    • Try a different perspective:
      • Take the same shot from different angles, maybe three or four times. High or low, zoomed in or out – see what works.
    • Use the light:
      • Light is probably the most important control for a picture.
      • You can take great pictures in any conditions – but direct sunshine is not always good: perhaps place a subject under a tree in direct shade and use even, reflected light; on cloudy days sky is huge lightbox; the time of day makes a difference too
    • Learn how to process your pictures:
      • With a DSLR – raw images are amazingly powerful.
      • Use Snapseed on iOS and Android.
      • On a PC or Mac, use iPhoto, Picassa, Lightroom or Aperture.
      • Attend a workshop, watch some of Adobe’s videos, or a find a good YouTube channel.
    • Practice and look for inspiration:
      • Henri Cartier-Bresson was quoted as “your first 10,000 photos are your worst”.
      • No-one was born an amazing photographer and we’re on a journey – “give yourself permission to suck”, says Al – and practice.
      • Work out what tricks are employed by those that inspire you – break them down and apply them to your own images.

    A web developers guide to Windows 8

    Martin Beeby kicked off with a self-deprecating video, for all of us Internet Exploder lovers:

    Then he moved on to tell us about modern.ie – a website to help developers design for Internet Explorer 10 and see if and where the might be problems, if they are using out of date libraries, or vendor prefixes that are no longer required. One example of the tips included is this code to ensure that a responsive site really is responsive, making sure that it displays properly when running on the side of a Windows 8 display:

    @-ms-viewport{width: device-width;}

    There’s also advice on creating icons that will look good on a Windows 8 desktop – and a 3 month subscription to BrowserStack for cross-browser testing.

    Moving past modern.ie, Martin explained that Windows 8 can run HTML and JavaScript apps locally – so web developers can be app developers too – and, of course, because this is Windows 8, we were encouraged to embrace touch…

    I only wish that the video Martin wrapped up his talk with was available on the web (I’m told it will be soon)… if I ever see it again, I’ll tweet the link…

    The value of conferences

    I had high hopes for this talk – I need to convince my new boss’ boss that there is value in conferences. And there is – but Craig Lockwood (@CraigInWales)’s talk started out by talking about the costs…

    • The costs to the organiser: a venue; speakers (fees and expenses); marketing (lanyards, programs, promo codes for discounts, etc.); insurance (weather, speaker sickness, etc.); judgement (you can’t please everyone – someone will be unhappy); refreshments; and time.
    • The costs to the speaker(s): time (to write a talk); judgement (what might others say they think of you?)
    • The costs to the attendee: ticket costs; travel; accommodation; and time

    So what does this mean? Why do we need conferences? After all, Craig exclaimed, plumbers don’t get together to discuss latest pipe techniques! Our techniques and even the canvas we work on changes too regularly to keep up so we share information. Freelancing can be a lonely job – so meetups are great to build relationships and share knowledge.

    Twitter, suggests Craig, has become the watercooler and conferences are the parties. Of course, some idiots still spoil things and some conferences find that they now need codes of conduct! So be respectful – it’s fine to disagree (respectfully) – but we should air our grievances personally and not publicly [Hmm… I once blogged about a pretty awful vendor event… think I might be guilty there].

    But think about this quote too, attributed to Ling Valentine (@LINGsCARS):

    “If nobody hates your website, chances are nobody loves it either.”

    “I have no idea what I’m doing”

    The final talk was from Simon Collison (@colly) and I just can’t do it justice in written form. Listen to the audio and then think about your own life and what you’re doing right now:

    This hit home for me: I’m just starting a new job; it’s going to be a challenge – but that’s exactly what I need. As for keeping up with blogs, tweets, magazines, books – I’m drowning. And don’t get me started on the systems I use at work (admittedly not quite as chaotic as the setup Simon describes at Fictive Kin…)

    So when does this happen again?

