Author: lekkim

Positive, competent, out-spoken, frank and customer focused architect and developer with a strong foundation in web, cloud and product development. I'm a strong advocate for API first and cloud based solutions and development. I have a knack for being able to communicate and present technically complicated matters in conference, customer and training settings. I've previously acted as team member and leader in a product organisation.

IBM announce dates for bringing TLS v. 1.2 to IBM Domino

So in October of 2014 I wrote about the upcoming TLS (transport layer security) enhancements that IBM was planning to bring to IBM Domino as part of the industry wide panic about the POODLE attack which I still consider mainly theoretical. I was a bit critical towards IBM as they chose to patch their seriously lacking SSL v. 1.3 implementation and implement TLS v. 1.0 on top of IBM Domino v. 9.0.x (IBM Domino, POODLE, SHA-1 and why it’s also sad when IBM decides to update the security stack). The reason I was critical was that I thought that you either take security serious and bring the stack to the front of the line (TLS v. 1.2, v. 1.3 in draft) or get out of the game.

Since then I have been pleasantly surprised to hear about the initiatives IBM has going on. At IBM ConnectED 2015 I attended a very nice session by David Kern from IBM and Daniel Nashed (IBM Business Partner) on the TLS and security improvements planned for IBM Domino. Among others was massive cipher suite updates incl. upcoming support for Diffie-Hellman and perfect-forward-secrecy. Cool stuff! Yesterday I was very pleased to see that IBM now has announced the support for TLS v. 1.2 coming in Q1/Q2 of 2015 (the technote is a bit confusing as to when it will be out).

So all appears to be good and IBM is moving in the right direction with this. Very nice.

Docker without sudo

Using Docker looks very promising but having to use sudo all the time is really a killer. Luckily there’s a way around it by adding users to the docker group and restarting the docker service.

  • Add the docker group if it doesn’t already exist: sudo groupadd docker
  • Add the connected user “${USER}” to the docker group. Change the user name to match your preferred user: sudo gpasswd -a ${USER} docker
  • Restart the Docker daemon: sudo service docker restart
  • If you are on Ubuntu 14.04 and up use docker.io instead: sudo service docker.io restart

How can I use docker without sudo?

Nice way to export from DB2 command line

Stumbled on this very nice easy way to export to a delimited file from the DB2 Command Line Prompt (CLI) today.

db2 “EXPORT TO <filename> OF DEL MODIFIED BY NOCHARDEL <select statement>”

i.e.

db2 “EXPORT TO result.csv OF DEL MODIFIED BY NOCHARDEL select * from empinst.employee”

Hiding widget on my own profile

Was looking through widgets-config.xml for IBM Connections v.5 to diagnose a customer issue and stumbled on the below widgetDef attribute. Now I haven’t tried it yet but it looks like you can use it to hide a certain widget on your own profile e.g. only show when viewing other peoples profile. Could be useful.

hideWidgetForMyProfile=”true”

Atlassian SourceTree Pro-Tip

I’m finding myself use Atlassian SourceTree more and more for my Git work as it’s both intuitive, fast and very pleasing to the eye. Yesterday at an Atlassian event (Getting Git Right) I noticed that the branches were nested in one of the demos. I wondered how they did that but it turns out to be very simple. If you (re)name a branch and use slashes (/) in the name then SourceTree will automatically nest them. Very nice and does make it easier to distinguish between feature, release, bugfix branches etc. The below video shows how you rename a branch in SourceTree using slash.

[youtube https://www.youtube.com/watch?v=3585UqpX1sY&w=420&h=315]

Loading widget data in IBM Connections 5 by the aggregator

One of the areas that changed fundamentally in IBM Connections 5 is how widget resources (JavaScript and CSS) is loaded by the browser. In prior versions the resources were loaded by the end-user browser through the AJAX proxy in IBM Connections Profiles or Communities depending on the feature in use. Starting with IBM Connections 5 the resources are aggregated and loaded by the Common feature that now also caches the resources. For end users this is great as speed and performance improves but for developers and admins it can be hard to diagnose what’s going on.

In Profiles it’s pretty easy – once you know how – to see what the aggregator is aggregating for the current user. The below video shows how to see this is Profiles. I’m still trying to fully understand it in Communities and will post the info once I have it.

[youtube https://www.youtube.com/watch?v=1GLpA604Iic&w=420&h=315]

An important tool results from the whole POODLE/SHA-2 debacle

My stance on the POODLE / SHA-2 issues with Domino is well known and I haven’t been holding anything back. And now – after a while – IBM is starting to release the promised tools to lay the foundation for SHA-2 signature support and TLS 1.0 support on IBM Domino. As part of my IBM Support Updates today I saw and entry called “Planned SHA-2 deliveries for IBM Domino 9.x“. This is a technote outlining how IBM is bringing TLS 1.0 and SHA-2 support. This is all well and good and great that IBM starts to deliver on its promises.

But that’s not all… And by far the most interesting thing to find in that technote.

Burried within this technote is a mention of a tool called kyrtool which replaces iKeyman as the way to work with the KYR keystore file used by IBM Domino. It’s a command line tool and allows for import of standard x509 certificates generated using OpenSSL or similar and produces a KYR and a STH (stash) file as the result. There is documentation about the tool in the wikis (Generating a keyring file with a self-signed SHA-2 cert using OpenSSL and kyrtool). As an added bonus the examples with OpenSSL is done on Dave Kerns paranoia Linux box (dskern@paranoia).

The release of this tool is very good news and cannot be overstated and in my eyes far overshines the support for TLS 1.0 and SHA-2 as it allows administrators to work with the KYR files on Windows versions newer than Windows XP. It ever supports win32, win64, linux32 and linux64. How do you like them apples?

Thank you IBM.