Essential Freeware Applications For Your Desktop

Within the last couple of weeks, I've bought a new PC and re-imaged a laptop - both with variants of the Windows 7 operating system. There is something comforting about a clean system - it's a chance to install only the applications that you absolutely need and also a chance to ensure that you have the most up-to-date versions of those applications.

So here is my list of essential applications (for Windows) that everyone should install - at least everyone who performs the kind of tasks that I do!

Communications

Firefox is an absolute must have but there's no point in having Firefox without the add-ons. For me, that means Live HTTP Headers, Favicon Picker and Web Developer add-ons get installed straight-away.

Thunderbird is my eMail client of choice but again this is due to the add-ons. Lightning, Provider for Google Calendar, Google Contacts and an ability to manually sort folders are all necessary additions to the base product!

Filezilla is my FTP client.

PuTTY is my preferred terminal client. So lightweight. So robust.

Skype is used for phone calls - I typically use Messenger for instant messaging rather than Skype but when it comes to telephone calls, Skype can't be beaten.

Security
Password Safe because I'm a responsible citizen who uses different passwords for different applications/websites and I can't possibly remember them all.

AVG Free still makes it on to my machines. I've tried others but found AVG Free to be the least invasive.

Development
I still like to handcraft my HTML - I don't know why. I can't help it and because I code in PHP, JavaScript, HTML and various other scripting technologies, I find it easiest to use Notepad++. Macro recording and code highlighting without the bloat? Install it!

MySQL Workbench is an application that I use not just to manage MySQL databases but to design databases in general (even if the target platform is DB2 or Oracle).

Toad for DB2 (and other variants). MySQL Workbench creates very pretty diagrams, but Toad is just plain superb for remote management of a database.

TortoiseSVN helps me keep my source code under control!

I have a lot of demonstration environments and have spent many years using VMWare's Workstation. However, I've recently been converted to Sun's xVM Virtualbox product. I haven't performed any serious benchmarking but I've found it just a little more slick when using virtual machines on my laptop. Serious serving of virtual machines is something I may still turn to VMWare to perform, though.

Miscellaneous
The following get installed just because:

• Google Earth
• Tweetdeck
• Other browsers (to verify cross-browser compatibility): Google Chrome; Safari; Opera
• Google Picasa
• Adobe Acrobat Reader (of course)
• Spotify because I sometimes like to work while listening to music
• CutePDF for PDF generation from any of my apps
• Microsoft Media Encoder for video clip production
• JZip for archiving
• GNU Tools for Windows which gives me tar, sed, awk and grep capabilities
• OpenProj for project management

All of the above applications are freely available so there is no financial excuse for not installing them. I do have some commercial applications installed as well though. Despite the great strides that OpenOffice and Star Office have made in recent years, I still can't seem to do without Microsoft Office. And Visio is still tops for me!

Messaging Systems

Inter-application communication has evolved over the years from proprietary protocols and fixed message formats to message queues and web services based systems using XML.

But it isn't unusual to see an application communicate via mechanisms more usually associated with real-world messaging between real people. eMail, for example, can be used to convey messages from one system to another although eMail isn't necessarily a great way of guaranteeing delivery of any message in my experience!

Bringing us right up-to-date is Twitter. Although Twitter is a way of communicating using short-based messages only (as it is limited to a mere 140 characters), it does have a good record of being almost always available. Sending a short-based message from one system to another could utilise the power of Twitter quite easily, surely?

Consider the following usage pattern...

An offsite managed service is being provided by a third party with support hours of 08:00 - 18:00. Overnight batch processes are to be checked each morning by the service provider. The service provider, however, introduces monitoring of systems which trigger exception alerts via Twitter for off-site pick-up via any amount of Twitter clients on any number of devices. Think about the following message:

2010-04-07 22:50:05 FATAL: Batch Feeder [BACS: Invalid Trailer Record]

Instead of waiting for support staff to analyse logs the following morning, they have a head start telling them exactly where to look.

Of course, we could just have the monitoring service raise a ticket or send an email or send SMS alerts. The point is not to show that Twitter is better than any of these delivery mechanisms but to show that Twitter is an alternative. (After all, it could be that we have a Twitter listener which queries these messages and raises the necessary problem records in the service desk.)

The point is the ultimate delivery mechanism of the message to the client isn't the responsibility of the message generating application. The application doesn't care if the message is to be viewed by a custom-built message reader on an iPhone, Tweetdeck on a PC or a shell script sending curl requests at twitter.com!

I'm sure my avid readers can come up with many more sophisticated use cases for the integration of Twitter into the enterprise.

NOTE: Any such inter-application communication using Twitter should ensure that the tweets are protected. There's no point in having "randoms" looking at your tweets, after all.

ITIM Messaging & Synchronisation

WebSphere gurus all the world over will probably understand what a messaging cluster is; what tranlogs are; and how all this "stuff" works.

For systems integrators who don't necessarily specialise in any one technology, these things may seem more like a dark art and certainly the information made available in the myriad of documents produced by the various authors of WebSphere technical books doesn't seem to shed enough light on what is going on.