    The next MKGN is on 13 June and all 200 tickets “sold out” in just 2 hours (can a free event sell out?!). There’s a waitlist in operation and it’s definitely worth signing up if you’re in the area and you are interested in webby-creative-designer-digital-makery-slightly-geeky-stuff, washed down with a beer or two and followed by pizza! I’ve even met some people there in real life that I only knew on Twitter before…

  • Selectively removing cookies to resolve Office 365 authentication issues

    Every now and again, Office 365 decides that it doesn’t recognise my credentials and won’t let me log on. Well, not from a my normal web browser anyway. Everything works on my iDevices, my Windows Phone, even in a a protected browser session (e.g. Google Chrome’s incognito browsing), but not from my “normal” browser, with handy password management extension…

    Because it works in a protected browser session, I was pretty sure the problem is related to cookies but removing them all is a bit of a sledgehammer to crack a nut.  Instead, I delete individual cookies by going to chrome://settings/cookies and search for the microsoftonline.com cookies.  After removing these, I can log on successfully for a few weeks until the next time Office 365 decides it can’t authenticate me…

  • Unable to access Barclaycard-powered credit card websites? Try InPrivate browsing

    Late last night, I was trying to log on to the website for a credit card that I use, that’s branded as belonging to a hotel chain but actually provided by Barclaycard*.  After going through the usual security theatre to log on, the system kept telling me that it was unable to access my account:

    Unexpected error
    Sorry, an unexpected error has occurred and we can’t continue servicing your account online at this time.

    I’ve seen this before so I decided to try another browser, then another PC, then a Mac, then yet another PC – all to no avail.

    The fact that I tried so many machines (some of which I wouldn’t have used before to access the site) suggests that the problem is not to do with cookies but I eventually managed to access the site using Internet Explorer’s InPrivate browsing mode (Ctrl+Shift+P – some other browsers have similar functionality).

    So, if you’re having problems accessing a Barclaycard-powered site, InPrivate browsing might be the answer.

    Strangely, I tried again this morning, from one of the PCs that didn’t work last night and everything worked as it should… bizarre!

    *Barclaycard’s own cards appear to use a different system.

  • Useful to know: Google Chrome has its own task manager

    Earlier today, I was wondering why I was seeing a “missing plug-in” message in Google Chrome on a number of websites that I regularly view. I loaded the same websites in Internet Explorer and they worked OK, so something had obviously gone screwy inside Chrome. I could have guessed – it was Flash, although normally I get a yellow bar to tell me that has stopped working.

    I rebooted my PC yesterday, so I don’t plan to do that again for another couple of weeks (until the memory leak that one of my apps has gets so bad that I’m forced to…) but I googled missing plug-in google chrome to see what comes up. As it happens, Chrome has a task manager built in (press shift and escape).  After ending the Shockwave Flash process, I refreshed the offending page(s) and everything worked as it should.

    By then I was intrigued by the stats for nerds link which takes me to chrome://memory-redirect/ – an internal page that contains a breakdown of activity by process (including which tabs are managed by which processes) – which would have been handy to know about when Chrome had gobbled up a good chunk of my RAM earlier this week:

    [blackbirdpie url=”https://twitter.com/#!/markwilsonit/status/167195412262961152″]

    If anyone knows a similar memory management function for Internet Explorer, I’d be pleased to hear it as the relationship between tabs and processes seems to be a black art (and it may help to chase down problematic tabs) – I’ve tried Process Explorer and Windows Task Manager in the past, but it would be useful IE functionality…

  • Unable to send mail in Outlook Web App using Google Chrome

    For the last few days, I’ve been getting frustrated with my Office 365 Outlook Web App in Google Chrome. Microsoft has worked to ensure that the latest web apps work well in other popular  browsers but each time I replied to an email, the message would not send. The URL was displayed in the bottom of the window (as though a call to the server was being made) but then nothing – no saving to my Drafts folder either, just the ability to close the window and lose the work.

    I googled the problem and found a thread that gave me the answer:  it seems there is a conflict with the Click to call with Skype extension (I was using v5.6.0.8153 in Chrome v13.0.782.22). As soon as I disabled the extension (no need to uninstall), I was able to send mail from the Outlook Web App again.

  • Upcoming events (including special #uktechdays) event

    We’re having difficulties scheduling WSUG events right now. Without going into all the gory details, Microsoft’s funding for rooms, etc. is not available in the way that it has been in the past, so we need to find another way to do things…

    Now that the summer holidays are over, I’d like to organise a “virtual” user group meeting, over Live Meeting – and have had some conversations with Microsoft about a session on “Azure for IT Pros” (how can we integrate our on-premise infrastructure with Windows Azure, etc.). Please leave a comment if you think this will be of interest.

