tank, ssl, heartbleed

[chris...@gmail.com]

As you may have heard there's a significant bug in the SSL
implmentation used by most of the world:

http://heartbleed.com/

Since Tank uses SSL I've updated the OpenSSL on that server, changed
server side secret keys and destroyed any user generated API keys.

For users this means they will need to log in again if they have a
currently active session.

Since Tank uses GitHub, Facebook and Google for authentication,
rather than storing passwords itself, there is very little risk
that sensitive data has been compromised.

As a general rule, once you are sure that GitHub, Facebook or Google
have updated their SSL (they almost certainly have by now), it would
be prudent to change your password there.

--
Chris Dent http://burningchrome.com/
[...]

[Måns]

Hi Chris

I'd like to try Tank - however my google account won't login (when it does I get a very nasty textpage full of servermessages**) Facebook complains with an error message saying sth like "The app isn't configured correctly for login with facebook...".

I don't have a Github account.

Cheers Måns Mårtensson

**) - Should I change my Google username??

Traceback (most recent call last):
  File "/usr/local/lib/python2.7/dist-packages/httpexceptor/__init__.py", line 58, in __call__
    return self.application(environ, start_response)
  File "/usr/local/lib/python2.7/dist-packages/tiddlyweb/web/wsgi.py", line 190, in __call__
    output = self.application(environ, start_response)
  File "/home/cdent/tiddlywebs/tank.peermore.com/tiddlywebplugins/tank/httperror.py", line 25, in __call__
    return self.application(environ, start_response)
  File "/usr/local/lib/python2.7/dist-packages/tiddlyweb/web/serve.py", line 158, in __call__
    return self.application(environ, start_response)
  File "/usr/local/lib/python2.7/dist-packages/tiddlyweb/web/serve.py", line 117, in __call__
    return self.application(environ, start_response)
  File "/usr/local/lib/python2.7/dist-packages/tiddlyweb/web/query.py", line 44, in __call__
    return self.application(environ, start_response)
  File "/usr/local/lib/python2.7/dist-packages/tiddlyweb/web/wsgi.py", line 128, in __call__
    return self.application(environ, start_response)
  File "/usr/local/lib/python2.7/dist-packages/tiddlyweb/web/extractor.py", line 34, in __call__
    return self.application(environ, start_response)
  File "/usr/local/lib/python2.7/dist-packages/tiddlyweb/web/wsgi.py", line 38, in __call__
    return self.application(environ, start_response)
  File "/usr/local/lib/python2.7/dist-packages/tiddlyweb/web/negotiate.py", line 30, in __call__
    return self.application(environ, start_response)
  File "/usr/local/lib/python2.7/dist-packages/tiddlywebplugins/cors.py", line 87, in __call__
    return self.application(environ, start_response)
  File "/usr/local/lib/python2.7/dist-packages/tiddlywebplugins/csrf.py", line 75, in __call__
    return app()
  File "/usr/local/lib/python2.7/dist-packages/tiddlywebplugins/csrf.py", line 71, in app
    output = self.application(environ, fake_start_response)
  File "/usr/local/lib/python2.7/dist-packages/selector.py", line 137, in __call__
    return app(environ, start_response)
  File "/home/cdent/tiddlywebs/tank.peermore.com/tiddlywebplugins/oauth/consumer.py", line 76, in do_user_auth
    server_name, response_map, content)
  File "/home/cdent/tiddlywebs/tank.peermore.com/tiddlywebplugins/oauth/consumer.py", line 120, in _do_login_or_register
    return _send_cookie(environ, start_response, user)
  File "/home/cdent/tiddlywebs/tank.peermore.com/tiddlywebplugins/oauth/consumer.py", line 169, in _send_cookie
    mac_key=secret, path='/', expires=cookie_age)
  File "/usr/local/lib/python2.7/dist-packages/tiddlyweb/web/util.py", line 216, in make_cookie
    cookie[name] = '%s:%s' % (value, secret_string)
  File "/usr/lib/python2.7/Cookie.py", line 591, in __setitem__
    rval, cval = self.value_encode(value)
  File "/usr/lib/python2.7/Cookie.py", line 680, in value_encode
    strval = str(val)
UnicodeEncodeError: 'ascii' codec can't encode character u'\xe5' in position 8: ordinal not in range(128)

[chris...@gmail.com]

On Tue, 29 Apr 2014, Måns wrote:

> I'd like to try Tank - however my google account won't login (when it does
> I get a very nasty textpage full of servermessages**) Facebook complains
> with an error message saying sth like "The app isn't configured correctly
> for login with facebook...".
> I don't have a Github account.

Ah, interesting. The error you are reporting shows a bug in the way
that cookies are being produced, so not a mistake on your side,
something I need to fix, which I will do as soon as I can (it may be a
few days, I'll be travelling over the next couple).

On the facebook issue I'll have to look into that, but it is probably
a configuration error on my part.

[chris...@gmail.com]

On Tue, 29 Apr 2014, chris...@gmail.com wrote:

> On the facebook issue I'll have to look into that, but it is probably
> a configuration error on my part.

I think I fixed the facebook problem: SSL issues with the latest
version of httplib2.

The unicode username problem remains, I'll look into that as soon as I
can.

[Måns]

Hi Chris

On FB I still get the same errormessage:

Text is in Danish - it is however the same error as I described earlier...