Yesterday, I had a misbehaving IBM Tivoli Identity Manager (ITIM) instance which saw all transactions sitting in a pending state with not a single transaction being flushed through to completion.

The setup was: ITIM v5.0 running in a WebSphere v6.1.0.9 clustered environment with two physical servers. Everything about the deployment was fairly vanilla (though the amount of data going through the system is quite large).

The problem started on Sunday night during the automatic regeneration of LTPA keys - it seems. The Deployment Manager lost the ability to control the Node Agents/Clusters which forced the following sequence of events:

• Forced shutdown of the Application Servers and Node Agents
• Removal of Global Security
• Manual synchronisation of the nodes on the physical servers
• Startup of the Node Agents
• Reconfiguration of Global Security
• Resynchronisation of the nodes (via the Deployment Manager)
• Startup of the Messaging Cluster
• Startup of the Application Cluster

Everything looked OK, until transactions started to appear in ITIM and they still sat pending!

The logs showed that the Messaging Cluster would start, then stop, then start, then stop, then start, then stop.....

Communications channels between the local queues and the shared queues weren't as they ought to have been and the root cause seems to be an inconsistency between transactions that ITIM expected to be pending; transactions the Messaging Cluster thought it had; transactions stored in the "physical" storage of DB2 for the messaging cluster and the tranlog.

NOTE: The recovery procedure for this is probably not something anyone should undertake but it was a final straw after 12 hours of trying various tactics which could have saved my pending transactions (which proved futile).

• Stop the clusters
• Stop the Deployment Manager
• Kill any rogue WebSphere processes (of which there were a few)
• Stop the database manager supporting ITIMDB
• Delete the various tranlog files for the two application server instances
• Reboot the two servers (which probably wasn't required, but these were Windows 2003 server instances which seemed to be hanging on to various ports needlessly and I wanted a clean environment to start everything up again)
• DANGER: delete from itiml000.sib000 in the ITIM Database (as well as itiml001 and itims000 and for sib001 as well)
• Start up ITIM

At this stage, all was well. Apart from my physical well being.

CAUTION: The above approach was a very brutal way of clearing out everything to a point where the system was operational once again. I never want to have to repeat this process and having a clean ITIM instance which is well tuned and well looked after is very much more preferable than having to perform this kind of recovery.

Reputation On The Net

I've commented on more than one occasion on the power of the internet and, in particular, the power of the various social networking sites that have sprung up in recent years. It's not enough to have an account on Facebook any more. We have to have a Twitter account feeding Facebook. We also want our random thoughts automatically updating our professional networking pages on LinkedIn. We use Plaxo to amalgamate the email addresses stored in various repositories. We have our .TEL domains, we're Buzzed and we blog.

We must spend a lot of time generating unstructured information for the consumption of the masses.

But what about the information that is generated ABOUT us BY others? It's one thing to look after one's online reputation by ensuring that we portray ourselves as professional in our tweets and blogs. But what if the baddies out their are destroying our reputation in forums that we have no control over?

I've spent a number of years applying my brain cells to the task of working out how to control access to systems and how to manage the credentials within systems. We in the industry call it Identity & Access Management as these tasks are frequently joined "at the hip". Maybe my brain has had enough of IdAM activity as most of my recent conversations seem to be related to Cloud based services, reputation management and how social networking can be an invaluable business tool.

Here's a question for you? How frequently to you actively search for information related about YOU on the net? What dangerous comments could be lurking out there? What do people really think of you?

Sometimes it may be best to not know. But, sometimes you can be presented with a very nice surprise.

Take, for example, Vintage1951's recent blog entry! In it, I've been called experienced and thoughtful! In an industry where reputation is everything, I can think of almost no higher accolade (at least, no higher accolade that won't sound over-the-top and smug!)

It's nice to see that Vintage1951 takes a similarly thoughtful approach to his reputation by connecting with only those people he has the utmost respect for. I feel privileged to be amongst them.

On a final note - have a browse around Vintage1951's blog. There are some excellent articles in there!

Enterprise Compliance For Business Managers

I spent a number of years acting as a Line Manager for a team of Identity & Access Management specialists at a time when there was increasing focus on compliance controls within the organisation. Certifying that my employees only had the systems' access rights that they required for their job was a quarterly event to look forward to.

Being told that Joe Bloggs can access System X with a role of Developer might seem like sufficient information for me to testify that the this is appropriate, but I would have to have made an assumption that developer access on System X has been correctly configured by whomever configured the system. What would the impact be if the administrator of System X had inadvertently given superuser access to those users in the developer group?

Traditionally, we have merely accepted that assigning users to groups is enough to satisfy our legislative requirements. But this is not the case! We also need to attest that the lower level permissions have been configured appropriately.

So what if we could find a way to deliver the lower level permissions to the Line Manager during his quarterly certification? What if I could see that superuser access had been inadvertently granted to my set of developers on System X?

