Author Archives: Jeanne Boyarsky

twitter and two factor take two

Posted on by
Reply

In 2014, I tried to enable two factor on Twitter and had to turn it off. Given the recent news that Twitter encourages everyone to change passwords, I decided to take another stab at it. I also learned that Twitter has more options for two factor now like Google authenticator.

Step 1: Changing the password

First, I changed the password. I clicked on the drop down with my picture and chose “settings and privacy”. Then I choose password and changed it. I got an email letting me know the password changed. Good.

Step 2: Surprise step – review apps

Twitter then reminded me that I have 18 applications that can access my account and asked if I wanted to review them. 18 sounds high so I said yes. There were a few general categories:

  • Apps with read only access – given that pretty much everything on twitter is public, I don’t mind that I gave a few sites access to read my profile. I did find one that was just for a one time test and doesn’t need it anymore.
  • Piping my tweets to Facebook – yes. I definitely want this.
  • Various twitter clients – some I don’t use anymore so cleaned this up a bit as well.
  • “social reputation monitoring” – it says I gave this site read/write/direct message access in 2015.  I don’t remember this and I certainly don’t want them to have it anymore. Revoke!
  • Linked in – While I don’t mind them having read access, I don’t want them having write access. Revoke. Same with Disqus. I wasn’t nearly paranoid enough in 2013.

Now I have 13 apps with read (or read/write) access. Still a lot, but at least I know what they are. It’ll be interesting to see which of the read only ones break. “I don’t mind” is different from “I really want it to work”

Step 3: Login verification (two factor)

As I was looking for two factor, I saw “login verification” under account options. That turns out to be what Twitter is calling two factor. I guess it sounds less scary.

However “setup login verification” was disabled. It says I need to confirm my email to turn this on. Ok. So how do I do that? It appears the only way to get a confirmation email is to change your email address. It was a bunch of steps, but I did:

  1. Change to myRealEmail+twitter@gmail.com (because gmail lets you add a plus and more text and still sends to you)
  2. Enter twitter password to confirm it is me
  3. In email, click confirmation
  4. Repeat these three steps to switch back to and confirm my “short form” email. (so I remember what I gave them)

Ok time to turn on two factor with SMS

  1. In account settings, click “setup login verification”
  2. Click start
  3. Enter twitter password to confirm it is me
  4. Send SMS code
  5. Enter SMS code from phone
  6. Generate a backup code in case I ever have issues

Now I have the option to setup alternate two factor methods

  1. In account settings, click “review your login verification methods”
  2. Click “setup” next to mobile security app
  3. Use google authenticator to scan the barcode
  4. Enter the generated code from google authenticator into twitter

Finally, I clicked “edit” next to text message verification so I am just using google authenticator and not text message.

Step 4: My twitter clients

Ok. Now for the test. Can I use Twitter in the devices I care about most? Things seem to work. Will post an update if that no longer stays the case!

Updates:

  • I can still use twitter on all my devices. So I don’t get prompted to login after the password change or two factor. It only takes effect for new logins. (This is good; I have a lot of places that I am logged into twitter.)
  • I got an email from an identify monitoring service that they no longer have access to my twitter. This service only told me about my own tweets so I’m leaving them without access. I was hoping they would tell me about other people’s tweets. I know what I tweet. And as fun as it is to be told I used the word “password” in my twitter…

your calendar belongs to you!

Posted on by
Reply

I was taking a training class this week and was informed that some of the things I do aren’t “common knowledge.” So I’m going to be using the soft skills category in this blog to share some of them. Consider this the first blog post of many.

The advice that started this was a comment I made about blocking out your calendar. If you want to be able to do something, you need to make it a priority. And how do you do that if your calendar tells the world (well your co-workers) – “hey look, Fred is free at this time.”

Personally, I block out time for lunch each day. I also block out “coding blocks” so I have dedicated blocks in which I can focus. Want to do something after work? Block out your calendar starting 5 or 5:30.

Now I know what you are thinking – that won’t work in my job. We have unplanned events, emergencies, high priority meetings. Well, that’s ok. You can make peace with the idea that you won’t keep all of your blocks. Maybe you want to run at 5pm three days a week. Block out 5pm on all five weekdays. That way you can have two unplanned events and rest assured that you will still run three days a week.