Cheers Måns Mårtensson

[chris...@gmail.com]

On Wed, 30 Apr 2014, Måns wrote:

> On FB I still get the same errormessage:
>

> <https://lh5.googleusercontent.com/-tomEOv03sIo/U2EDdP9HaqI/AAAAAAAAFGs/ngQhoYfqRwA/s1600/fberrordk.png>

> Text is in Danish - it is however the same error as I described earlier...

Interesting, perhaps it is because it has not been localized to use
Danish. I've added that (on the facebook side). Could you try again
and let me know?

If it still doesn't work if you could give me the full translation of
the Danish text that would be helpful. Thank you.

[chris...@gmail.com]

On Tue, 29 Apr 2014, chris...@gmail.com wrote:

> Ah, interesting. The error you are reporting shows a bug in the way
> that cookies are being produced, so not a mistake on your side,
> something I need to fix, which I will do as soon as I can (it may be a
> few days, I'll be travelling over the next couple).

I haven't had a chance to look into this yet. It will be Tuesday
before I do.

[Måns]

Hi Chris

 

If it still doesn't work if you could give me the full translation of
the Danish text that would be helpful. Thank you.

Error: "App Not Setup: The developers of this app have not set up this app properly for Facebook Login."

Cheers Måns Mårtensson

[chris...@gmail.com]

On Sun, 4 May 2014, Måns wrote:

>> If it still doesn't work if you could give me the full translation of
>> the Danish text that would be helpful. Thank you.
>
> Error: "App Not Setup: The developers of this app have not set up this app
> properly for Facebook Login."

It appears I only have it set up to work for me! :)

I'll attempt to fix that this afternoon and report back.

Thanks for helping me trace this.

[chris...@gmail.com]

On Mon, 5 May 2014, chris...@gmail.com wrote:
> On Sun, 4 May 2014, Måns wrote:
>>> If it still doesn't work if you could give me the full translation of
>>> the Danish text that would be helpful. Thank you.
>>
>> Error: "App Not Setup: The developers of this app have not set up this app
>> properly for Facebook Login."
>
> It appears I only have it set up to work for me! :)
>
> I'll attempt to fix that this afternoon and report back.

I've adjusted the configuration so it should now be public. If you
could try again that would be great. Thanks.

[chris...@gmail.com]

On Sun, 4 May 2014, chris...@gmail.com wrote:

> On Tue, 29 Apr 2014, chris...@gmail.com wrote:
>
>> Ah, interesting. The error you are reporting shows a bug in the way
>> that cookies are being produced, so not a mistake on your side,
>> something I need to fix, which I will do as soon as I can (it may be a
>> few days, I'll be travelling over the next couple).
>
> I haven't had a chance to look into this yet. It will be Tuesday
> before I do.

I believe I've fixed this so there is now a new release of TiddlyWeb
(2.2.0). I've installed that version on Tank so usernames containing
unicode _may_ work now. If you get a chance to try it please let me
know one way or another.

Thanks.

[chris...@gmail.com]

I fixed it in TiddlyWeb itself, but apparently not in the CSRF
handler. So I just moved the bug around. I'll looking into it some
more now.

[chris...@gmail.com]

On Tue, 6 May 2014, chris...@gmail.com wrote:

> I fixed it in TiddlyWeb itself, but apparently not in the CSRF
> handler. So I just moved the bug around. I'll looking into it some
> more now.

It's properly fixed now. I was able to create a user with the name
Cöws and log in and out and do all the expected stuff.

Thanks for your patience.

[Måns]

Hi Chris

I've been able to login with my unicode google username - and with my facebook account.

Great :-) Thanks a lot!!

I like everything what I have seen in the interface uptill now - I have to investigate - and see what I can do with Tank. Need some more time before I can give feedback...

A couple of "newcomer" questions (I should probably read some of the documentation before asking - however you don't need to bother - if you know I will find the answers in the docs...):

Can I setup a TW5 easily? eg. Just by saving it to to a tank - as a single file? (The tiddlyspot way...)

Is it possible to run a TW5 as if it was a TIddlySpace wiki on Tank? - with tiddlers in different tanks with different policies?

Cheers Måns Mårtensson

[Måns]

Aah already found mit - sorry for being a lazy user  - cheers

https://tank.peermore.com/tanks/docs/TiddlyWiki%20Five

[chris...@gmail.com]

On Mon, 12 May 2014, Måns wrote:

> I've been able to login with my unicode google username - and with my
> facebook account.
> Great :-) Thanks a lot!!

Excellent, thanks for letting me know.

> I like everything what I have seen in the interface uptill now - I have to
> investigate - and see what I can do with Tank. Need some more time before I
> can give feedback...

Take your time, any feedback is very useful.

> Can I setup a TW5 easily? eg. Just by saving it to to a tank - as a single
> file? (The tiddlyspot way...)

Your other message suggests you figured this out: you use tw5 by
composing a tank containing the tw5 app with a tank of your choice.

> Is it possible to run a TW5 as if it was a TIddlySpace wiki on Tank? - with
> tiddlers in different tanks with different policies?

It is possible, but it is not yet exposed in the interface. Under the
covers a composition is just a recipe with two or more bags which
happens to have one tiddler called "app" in it. At the moment the
interface allows the composition to be created with just two
tanks/bags, however you can have more bags in there if you use the API
to adjust the recipe that is associated with the composition.

I plan to create a tool which is similar to the policy manager[1] for
adjusting compositions, but have not had the time and focus required.

[1] https://tank.peermore.com/tanks/docs/Policy%20Manager