Oracle has made Java Enterprise Friendly!

I can securely manage multiple Java versions across an entire enterprise with minimal initial 'pain points.'

Finally!!

From Java 7 Update 10 forward, Oracle has instituted some intense security.  This has totally screwed with enterprise java deployments.  Many organizations have not bothered to update to Java 7 at all.  Which is a problem, because in April, 2013, Oracle stopped issuing updates for version 6, leaving open vulnerabilities to be exploited.

Oracle introduced the Security Baseline JRE version.  Before running any app, java will attempt to verify that the version of java on the computer is at or above the baseline version.  If it is not, security dialogs will pop up and the app may be blocked!

From Java 7 Update 10 forward, every version has a hard-coded expiration date.  When that date passes and Java has not been updated, Pop-ups attack!!

The default security level is “High”:

·         Very High - Only apps signed with a valid certificate are allowed to run. Everything is prompted to approve.  If java is outdated, you can’t run any app.

·         High - Signed apps can be run, self-signed can be run in the sandbox as long as the JRE is up to date.  Unsigned are allowed in the sandbox with multiple verification prompts.

·         Medium - Allows running of apps even if JRE is out of date, but has prompts to inform and verify.

Oracle has finally given some relief to Enterprises as of Java 7 Update 40 - and I just found out about it!

“A new feature in Java 7 Update 40 is aimed at ameliorating this predicament. It's a change to the local security policy that allows large customers to specify a limited number of apps that will run on older versions of Java. Now known as a deployment rule set, the new instructions use a digitally signed certificate to whitelist specific apps, often referred to as JARs or java archive files. Those not on the list will be dropped, or possibly run on the latest Java version.”

To take advantage of the Deployment Rule Set, We need to know every website or java applet that we need to Whitelist for our end users in order to create the ruleset.xml, a Java Developer’s Kit installed, a Code Signing Certificate and to distribute the “DeploymentRuleSet.Jar” file to all endpoints. 

The initial pain comes from doing a blanket block of all unknown java applets and vetting the ones that users call in to request access to.  Of course, you want to find out as many of the internal URLs that run java apps and as many of the business-need URLs that users have to have as possible, but you will miss some.  Users will call in, the .xml will have to be updated and the .jar will have to be rebuilt and re-sent.

 

Within the ruleset.xml, we can whitelist a java applet to run without prompts (unless the certificate has been revoked), block it or just use the default settings.  We can also set which version of the JRE to use, so we can identify apps that require older versions and set those to use those versions.  This means that we do not need to uninstall older versions – we can force any unlisted app to use JRE 7 or simply be blocked, while sending only those applications that require older versions to their specific version.

I find this very exciting!

Online Documentation Resources:

http://docs.oracle.com/javase/7/docs/technotes/guides/jweb/jcp.html#security

http://docs.oracle.com/javase/7/docs/technotes/guides/jweb/client-security.html

https://blogs.oracle.com/java-platform-group/entry/introducing_deployment_rule_sets

http://docs.oracle.com/javase/tutorial/security/overview/

http://docs.oracle.com/javase/tutorial/security/

http://docs.oracle.com/javase/7/docs/technotes/guides/security/

http://docs.oracle.com/javase/7/docs/technotes/guides/jweb/deployment_rules.html

You can't have Obamacare

This is another futile effort to make people less stupid.

"Obamacare" is a set of Policies, Requirements and Regulations affecting the Health Insurance industry.  It is impossible to enroll in Obamacare.  It is impossible to not be affected by Obamacare.  It is impossible to "Opt Out" of Obamacare - you can't "Opt In" either.

You can't "have Obamacare."

You can have Health Insurance as provided by a variety of Private Insurance companies - as you always have.  Those insurance companies now have to adhere to a new set of regulations that do a better job of protecting YOUR interests.

1. You can't be dropped from coverage when you get sick 
2. You can't be dropped from coverage if you made an honest mistake on your application. 
3. You also can't be denied coverage or treatment for being sick
4. You can't be charged more for getting sick. 
5. You can't be charged more for just being a woman.
6. Most insurers must spend at least 80 percent (85 percent for insurers covering large employers) of the premiums you pay on medical care and quality improvements. If insurers spend too much on overhead, such as salaries, bonuses, or administrative costs, as opposed to health care, they must issue premium rebates to you each summer.

