I’ve built a handful of Chrome extensions this year, and I wrote up some of what I learned in a post back in March. Since then, I’ve found two more tricks that have proved useful. First, the Chrome Canary channel includes a handy extension error console to quickly expose extension errors. Update: This feature is nowContinue reading “Useful Resources when Developing Chrome Extensions”
Author Archives: ericlaw
Email Tracking Links are the Worst
Use HTTPS for all inbound links, especially those sent in email.
Troubleshooting Windows 10 Bluescreens
I recently bought a Dell XPS 8900 desktop system with Windows 10. It ran okay for a while, but after enabling Hyper-V, every few minutes the system would freeze for a few seconds and then reboot with no explanation. Looking at the Event Viewer’s Windows Logs > System revealed that the system had bugchecked (blueContinue reading “Troubleshooting Windows 10 Bluescreens”
WordPress.com bug post
This post demonstrates a bug in WordPress. Ignore it. This isn’t a real domain. Don’t hyperlink it because I explicitly did not use an A tag here https://eric-lawrence-wrote-this.com okay This isn’t a real domain. Don’t hyperlink it because I explicitly did not use an A tag here https://eric–lawrence-wrote-this.com okay
File the Bug
Two experiences this week reminded me of a very important principle for improving the quality of software… if you see something, say something. And the best way to do that is to file a bug. Something Weird? File a bug! The first case was last Thursday, when a user filed a bug in Chrome’s trackerContinue reading “File the Bug”
Using Fiddler With iOS 10 and Android 7
If you’ve tried to use Fiddler with iOS10 beta or Android 7 Nougat, you have probably found that HTTPS decryption isn’t working, even if you use the latest Fiddler and the Fiddler Certificate Maker add-on. Unfortunately, at the moment both platforms are broken, but for different reasons. In both cases, the client will fail toContinue reading “Using Fiddler With iOS 10 and Android 7”
Test post
Here’s an image from a server with a LetsEncrypt certificate.
Cheating Authenticode, Redux
Back in 2014, I explained two techniques that have been used by developers to store information in Authenticode-signed executables without breaking the signature, including information about the EnableCertPaddingCheck registry flag that can be set to break the technique1. Recently, Kevin Jones pointed out that Chrome’s signed installer differs on each download, as you can seeContinue reading “Cheating Authenticode, Redux”
TLS Fallbacks are Dead
Just over 5 years ago, I wrote a blog post titled “Misbehaving HTTPS Servers Impair TLS 1.1 and TLS 1.2.” In that post, I noted that enabling versions 1.1 and 1.2 of the TLS protocol in IE would cause some sites to load more slowly, or fail to load at all. Sites that failed toContinue reading “TLS Fallbacks are Dead”
Non-Secure Clicktrackers–The Fastest Path from A+ to F
HTTPS only works if you use it. Coinbase is an online bitcoin exchange backed by $106M in venture capital investment. They’ve got a strong HTTPS security posture, including the latest ciphers, a 4096bit RSA key, and advanced features like browser-preloaded HSTS and HPKP. SSLLabs grades Coinbase’s HTTPS deployment an A+: This is a well-secured siteContinue reading “Non-Secure Clicktrackers–The Fastest Path from A+ to F”
text/plain 