This raises another problem, though. Lower level permissions on various systems take the form of data values which may be meaningless in their own right and therefore not in a format that would allow a Line Manager to understand them. As an example, informing a Line Manager that their employee has access to a system which means they have been assigned the value of S to the attribute ACCESS_RIGHTS. What does S mean? Standard? Super? Something-Else?

So what if we could provide the details in a manner which is more meaningful for the Line Manager?

I've spent some time in the recent past working on a mechanism to augment these lower-level permissions to provisioning data in such a format, thus enhancing the attestation experience of access certifiers but also as a means of validating that systems have been configured properly (and, as a consequence, the ability to perform lower-level Segregation of Duties checking).

The result of this work has been documented by Alan Harrison and is now available on the Pirean website. The work shows how low-level attributes held in RACF can be presented in a meaningful way through the IBM Tivoli Identity Manager interface. The principles, however, can be applied to any credential storage mechanism.

How I wish I had had that ability when I was a Line Manager!

ITIM Provisioning with SPML

I had an interesting day last week playing with IBM Tivoli Identity Manager and IBM Tivoli Directory Integrator. The brief was to send provisioning requests from ITIM via ITDI as SPML requests to a target credential store. Sounds easy, doesn't it?

SPML parsing support has been available within ITDI since v6.1.1 (Fix Pack 1) and dropping the openspml2-toolkit.jar into ITDI's JAR directory should've been enough for me to get motoring with the requirement. And there is a certain amount of truth in that statement in that it was easy to put together a Proof Of Concept showing an ITDI Assembly Line sending SPML formatted provisioning requests to a SPML listener.

That was fine until I elevated the Assembly Line into ITIM. Sending the AL to an ITDI RMI Dispatcher as part of an ITIM provisioning request has been a feature of the ITIM setup since its v4.6 days and there hasn't been any reason to suspect that ALs invoked via the dispatcher mechanism would behave any differently than ALs invoked from either the command line or through the ITDI GUI.

But there is...

Unfortunately, I had created an Assembly Line that was made up the following:

• Parser Function (to parse my work entry into SPML format)
• HTTP Client Connector (to send my SPML formatted string to a SPML listener)
• Parse Function (to parse the response to my connector above)

There's nothing wrong in what I did. I could've attached the SPML parser to the HTTP Client Connector, but I didn't. I wanted to build up my AL slowly and show what was happening during the SPML creation process.

The AL worked fine through the GUI. But it did not work when "dispatched" as it throw a nullPointerException during the attempt to call the parser. My RMI Dispatcher had all the required JARs at its disposal and the environment variables were identical to my GUI environment. I even tried to use the CSV parser rather than SPML (thinking that maybe a parser introduced as part of a Fix Pack may not have full support) but I got the same result.

If only I had attached the parser to my HTTP Client Connector because guess what? You guessed it. That worked! It seems that (in my environment) parser functions cannot be instantiated when the AL is invoked by the RMI Dispatcher. NOTE: I did upgrade my RMI Dispatcher code to the very latest version during my investigations.

So a note to all - Parser Functions may not behave as you expect when dispatched!

No Matter How Diligent You Are...

Today, I got an email from a service provider I have only rarely used stating that they had been the victim of a successful hacking attempt. They reassured me that they didn't store any credit card details but I should change my password as soon as possible.

This is the second time this has happened in the past year and both sites are fairly insignificant in the grand scheme of things. They aren't, for example, financial services sites so I shouldn't panic unduly.

I have no changed my password on the offending website so all's well, right?

Wrong!

Whoever hacked this site may now have my name, address, email address and a password they know I have used in the past. Matching this password and email address may grant them access to other services I use online. That's not an unreasonable assumption on the part of the hacker, of course. How many people reuse their "favourite" password on each service they sign up to?

I think of myself as fairly diligent, though. I do have a "favourite" password. In fact, I have 3/4 "favourite" passwords! But NONE of them are used for my mission critical services: banking, being one!

However, I should now consider that one of my "favourite" passwords has been compromised and should be decommissioned. That now means I should take a look through my password safe and change the password on those services that make use of this now redundant password. What a pain!

The personal damage has been contained somewhat. My mission critical services are still safe. (In fact, I have no idea what the password is for these services and have no intention of ever "learning" what I have them set to!) If only everyone else behaved as responsibly. In fact, if only I behaved even more responsibly by having a separate password for every service I use!

My tips for the day, then, are:

• Even if you have a high-quality password, always consider it vulnerable as you have no idea how your service provider stores your password
• Try to create a different password for each of the services that you use (and avoid prefixing or suffixing your "favourite" password with the service details - passw0rdebay and passw0rdfacebook are stupid passwords)
• If you still feel confident reusing your "favourite" password, avoid the temptation to use it for your banking services
• Re-evaluate what a mission-critical service is. Banking is definitely mission-critical, but your reputation is also critical and having your Facebook or Twitter accounts compromised because of a slack password policy isn't clever either
• Invest in a password management tool - even something as simple as Password Safe ought to do the trick and it is free!