    In the meantime, I wanted to tell you about a Microsoft-hosted event that may be of interest, although it may also be a bit “developery” for some Windows Server admins.

    In any case, Steve Ballmer will be the guest speaker at a special UK TechDays “Future of Cloud Development” event in London’s Docklands on 5 October.

    The site has not gone live yet but you can registration on the event page or at 0870 166 6670, quoting event reference 9886 – you’ll also need the invitation code: 6D4723.

    More details of the session content can be found below:

    • A lap around Windows Phone 7 (Mike Ormond) – In this session Microsoft will take a look at Windows Phone 7 and the developer ecosystem, from the capabilities and unique features of the platform to the development frameworks and tools you have at your disposal. Along the way they’ll build a simple application or two and explore how people can purchase your finished masterpiece.
    • A lap around the Windows Azure Platform (Eric Nelson) – Hear how the Windows Azure Platform provides a scalable compute and storage environment with Windows Azure, secure connectivity with Service Bus and Access Control Service, and a relational database with SQL Azure. Learn about these new services and see demos that show how to build applications that run in and take advantage of Microsoft’s new cloud platform.
    • We’re Not on XP Any More – A Windows 7 Application in 60 Minutes. (Mike Taulty) – In this code-only session Microsoft will use Visual Studio 2010 and any .NET assembly that we can beg, borrow, steal or even build in order to put together a simple, modern Windows 7 application from scratch using the journey to provide pointers on how your applications can shine by using features that Windows XP only dreamt about ( when it wasn’t dreaming of electric sheep in its world limited by 2 processor cores, 4GB of RAM and GDI based graphics).
    • Keynote: New opportunities and compelling experiences – Microsoft’s Chief Executive Officer, Steve Ballmer, will talk about new opportunities to deliver seamless experiences across many screens and a cloud, and why now is such an exciting time for developers
    • IE9 The Best Browser for Windows (Martin Beeby) – In this session Microsoft will use IE9 and a sprinkling of JavaScript and HTML5 to show you how to create an integrated and immersive experience maximizing the full power of your visitors Windows 7 PC.

    [A version of this post also appears on the Windows Server User Group blog]

  • Yikes! My computer can tell websites where I live (thanks to Google)

    A few months ago there was a furor as angry Facebook users rallied against the social networking site’s approach to sharing our personal data.  Some people even closed their accounts but at least Facebook’s users choose the information that they post on the site.  OK, so I guess someone else may tag me in an image, but it’s basically up to me to decide whether I want something to be made available – and I can always use fake information if I choose to (I don’t – information like my date of birth, place of birth, and my Mother’s maiden name is all publicly available from government sources, so why bother to hide it?).

    Over the last couple of weeks though, I’ve been hearing about Google being able to geolocate a device based on information that their Streetview cars collected.  Not the Wi-Fi traffic that was collected “by mistake” but information collected about Wi-Fi networks in a given neighbourhood used to create a geolocation database.  Now, I don’t really mind that Google has a picture of my house on Streetview… although we were having building work done at the time, so the presence of a builder’s skip on my drive does drag down the impression of my area a little!  What I was shocked to find was that Firefox users can access this database to find out quite a lot about the location of my network (indeed, any browser that supports the Geolocation API can) – in my case it’s only accurate to within about 30-50 metres, but that’s pretty close! I didn’t give consent for Google to collect this – in effect they have been “wardriving” the streets of Britain (and elsewhere).  And if you’re thinking “thats OK, my Wi-Fi is locked down” well, so is mine – I use WPA2 and only allow certain MAC addresses to connect but the very existence of the Wi-Fi access point provides some basic information to clients.

    Whilst I’m not entirely happy that Google has collected this information, it’s been done now, and being able to geolocate myself could be handy – particularly as PCs generally don’t have GPS hardware and location-based services will become increasingly prevalent over the coming years.  In addition, Firefox asks for my consent before returning the information required for the database lookup (that’s a requirement of the W3C’s Geolocation API)  and it’s possible to turn geolocation off in Firefox (presumably it’s as simple in other browsers too).

    What’s a little worrying is that a malicious website can grab the MAC address of a user’s router, after which it’s just a simple API call to find out where the user is (as demonstrated at the recent Black Hat conference).  The privacy and security implications of this are quite alarming!

    One thing’s for sure: Internet privacy is an oxymoron.