There are pros and cons as with any policy adjustment.

Most of the conversations I hear about Obamacare are full of misinformation and outright lies.

You can use a Health Insurance Exchange that was set up by the policies of The Patient Protection and Affordable Care Act - also known as "Obamacare" or the ACA.  If you don't have insurance provided by your employer or you are not happy with that insurance, you can go to a State HIE or the Federal HIE if your state is too stupid to have one set up (like Mississippi, even though we spent the money to set one up, the Guv blocked it being implemented).  This allows you to shop around for all the Private Insurance offered through the exchange.  It is like if you were employed by a mega corporation who offered various insurance plans through various insurance companies.  The effect this has is to lower overall insurance premiums by spreading the risk pool - just like what large companies offer.  The reason single or single family plans are so expensive is that there is no risk pool, its just that one, small group. 

You can opt to not get health insurance and be charged a tax penalty instead of get health insurance for yourself.  Not the most shining example of "Personal Responsibility," but you could choose to do that.

Sharing the Sacrifice Act

Sharing the Sacrifice Act

To repeal the provision of law that provides automatic pay adjustments for Members of Congress, tie congressional compensation to Median Income and make adjustments for smaller government.

Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled,

SECTION 1. ELIMINATION OF AUTOMATIC PAY ADJUSTMENTS FOR MEMBERS OF CONGRESS.

(a)          In General- Paragraph (2) of section 601(a) of the Legislative Reorganization Act of 1946 (2 U.S.C. 31) is repealed.

(b)          Technical and Conforming Amendments- Section 601(a)(1) of such Act is amended—

(1)          by striking `(a)(1)' and inserting `(a)';

(2)          by redesignating subparagraphs (A), (B), and (C) as paragraphs (1), (2), and (3), respectively; and

(3)          by striking `as adjusted by paragraph (2) of this subsection' and inserting `adjusted as provided by law'.

(c)           Effective Date – This section shall take effect 30 days after the Act is signed into law.

SECTION 2. TYING COMPENSATION TO MEDIAN INCOME.

(a)                   Median Income shall be as calculated by the Congressional Budget Office on a yearly basis.

(b)                   The compensation for all members of Congress shall be tied to the Median Personal Income of the state they represent.

(c)                   Compensation shall be set at 2.5 times the Median Personal Income of the state.

(d)                   Compensation shall be limited to 3 times the National Median Household Income.

(e)                   Effective Date – This Section shall take effect the next fiscal year after the Act is signed into law.

SECTION 3. STAFFING AND STAFF SALARY ADJUSTMENTS.

(a)                   Staff shall be limited to 9 staff members per Representative in the House.

(b)                   Compensation for each staff member of a Representative shall be limited to 1.5 times the Median Personal Income of the state of the Representative.

(c)                   Compensation for each staff member of a Senator shall be limited to 1.5 times the Median Personal Income of the state of the Senator.

(d)                   Total Compensation for a Senator’s staff shall not exceed 15 times the Median Personal Income of the state of the Senator.

(e)                   Effective Date – This Section shall take effect the next fiscal year after the Act is signed into law.

SECTION 4. LEADERSHIP SALARY ADJUSTMENTS.

(a)          Majority and Minority Leaders in the House will be paid 1.15 times the Median salary of all other Representatives – leaving out the other Majority or Minority Leader and the Speaker of the House.

(b)          Majority and Minority Leaders in the Senate will be paid 1.15 times the Median salary of all other Senators – leaving out the other Majority or Minority Leader.

(c)           The Speaker of the House will be paid 1.25 times the Median salary of all other Representatives – leaving out the salaries of Majority and Minority Leaders.

(d)          Effective Date – This Section shall take effect the next fiscal year after the Act is signed into law.

Built us a Shed

Willice decided that we need a deep freezer.  We don't have any room in the house, so I decided that the best option was to get a Shed Kit and built it on the concrete parking pad beside the house - that we never use to park on.
We ordered the Majestic shed kit from Home Depot.  I went a got some more 2x4s after it came in to reenforce the floor a little bit.  The kit arrived on a flatbed truck and I tore into it immediately.

