Archive

Archive for January, 2010

10 Red Balloons (got me thinking)

January 30th, 2010 1 comment

I stumbled across this article about a clever challenge involving 10 red balloons. I read about it after following a link on a design studio’s Twitter posting. DARPA (Defense Advanced Research Projects Agency of the US government and creators of the internet back in the cold war days of the 1960s… read Bruce Sterling’s “A Short History of the Internet” written in 1993 if you have never heard of DARPA) took the 40th anniversary of the creation of the internet to pose the question: “Can any real world problems be solved by using the internet?” They came up with the DARPA Network Challenge.

So basically DARPA hid 10 red weather balloons all over the continental United States, and the challenge was to find them all, submit their latitude and longitude, and to find them first. Of course a team from MIT won the competition. How long did it take to find them? A month? A week? Just 8 hours and 52 minutes. How did they do this? By using social media and social networks of course.

Officially the DARPA Network Challenge states:

The DARPA Network Challenge is a competition that will explore the roles the Internet and social networking play in the timely communication, wide-area team building, trust and urgent mobilization required to solve broad-scope, time-critical problems.

So that’s all well and good, fun and interesting and such. But the thing that got me thinking, the thing touched on in the marketing website article was not the discovery of the (in advertising lingo) “big idea” a.k.a. the red balloons. But rather it was the MIT team’s process and approach to solving the problem that is the new “big idea.” The process invented by MIT’s team to rapidly assemble and task it’s newly formed “red balloon team” community worked, and it easily slipped into the operational ethos of bloggers, Facebook users and Twitter users (of course, having decided to donate the $40,000 cash prize to a charity probably helped too). The success of that process demonstrates to me (and DARPA who will interview the MIT team and it’s “community” of participants) the real value of social networks and the internet.

What the marketing website article is trying to say is that ad agencies used to be doing nothing but looking for the next “big idea” and then pitching it to their clients. But along came the internet and changed all that. There are plenty of these big ideas to go around, and depending on how immersed you are in all this social media/networking stuff, more and more of them are starting to come from end-users or consumers. Take the Swiffer for example, it was an idea suggested by a consumer responding to an initiative called “Connect and Develop” from Proctor and Gamble to gather feedback and ideas from their customers.

Crowd sourcing: No one is as smart as everyone.

This is one of the ideas that forms the center of the disruptive technology called the internet. We experience successive waves of change that are emanating from the fact that virtually anyone can publish their thoughts, ideas, images, and video for the rest of the world to find. And sometimes conditions conspire to allow a simple idea or thought to permeate the minds and hearts of millions of people in a near instant. Such things are often called internet memes.

The first wave that hits you is email. Everyone starts here and sees the value of being able to send and receive email. Even my parents have been hit by the power of this medium of communication. The next wave I think that hit was port 80 traffic: http protocols for websites and web pages. Then e-commerce as a wave of online shopping, followed by an MP3 wave (napster at first, iTunes music store now), and most recently by a youtube.com or video wave.

In each of these waves, traditional media entities have been deeply disrupted by the free flowing of ideas and assets. Email killed the telegram (Western Union decommissioned the service in 2006 after over 150 years of use) and is digging into postal service revenues since day one. The websites and webpages have largely up-ended magazines and newspapers so that printed editions are now becoming increasingly scarce. MP3s have both salvaged and savaged the recording industry. And in January 2009 YouTube.com recorded over 100,000,000 viewings per day.

So all of this will continue happening, the waves of disruption (disruptive to traditional thinking and doing at least) will keep on coming. Publishing will become easier, in all sorts of media. Access will be expanded to include more and more people. And our part in all of it, at least in my view, is to remember to try to step back and think about the process of change that is going on. The new ways we can solve problems using this incredible web of technologies and people addicted to them. That will remain a valuable skill and insight to achieve and maintain. Learning how to program perl is great, or some other language. But eventually perl won’t matter that much. We won’t need to pay so much attention to the underlying technologies of the internet because they will (rightly) recede into the background. What will remain will be pure freedom of communication and expression I imagine. And the possibilities at that point will be blinding. So don’t fret about the big red balloons, just try to keep being a curious, problem-solving clever monkey and you’ll always have interesting work to do.

