Monthly Archives: April 2007

Tips for Composing Complete E-mails

Nice tips, via WWD:

  1. Don’t enter the email address into to or cc before composing the mail. There is a chance to hit ctrl+enter (send) any time. Leading to half composed mails being sent. Hence compose the mails first. Then add to and cc
  2. Attach the attachments first or you may forget to attach
  3. (more tips here)

You know, I couldn’t agree more. When I’m writing e-mails, I usually

IIS local SSL certificate install illustrated

One of the all-time most popular posts here continues to be “Testing with a local SSL certificate for free“, even though it is over a year old. To save you the click, here are those three simple steps again:

  1. Download and install the IIS Diagnostics Toolkit from Microsoft.
  2. Run the newly installed SSL Diagnostics program
  3. Right click on your local website and choose “Create new cert”. It will install a two-week locally signed certificate on your machine that is not technically valid, but will at least allow you to test SSL activity.

Create CertificateIt recently occurred to me that the UI for the free Microsoft tool is not straightforward: it is not immediately obvious where you can right-click. Here are some screenshots to show what step three above looks like. First of all, the image to the right is what the SSL Diagnostics screen looks like, and it shows where you should click to make the certificate (click to see full size). Once you’ve completed this step, you’ll see the screen update and show you information that looks much like the screen below.

Post-Create Certificate

When you visit your local server to see if it works, you may get some security errors. For example, these are the two messages that I get when I try to visit https://localhost/ using Firefox:

Certificate Error Security Error
Firefox Certificate Error Firefox Security Error

Website Technology Penetration

How many sites actually use frames nowadays? It turns out that there are people who track this very thing, such as the company Security Space who recently published their annual Technology Penetration Report. Since it is difficult to see the years side by side, I compiled their reports since 2004 into one matrix to see how things are changing, similar to how Alan Graham did last year. Yes, frames haven’t gone away yet. Sad.

Technology 2004 2005 2006 2007
JavaScript 55.87% 59.37% 58.08% 59.77%
Frames 23.49% 18.17% 15.91% 13.90%
StyleSheets 35.06% 39.93% 49.51% 54.00%
Java 2.58% 1.67% 1.64% 1.22%
IFrames 7.72% 12.12% 9.88% 10.76%
GIF Images 61.22% 58.54% 63.26% 62.65%
JPG Images 46.42% 47.25% 54.11% 55.06%
PNG Images 4.11% 6.42% 7.78% 9.68%
Flash/Shockwave 9.55% 8.77% 12.75% 12.77%

Web Tech Trends 2004-2007

IIS HTTP Error 400

Here is a little something that came up last week. It came about as we were trying to parse some Wikipedia-style links in a new way for Skweezer. The problem we were facing was that while many links inside of a Wikipedia page are okay, all of the links with colons were failing. The wiki software uses the colon character liberally, such as this: http://en.wikipedia.org/wiki/Wikipedia:Contents

It turns out that IIS does not like the colon character (“:”) in a URL. If you request an asset with the colon character embedded and the page is served by IIS, you may receive an error: “HTTP 400 Bad Request”. Colons are acceptable in one part of the URL: the host name, where they indicate a non-standard port like this: http://barnabas.wordpress.com:8080/. However, if a colon appears anywhere else in the URL, IIS will complain with HTTP error 400. Objectively this is good; IIS is defending itself against what it perceives as a hack attack. I do not know for sure, but I imagine that this particular colon check is defending against an old exploit from 1998. Read more »