One reason this works, is that you regain control of your calendar. If you have it blocked, someone has to ask you (or you have to offer) to free up that time for them. Which ensures it is important enough a reason to do so.

One of my co-workers started calendar blocks at my suggestion. He still has those blocks in his calendar so it must be working for him too! And if it helps us, why not you as well?

Moving Java Forward Faster – live blog at Oracle Code

Posted on by
Reply

Title: Moving Java Forward Faster
Speakers: Donald Smith

See my live blog table of contents from Oracle Cloud

New Java Release Model

  • “no more limos; think trains”
  • From Java 2 to Java 8, had target release of every two years. Slipped a bunch of times (once to 5 years)
  • From Java 2 to Java 8, did update releases roughly every 6 months. (not counting security releases). These update releases had new APIs or functionality. Ex: 8u20, 8u40, 8u60
  • Java 9 was released in September 2017 and is already at end of life
  • Tried to make case that Java 10 is really 9.1 and Java 12 is really 10.1 and Java 13 is really 10.2 and so forth. [I don’t think this analogy holds. Talking to Mark Reinhold suggests that they aren’t trying to make major changes specifically for 11).
  • Didn’t use 9.1, 10.1, etc because need major version number to make spec change.
  • Carve up changes across releases instead of a major release every few years.
  • Every six months is now a feature release and can potentially change the spec.
  • Enterprises do not like 6 month releases so every 3 years is LTS release.
  • Java 11 is 18.9 LTS. So the LTS still uses the yy.m naming convention. So Java 17 will be the 21.9 LTS. If so java –version get vendor string that will have both Java 11 and 18.9 in string for Oracle JDK
  • Java 11 (18.9 LTS) will be supported for about 5 years plus 3 years of extended support.
  • LTS releases will be more stable because people are using the interim releases who don’t care about LTS.
  • Java 6 support ends in late 2018. Java 7 support ends in 2022 and Java 8 ends in 2025. Java 8 might be supported longer. TBD.
  • Oracle will be producing Open JDK binaries vs it being a third party thing. Open JDK binaries are GPL licensed. They will only be available for 6 months for Java 11, 17, etc
  • Open sourcing the commercial features that are part of the JDK – mission control, flight recorder, app class data sharing, java usage tracker (see how many JREs used in system).
  • Separately packaged tools will stay commercial

What’s new in Java 9

  • Last “major” release. 100+ features
  • No longer using word “major” because releases are frequent and incremental.
  • Jigsaw gives smaller footprint to attack by having less modules.
  • java misc Unsafe – [the usual so not writing it up]
  • AOT compiler – for application as well. Not immediate, but coming.
  • jshell – live demo
  • G1 is now default garbage collector

Long term goal of jlink

  • Horror stories where people need a dozen versions of JREs because apps don’t work with various patches.
  • Long term goal – shift thinking of how package apps from standalone JRE to shipping a JRE with the app itself. (for client side apps for users)
  • Gut: This makes the problem worse
  • jlink lets you create custom runtime optimized for program. Doesn’t have all the modules.
  • Get smaller package with just what need.
  • [security implications are interesting; have to patch each app but apps far less likely to contain vulnerability]
  • jlink also requires packing for hardware
  • Goal shifting to jlink because browsers and OS are heading away from one common Java for Windows and Mac. Worried that one day there will be an OS update that will block separate JRE.
  • [I asked why it isn’t a problem for developers if OS blocks common java. He said maybe a configuration or a developer build. So power users vs end users problem]

What’s new in Java 10

  • First feature release (vs major release)
  • Type inference – var x – … (example of a feature that couldn’t be in an update release since changes Java spec)
  • G1 garbage collector uses multiple threads
  • 12 JEPs (Java Enhancement Proposals) targeted.
  • Open source root certificates. Can connect to many TLS servers out of the box. Vs OpenJDK for RHEL which assumes you have Firefox installed.

What’s new in Java 11

  • 4 JEPs already targeted. Waiting until ready to target
  • Removing some APIs

Future – version not yet known

  • Optimize for data; not just code. So big data libraries don’t need to call native code
  • Project Panama – interoperate with native libraries (better JNI)
  • Project Loom – lightweight threads
  • Project Valhalla – value types. Maybe Java 12?

My take

Excellent session. I thought I understood the release model and still learned some nuances! Glad he spent more than half the session on this topic. And I hadn’t realized the long term implications for Jigsaw/jlink.