Migrating to HTTPS

Posted on June 5, 2016 by Matthias

There’s more to migrating a complex site to HTTPS than just enabling TLS in your web server or reverse proxy. All links to embedded resources like style sheets, images, or scripts need to be served via HTTPS and potentially have to be rewritten. In a well-designed site that’s not an issue, but in most peoples’ organically grown setups it can be a huge effort.

Continue reading →

Posted in misc | Tagged , , | Leave a comment

Let’s Encrypt on WordPress.com

Posted on April 10, 2016 by Matthias

A couple of days ago, WordPress.com announced that they are now supporting TLS for custom domains (which is how this blog is hosted). There are many reasons for not hosting a blog yourself even if you have the necessary skills, like not having to deal with security updates and scalability issues for starters. Flexibility isn’t one of them, unfortunately, so I’m very pleased TLS has finally arrived. But let’s have a look at their setup.

Continue reading →

Posted in meta | Tagged , , | 1 Comment

Resolving JARs

Posted on March 20, 2016 by Matthias

Sometimes it’s useful to check whether a local JAR file is available from Maven Central, for example when converting an old build system to Maven. In many old systems, JARs aren’t named consistently and versioning info isn’t available. Fortunately, Maven Central has a search interface that supports lookup by a JAR file’s SHA-1 checksum. And even better, there is a REST API to automate things.

Continue reading →

Posted in java, Uncategorized | Tagged | Leave a comment

Let’s Use TLS

Posted on January 17, 2016 by Matthias

I have followed the HTTP/2 specification process closely and I like how the new protocol improves web performance and makes old workarounds obsolete. One drawback of deploying HTTP/2 is that most browser vendors only implement it on top of TLS. Since I’ve seen a lot of broken TLS configurations lately, I thought it would be interesting to set up TLS on my private server and share the resources I used in the process.

Continue reading →

Posted in best practices, Uncategorized | Tagged , , , | Leave a comment

Frontend Engineering

Posted on November 29, 2015 by Matthias

Despite all its shortcomings as a programming language, JavaScript isn’t a dirty word anymore. A decade ago, most self-respecting developers would refuse to even touch it, so it was left to web designers and junior developers who spiced up a few HTML pages with dispensable functionality. It’s amazing how the advent of AJAX changed things.

Continue reading →

Posted in misc | Tagged , , | 1 Comment

Normalizing Text in Java

Posted on October 10, 2015 by Matthias

Once in a while I see misguided attempts at normalizing text to make it suitable for use in URLs, file names, or other situations where a plain ASCII representation is desired. This can be tricky but with Java’s excellent Unicode support and some background knowledge it is pretty easy to implement. At least if your input uses the Latin alphabet – otherwise you’re out of luck.

Continue reading →

Posted in java | Tagged , | 2 Comments

Web Service Security

Posted on August 30, 2015 by Matthias

As a developer, I’ve used lots of web services and also implemented plenty myself. I’ve seen services with IP-based security provided by network firewalls, services protected by standard HTTP Authentication, TLS with client and server certificates and custom mechanisms using API keys. Recently, OAuth 2.0 has been added to the mix. Time for a little tour with links to the most important resources.

Continue reading →

Posted in misc | Tagged , | Leave a comment

Preventing Cascading Failure

Posted on June 28, 2015 by Matthias

With the advent of reactive programming and frameworks like Netflix’ Hystrix, classic stability patterns like Nygard’s Circuit Breaker Pattern have entered mainstream software development. The circuit breaker is used inside your clients to cut the connection to a collaborating system (the server) once you notice the server doesn’t answer in a timely manner. This helps to prevent cascading failures – if your system is under high load, you open the circuit in the client to not launch a self-inflicted denial of service attack against your server.

Continue reading →

Posted in best practices | Tagged , , , | Leave a comment