Things you need for SSL (EV) Extended Validation Certificates - godaddy

First, make sure you have the FINAL host name that you are securing. www.somehost.com and somehost.com are equivalent, but www2.somehost.com and somehost.com are NOT. For an EV cert you will need to do this once for every host you wish to get a cert for. For this reason you cannot get a wildcard EV cert.

If your business entity has a data trail (think info-usa type stuff) then you are probably golden. Otherwise you need:

A Requestor (probably you)
A Request Approver (someone at the company that can be verified)
An Approver (someone at the compnay that can be verified)

They can all be the same person and many times will be.

The CA will need your business registration #, city, and state. (your HQ address might be different than this, they need the info where you registered)

If the CA cannot find enough information in public records to validate your contacts, you will need to have their accountant (CPA) send a letter stating they represent the company and its contact info (mailing and telephone) along with contact info for the person who will be your Request Approver/Approver. Make sure all the addresses match up. This letter could also come from legal counsel who is registered with the state Bar association of the state your company is incorporated in.

In general if you make a typo in anything but the certificate request info, the CA can correct it after you initially request.

Coldfusion 9 not sending connection string to MySQL 4/5 datasource. (zeroDateTimeBehavior)

I was unable to get Coldfusion 9 server to take the usual fix for the following:

java.sql.SQLException: Cannot convert value '0000-00-00 00:00:00' from column 20
to TIMESTAMP.

which is to put:

zeroDateTimeBehavior=convertToNull

in the data source connection options. This method fixed the problem in all previous versions of ColdFusion.

My workaround was to add a 'Custom' data source and add all the normal JDBC variables and add the zertoDateTimeBehavior option to the actual URL instead of letting ColdFusion 9 try to do it.

Is your pharmacy taking you (and your insurance) for a ride?

Well, I decided to try auto-fills on my prescriptions from Walgreens and it works great, perhaps a little too great. It's so nice not to have to remember to order, and then pick-up scripts (or order, then forget, then need at 12am and have to drive to a 24hour location). However you should be aware of your insurance policies on filling prescriptions.

If your coverage company is like mine, they allow refills at around 21-days. This is fine when you aren't on auto-fill because everybody needs a little wiggle room on the timing. On auto-fill however, every single time your prescription CAN be ordered, it WILL be ordered. So instead of 12 months in the year, you now have 17 eligible refills available. With travel time maybe 1 less. By the time you are 1/2 way through the year, you will always have next months supply on the shelf before you start taking this month's supply. This may be great as far as being able to forget going to the pharmacy, but not sure about your pocketbook with the co-pays, and I'm sure your insurance will love it as well.

A Walgreens rep told me they fill entirely on the insurance providers policy, but I don't think the insurers have. I would have written them a note, but you can only send them 256 characters at a time through their online contact form. Basically she said "I'ts not our fault, there's nothing we can do". I did add that maybe she could suggest the customer being able to alter the interval to 30 days.

So, does your pharmacy do the same thing? It should be that after the second auto-fill (you need 1 or 2 early if you are right on the nose when you set it up to allow for holidays, sundays, and soon to be non-delivery saturdays), the interval that they are ordered reverts to 30 days, since once you are on track you shouldn't need that extra wiggle room anyway.

Nikto, a web vulnerability scanner

Nikto! of Klaatu barada nikto fame.

Rails can't find active_support or other already installed gems?

Recently a development server I use became inoperable with strange messages about missing gems that I knew where installed. It turns out I had accidentally installed them as my local user under my .gem directory and then removed the gems when I realized my mistake. Unfortunately, I didn't delete everything that had been installed under ~/.gem, notably the spec files for the said gems and other cruft.

It seems that Rails (2.3.5) checks the spec files at startup and will not probe the system gems if it encounters a spec file for one in your local directory, even if it fails to load the referenced gem. So make sure you delete ALL the files related to your gem in your local directory if you make the same mistake.

per request rails authenticity_tokens

An example of how to present a different rails authentication_token per request. This doesn't conveniently cache keys, or tackle the problem of storage and expiration of the tokens yet but shows how you can embed information that might allow you to do that. Used a public key encryption scheme, but probably should really be symmetric to ease the load on the server.

Copy & paste to see me!

module ActionController #:nodoc:
  module RequestForgeryProtection
    # This module overrides the default rails authenticity_token behavior by using 
    # the normal rails token as a secret that only lives in the current user's 
    # session. The new token is an encrypted hash containing that secret and a
    # timestamp that could be used to timeout the code.
    class << self
      attr_accessor :key_secret
    end

    protected

      # Returns true or false if a request is verified.  Checks:
      #
      # * is the format restricted?  By default, only HTML requests are checked.
      # * is it a GET request?  Gets should be safe and idempotent
      # * Does the form_authenticity_token match the given token value from the params?
      def verified_request?
        !protect_against_forgery?     ||
          request.method == :get      ||
          request.xhr?                ||
          !verifiable_request_format? ||
          check_private_data(params[request_forgery_protection_token])
#          form_authenticity_token == params[request_forgery_protection_token]
      end

      def check_private_data(input)
        ret = true
        logger.debug("sec-: " + ActionController::RequestForgeryProtection.key_secret)
        # set key in environment.rb with ActionController::RequestForgeryProtection.key_secret = 'key'
        p_key = OpenSSL::PKey::RSA.new(File.read(RAILS_ROOT + '/config/webprivate.pem'), ActionController::RequestForgeryProtection.key_secret)
        yml = p_key.private_decrypt(Base64.decode64(input))
        logger.debug("YAML TOKEN: " + yml)
        hsh = YAML::load(yml)
        if not hsh[:rnd] == session[:_csrf_token]
          ret = false
        else
          #check some other things like token store and time for expirations
        end
        ret
      end

      # Sets the token value for the current session.  Pass a :secret option
      # in +protect_from_forgery+ to add a custom salt to the hash.
      def form_authenticity_token
        session[:_csrf_token] ||= ActiveSupport::SecureRandom.base64(32)
        hsh = {}
        hsh[:time] = Time.now
        hsh[:rnd] = session[:_csrf_token]
        p_key = OpenSSL::PKey::RSA.new(File.read(RAILS_ROOT + '/config/webpublic.pem'))
        yml = hsh.to_yaml
        logger.debug("YAML Token: " + yml)
        crypted = p_key.public_encrypt(yml)
        token = Base64.encode64(crypted)
        #puts token
        token
      end

  end
end

Scilicet

Scilicet

Its one of these things in a legal document notating what state and county it is in effect for.


and you can make one with:

\[\left.\begin{tabular}{l}State of California\\\\County of Orange\\\end{tabular}\right\}ss.\]

in LaTeX, if you cared.

Yep, it's a slow day.