I’ve been following with interest various articles over the last week or so about “XML Pull API’s”http://www.xmlpull.org. The main advantages being much quicker processing and I’m guessing memory usage over DOM style apis. As well as a simpler API over Event driven APIs like SAX .

Now my XML Signature for Dom4J uses as the name sugest Dom4J. Which is great in that its easy to use and very powerful. This is great when you want to actually go in and do stuff to your xml.

Reading about the Pull methodologies advantages got me thinking, that it would be a good idea to create a Pull based XML Signature verifier. After all Verifications are in usage much more common than the actual signing process. Also most of the XML messages used by for example NeuClear are fairly simple and would probably lend themselves well to the simplicity of a Pull api.

So how would you do that exactly? My guess is the easiest way to do so would be to have a wrapper class implementing XMLPullParser.

Actually more likely two wrapper classes. One the Canonicalizer and one the Signature Verifier.

You would use it by passing it something like this:

XmlPullParser xpp = factory.newPullParser();
xpp.setInput(new FileReader ( args [i] ) );
XMLPullSignatureVerifier ver=new XMLPullSignatureVerifier(xpp);

while(ver.next()) {
	// Do stuff
}
if (ver.isValid(key))
	System.out.println("Signature is valid");
}

This looks relatively simple to me, but I’m not sure. Its not the highest priority for me at the moment though.

I like the idea of a blog as the main web site for an open source web site, so I have changed the main part of NeuClear to be a blog. This should hopefully make it easier and quicker for me to write documentation for the project.

On recommendations of my good friend Will, I downloaded the latest version of JavE which happens to be one of the coolest pieces of software outthere. It is a fully featured editor for doing ascii art and animations.

Its fully written in Java and is pretty responsive. The feature set is incredible. Think of Gimp for ascii art and you get my point. For examples of diagrams that I did in it have a look at my How does a NeuClear Transaction Work?

When I started work on NeuDist a year or so ago I picked the Apache license for the project. I replaced “Apache” with my own names etc of course. But I was never completely happy with the idea of using it for this kind of software. Now since I renamed it NeuClear I decided it would be a good time to think about changing the license.

Why? Mainly because I want to be as certain as possible that there arent backdoors in software based on NeuClear. I am a believer in absolute transparency in security and dont want to give banks/isps etc the opportunity to do funky stuff with your transactions.

The ultimate license to ensure openness is ofcourse the GPL which ensures that the source for any software using it must be published. I am a bit unclear on a few points here though. Maybe someone can help me out.

My guess is that many of the services running using NeuClear in the future will be inhouse developed services that are never distributed outside the companies providing the service. I can see that they would not be happy about publishing their internal source code publically (even though I think it would be a great idea).

As far as I can understand from the GPL FAQ as long as they dont distributed their software outside their organization they wouldnt have to distribute their source. This means that GPL might work just fine. I was planning on using the LGPL and may still do so if I hear to many naysayers about GPL.

The only other thing that I would like to see that I dont think any license has so far, is some extra clause in the GPL to require a periodical external audit of said inhouse services with the audit report made public. I think that would make a strong case for writing secure software and being accountable for it in the financial software world.

What do you get when you mix equal parts Dilbert, Flintstones and Kafka? You get my now ex-ISP inter.net whom I have more or less happily been using for over a year now since I first arrived in Panama.

I picked them originally because it looked like they had an innovative mix of services and their tech support staff were generally knowledgable and Linux savvy.

Now my 1 year contract finished a long time ago and I’ve been lazy to research if it was best to stay with them or move on with regards to my future broadband choice. It so happens that the service has been allright if a bit on a flaky side, so I searched around and decided that the best deal at the moment was directly with CableOnda Panama’s Cable TV provider and called customer service at Inter.net to cancel my subscription.

Flintstones

The customer service representative told me that they could process my cancellation but they would need a signed letter stating so. I’m normally against paper documents when dealing with internet companies, unless they make it as easy and painless as possible, so I asked them if they could send a form to my office for me to sign. I would send it right back with the messenger.

For non Panamanians you might ask why not use the mail? Well Panama is blessed with a very slow po box based mail service with no real street delivery and no mailboxes on every corner. In other words no one uses it for important stuff. Messengers are used by most companies for such things as contracts, bills, payments etc. The system works suprisingly well and I am actually very happy with it. For example Cable and Wireless will send a messenger with the bill and collect the payment at the same time.

Well inter.net couldnt do that kind of service. I would have to either show up in person or send my own messenger (I aint got one) to their offices in ritzy Punta Paitilla. Theoretically speaking I could do it, but why do I have to take 1-2 hours out of my schedule to close my account with them?

Dilbert

I decided that this sounded a bit more of a pointless excercise than I wanted it to be, so I asked her why she couldnt accept an email in stead? This is where it gets funny. She told me that to ensure the receipt of the letter they wouldnt accept an email as that was unreliable. The same was true for fax she said. I asked her the logical question… “So what youre telling me is that your email services arent reliable?” She couldnt really answer that.

I explained to her that if there was ever any doubt, that their technicians could quickly verify that the email was sent from my machine on the ip address they assigned me via DHCP to the MAC that they have registered for my network card to their very own mail servers. I further explained to her that I would comply with Panama’s (very good) Digital Signature act and digitally sign it with my pgp key thus making it a legally binding document according to the laws of Panama ( realising of course that I could have been talking Chinese as far as she was concerned).

KAFKA

The representative refused to give me her name or an email address and told me the only way the account would be closed would be to turn up in person.

This brings me to the part where I send my email from my home machine to just about all the publically available emails from the company as they wouldnt explicitly provide me the correct address, via their mail servers and duely digitally signed containing my cancellation notice in one paragraph. One paragraph explaining the situation and 5 paragraphs explaining how to verify that I sent the email in the first place.

Much, much later in the day. I can imagine after some serious “not my department” shoving around I received a message from Luis Vasquez their Controller. Who gave me a good burocratic brush off:

The company has their policies. Because of that we insist that any cancellation follows these as indicated by our representative. We do not process requests in this way. Please proceed with the proper cancellation.

Now considering that I have provided them with all the cancellation I legally need (Yes I did double check that with my lawyer). I know hes trying the old fashioned my balls are bigger than yours tactic. Unfortunately for him it doesnt work with me.

It still suprises me the (very few times) I have seen this kind of policies in innovative legitimate businesses. The theory is ofcourse if its difficult for the client to leave we will make more money. However this is very much only a short term tactic. Because your clients will leave and they will be unhappy. The tactic was perfected by Book clubs (have you ever tried to get out of one of those?) and brought into the new century by adult web sites. It really just leaves me with a bad taste in the mouth.

How does this harm Inter.net you might ask? Considering that I have been paying monthly in my supermarket and not via credit card they have absolutely no way of enforcing an illegal business practise. I am currently in the process of evaluating Panamanian hosting providers, guess whos off the list now. I do security and network consulting work at a management level at various large Panamanian companies. How can I possibly recommend an ISP who doesnt even trust their own services and try and stick it to their clients. They have several nice looking services for people like me who travel regularly. I had been considering to open such an account. Now I know that that would be inadvisable.

Allright enough rant. I did send a long letter to Mr. Vasquez and to the CEO of the Panama division. I would like to send it to David Browning the CEO of the US parent company, but they dont publish their email address on their site. David, reading your interview you seem like a sensible innovative guy who would dislike anything Dilbertesque as much as I do. Please get in touch if you see this.