I got the foundation set up and leveled, with some help from George.  I quickly decided that it was better to work in the shade.  I used the canopy that I bought for taking to Thunder Ridge Motorcycle Rally.

Sweet relief from the blazing sun!!

The foundation plan called for 2' centers.  I added a few 2x4s and came up with something a bit off... but stronger.  The ones in the picture above are not screwed in, just laid out. 

Leveling was a bit interesting.

The plan called for having one 2x4 on this joint.  I bought the steel plate and make it two 2x4s for a stronger foundation.  There were two such joints, one on each side.  The shed is 12' long and they used 1 8' 2x4 and a 4' 2x4 to make the span instead of one 12' - because it all had to fit nicely onto the pallet.

The Floor coming together.  The shed kit didn't include the flooring, just the floor frame, so I went for a very sturdy floor!

Sawing, screwing, hammering, cutting, sweeping.  It gets exhausting.

Floor is done and the walls are coming together!  Well, I'm building the walls.  George is helping after the first wall.  Really need two people to lift if without breaking something.  The lumber is 2x3 and warped.  The walls also have the joint like the floor did, but I couldn't find a good way to make it sturdier.  I don't think I'd find a good 12' 2x3.

One wall flipped over and one wall laid out.

George checking out our progress.

I'm tired and those walls are flimsy.

The loft frame helps me feel better about the walls not falling outward.

All four walls are up and the roof is on.  With warped wood, Square is just a theory.

For all the warping, the only problem area on the roof is quite small.

I haven't been able to get the shingles yet, so the roof is tarp'd.  We are wanting to match the new shingles on the house and those are from Lowes, so we have to get the money and then go all the way across the county to pick them up.

The windows and the wrap-around shelf.

The Work-bench has already proven useful.

I have wired up two power outlets, two switch-controlled power outlets to run the lights and a switch for the soon-to-be mounted outside motion detection flood light.  Now I have to get an electrician to hook up the power.  Well, make sure that I haven't gotten something messed up, then connect the power.

Windows 8 Network Connection

So, I just updated my workstation to Windows 8.  We have a SAN - well, it was a SAN now its a NAS, but we still use the old name to get to everything since that was easier than changing every shortcut that went to it.

Anyway!  I could not get to our SAN - or very many network computers - after I finished my update.

The Solution - which I could not find and hopefully you have - is setting a registry value and adding a DWord value.  As below:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters]
"ServiceDllUnloadOnStop"=dword:00000001
"RequireSecuritySignature"=dword:00000000
"EnableSecuritySignature"=dword:00000001
"EnablePlainTextPassword"=dword:00000000
"OtherDomains"=hex(7):37,00,00,00
"RequireSecureNegotiate"=dword:00000000

Edit the Other Domains value to be 7
Add "RequireSecureNegotiate" and it should default to 0 (zero).

That fixes it all.

While we are on the subject of Windows 8 - some have complained that they can't run File Explorer as an admin.  Here is the fix for that :

Create new shortcut on the desktop...  right click in an open area and  select "new" and select "shortcut."

For the location, type "explorer.exe" and click "Next."

Type a name in - like "File Explorer (Admin)" and click "Finish."

Right click on the new shortcut and select "properties."  Click "Advanced."

Put a check mark in "run as administrator" and click "OK" until you are back at the desktop.

Presto! You can now browse as an admin!

Riding the Natchez Trace - The Plan

Sometime soon, I plan to ride the entire Natchez Trace and back.  The trip will take three days.

Well, one evening to get down to Natchez and camp, one day to get to the end of the Trace and backtrack to camp and one day to ride home via the Trace.



View Natchez Trace Ride in a larger map
This will be a good test for my packing skills and camping endurance for The Oregon Trail ride in 2014.

The trip will be 125 miles on the first evening to get to the campground in Vidalia, LA, then 494 miles on the Trace itself for day 2, which includes 50 miles of backtracking to get to the Fall Hollow campsite for the night.  That should make for 8 to 9 hours of riding time, plus stops for gas and food along the way.  The last day will be an easy 320 something miles home - via my grandmother's house for a quick visit.

There is an article in Rider Magazine about a similar trip - only they stopped in Tupelo for the night.
I look forward to taking some photos and posting the trip blog!

Anyone want to join me?