Welcome – Lewis Walsh, Freelance software engineer from Essex, United Kingdom. Posting mainly about software development, system administration, electronics, and photography.

Everything I bought on Amazon in 2015

I signed up for Amazon Prime in early February. I'll definitely be renewing this February. This is not an endorsement of Amazon Prime, I just thought the list would be interesting. Here's my year in Amazon purchases.

Crucial 256gb SSD Nvidia GeForce GT720 graphics card Raspberry Pi camera module 3m VGA cable 3m DVI cable Flaxseed oil capsules Taschen 365 day-by-day New York Extra plush fitted mattress topper 10 x 80mm transfer files USB3 Multi-card reader 16kg Kettlebell Dremel glue gun 100 Velcro cable ties Microsoft Sulpt Comfort Mouse Quimox sync multi-charge USB cable Nikon AF-S DK Nikkor 35mm f/1.8G lens Raspberry Pi 2 Model B 1TB WD Red hard drive 49mm Cokin P series filter holder Spyderco Bug knife Car oil filter Silverline oil filter wrench Car air vent phone holder Amazon Fire Stick Cabin Porn book Manfrotto PIXI mini tripod Targus Defcon cable lock Bicycle combination lock DVB-T USB RTL-SDR receiver stick 35 miscellaneous cardboard boxes Draper de-soldering gun August VGB100 USB Video Capture Card Lihit Lab Tegga Pen Case - Book style in black 2 x Round hard storage cases for cables Stanley 20" Toolbox Dussel Warwick Backpack Yuanj Nuisance Call Blocker MicroUSB to RJ45 Ethenet Network Adapter 8gb Sandisk Ultra microSDHC card HDMI female to Mini HDMI Type C Male 2 x Micro USB male to USB A Female 10m telephone extension cable Hard travel case for WD My Passport Ultra Zheino 60gb SSD

Implementing Let's Encrypt

Updated Now that Let's Encrypt is in public beta I've updated this to suit.

These are exciting times for the web. Secure connections have been around for a long time and are now expected and trusted by the public. Unfortunately they're also very expensive, usually around $99 per year.

But huzzah and hooray, we now have Let's Encrypt, a service from the EFF, Mozilla, Cisco and others to provide FREE TLS encryption for any website. You can read more about the mission here: https://letsencrypt.org/about/

At the moment the service is in public beta which means they're still ironing out the bugs, but it's currently serving tens of thousands of certs and seems to be holding up fine.

For the purposes of this little walk-through I'm using Ubuntu 14.10 and Nginx.

One of the goals of Let's Encrypt is that it be automatic. In time this will include configuring the server too (be that Apache, Nginx, or another) and it already does a pretty good job but there's definitely more work to do.

I'm going to show how get just the cert files and configure Nginx manually. So to start with clone the Let's Encrypt software somewhere, I put it in my home directory:

git clone https://github.com/letsencrypt/letsencrypt

Ideally before the next step make sure you stop any service using port 80. There is a 'webroot' option to circumvent this and you can read more on the How it works page. But in my case I'm happy killing Nginx for a couple of minutes:

sudo service nginx stop

Now cd in to the new directory and run the software with the following parameters:

cd letsencrypt
./letsencrypt-auto certonly

The first time you run the program it will ask for an email address and ask that you agree with the T's and C's.

Lets Encrypt terms and conditions screen

Finally it will ask for your domain(s). Separate these either with a space or a comma.

That's it! If all goes well the necessary files will be created here: /etc/letsencrypt/live/<yourdomain>/

To add to Nginx, add or change your sites-available file to look like this:

server {
    listen 443 ssl;
    server_name lewiswalsh.com;
    ssl_certificate     /etc/letsencrypt/live/lewiswalsh.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/lewiswalsh.com/privkey.pem;

Next I created a server block to redirect https://www.lewiswalsh.com to https://lewiswalsh.com and one to redirect the insecure versions of those domains:

server {
    listen       443 ssl;
    server_name  www.lewiswalsh.com;
    return       301 https://lewiswalsh.com$request_uri;
}
server {
    listen       80;
    server_name  lewiswalsh.com www.lewiswalsh.com;
    return       301 https://lewiswalsh.com$request_uri;
}

Restart Nginx and all should be well.

sudo service nginx restart

Since Let's Encrypt certificates expire every ninety days you'll need to manually renew. Eventually this can be automated, but for now just run the following command again when your certs expire:

./letsencrypt-auto certonly

While you're at it, you may as well beef up the Diffie-Hellman cyphers to get that A-grade SSL.

Diffie-Hellman for TLS

After successfully enabling Let's Encrypt for my domain, I ran the test over at SSL Labs and was disappointed to see I only scored a C grade.

It seems that because my Nginx configuration supported SSLv3 it was susceptible to the POODLE attack. And thus regardless of anything else the grade was capped at C. This was easily fixed however by adding the following line to nginx.conf:

http {
    ...
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ...
}

I ran the test again but this time only scored a B grade. Here's why:

Warning! This site uses a commonly-shared 1024-bit Diffie-Hellman group, and might be in range of being broken by a nation-state. It might be a good idea to generate a unique, 2048-bit group for the site.

Luckily, the kind folks over at weakdh.org provide a Guide to Deploying Diffie-Hellman for TLS. To summarise, do the following:

First thing to do is generate a dhparams.pem. I put it in my /etc/nginx/sites-available directory, but it doesn't really matter where you put it as long as it's a fairly safe location:

openssl dhparam -out /etc/nginx/sites-available/dhparams.pem 2048

Now in the server block for your domain (by default this is in /etc/nginx/sites-available/default) add the following lines:

server {
    ...
    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
    ssl_prefer_server_ciphers on;
    ssl_dhparam /etc/nginx/sites-available/dhparams.pem;
    ...

Now reload Nginx:

sudo nginx -s reload

These simple steps have garnered me an A grade.

Testing Instagram embedding

A photo posted by Lewis Walsh (@lewiswalsh79) on Jul 9, 2015 at 12:32am PDT

The /now page movement

Derek Sivers, the former big cheese at CD Baby and a very interesting guy, has a /now page. Yesterday a slow movement started that has snowballed since. He's written a post about it.

The idea is a simple page on a personal website that shows what we're all up to at the moment. The page should really be written in the present tense. And by standardising the /now URI it makes it easy to find.

A lot of people seem to be using it as another about me page, or as another way to advertise their product or service. That's ok I suppose, but I don't think that's really in the spirit of it.

I love this idea. But I want to see what people are doing with all their time. I want to get a sense of the person's whole life right now.

Here's mine.

Update 30-10-2015 Derek has launched a site listing people with a /now page.