CA will not start… What do you mean, cannot download CRL…

January 20th, 2010 3 comments

As part of my work I was installing a Microsoft PKi infrastructure with two tiers. A root CA and an issuing CA.

Since the root CA is in another domain then the issuing CA, it took some fiddling and tweaking around with my CDP and AIA extensions, but that is another blogpost all together.

I knew I was in for some fun when when the following happened:

  • I installed my Issuing CA and generated the certificate request
  • I issued the request to my Root CA and generated the Issuing CA certificate
  • I tried to install the Issuing CA certificate and got the following error:
Cannot verify certificate chain. Do you whish to ignore the error and continue? The revocation function was unable to check revocation because the revocation server was offline. 0x80092013 (-2168885613)

Cannot verify certificate chain. Do you whish to ignore the error and continue? The revocation function was unable to check revocation because the revocation server was offline. 0x80092013 (-2168885613)

My first reaction was to call one of the network guest and notify him that I needed http access to the Issuing CA to the CDP location. But whil on the phone, I decided to try and to my surprise I was actually able to manually pull down the crl.

Intregued, I decided to check a few things:

  • I could download the CRL from both CDP locations with Internet Exporer
  • I could open the downloaded CRLs
  • I could telnet to port 80 of the both webservers
  • I could telnet to port 80 manually issue the GET /crl/CRLname.crl HTTP/1.0 command and get data back

O.K. what is going on here… Lets open PKI view, which is now included in Windows 2008 and Vista and can be downloaded for Windows 2000 and 2003.

It seemed that PKI view as in agreement, it too could not download the CRL from the CDP location

PKI view shows "Unable To Download" for both CDP locations

PKI view shows "Unable To Download" for both CDP locations

This did sent me on a wild goose chase:

But, as stated, I would use certutil to get the “best” answer on how is my configuration.
Certutil -verify -urlfetch “certfile.cer” will check *every* CDP and AIA URL (including OCSP) and tell you how they are all doing *at that specific instance in time” since it goes to the URLs immediately.
Brian

I exported the Issuing CA certificate from the certificate database of the Root CA and ran the command against is and this is what I found

E:\>certutil -verify -urlfetch <certfile>.cer
Issuer:
CN=Root CA
Subject:
CN=Issuing CA
Cert Serial Number: 115d5f6400020000000b
<snip>

—————-  Certificate AIA  —————-
Verified “Certificate (0)” Time: 0
[0.0] http://IIS1.domain1local/crl/Root-CA.crt

Verified “Certificate (0)” Time: 0
[1.0] http://IIS2.domain1.local/crl/Root-CA.crt

—————-  Certificate CDP  —————-
Wrong Issuer “Base CRL (13)” Time: 0
[0.0] http://IIS1.domain1.local/crl/Root-CA.crl

Wrong Issuer “Base CRL (13)” Time: 0
[1.0] http://IIS2.domain1.local/crl/Root-CA.crl

<snip>
E:\>

So while PKI view and the other error messages I was getting all pointed to the most common cause, it actually turned out that the CRl did get downloaded, but was not cryptographically relevant to what the system believes is the Root CA certificate.

Root cause

Inspection of the CRLs generated and the Root certificates installed showed what had caused the problem. In order to test the CDP extensions I had reissued the Root CA certificate, causing the Root CA to have three active certificates. Each with a different key.

This CA has three CA certificates

This CA has three CA certificates

When validating the Issuing CA certificate, validation would end at the last certificate issued, however the CA still signs its CRLs with the key pair of the first certificate.

I guess for me there is nothing left but to reinstall the entire chain.