For information, for people a bit more tech-savvy — in this article I use the SSL abbreviation as an encrypted connection of any type and version. We no longer use SSL. Or rather TLS — a new version that has replaced the old SSL. I would not like to focus on the mechanisms, how it works under the hood, but rather on what it gives to the end user.

Have you ever wondered how DNS servers work and what do they have to do with SSL? The website sejm.gov.pl allows you to open with a secured and unsecured protocol, so it is a good example for our tests. Consider this situation:

http://sejm.gov.pl/ – a website unsecured with an SSL
https://sejm.gov.pl/ – a website secured with an SSL
194.41.12.17 – the IP address of the website sejm.gov.pl
Entering the website http://sejm.gov.pl/ we will see something like this:

The inscription “Not secure” warns us about an unsecured connection, but everything is in place and the site works fine.

If we wanted to bypass DNS and go to the same page using the IP address, it would look like this:

Nothing really changes. Not a huge discovery, is it? ?
So let’s consider an encrypted connection:

Everything works just fine.

How about without DNS?

And here we have a problem. Why is the page not loading? We are using the correct address, we are using https, so it should be ok! We take the first steps to find a bad certificate.

Hmmm, even the certificate is correct… So why won’t the browser let us in? What happens when we ignore the error and use this website? Is our connection encrypted? Is it safe?

Answering briefly to the above-mentioned questions:

1. 1. Yes, the connection is encrypted. The SSL certificate itself does not have to be trusted to establish a secure communication channel between the server and the browser.
2. 2. Is it safe? It depends — in this case we are safe.
3. 3. In this case, by ignoring the error, we tell the browser that we want to view this page, even though its certificate does not match the address we typed into the search bar.

Then why do we need certificates?

The website we are on is verified with a certificate. The address for which the certificate was issued MUST be the same as the address in our browser address bar. Otherwise, even if the certificate is valid, we will be informed about the problems.

How does my computer know that the certificate is valid?

In the operating system, we have saved certification authorities that we trust, we can freely modify their list, e.g. add ours. Here it is important to use a system with limited privileges on a daily basis — only the administrator is able to add a new trusted certificate. So the hands-tied virus runs on a restricted account.
In the previous picture, we looked at the sejm.gov.pl website certificate, the issuer Certum Trusted Network CA was at the top of the certification path — it is trusted because it is in the store of trusted certificates of my computer.

Because the certificates are saved in operating systems, the number of companies that issue them is quite limited. Theoretically, anyone can issue a certificate for any domain, e.g. using the free OpenSSL tool, but what if we as the issuer are not trusted by others? We won’t be able to attack this way.

The website certification process itself can be simple and fast — e.g. in the case of static websites where we do not provide any sensitive data. The certificate provider then only checks whether the page for which we want to generate the certificate exists and whether it belongs to us. Free certificates for basic features have been available for purchase for some time, issued by Let’s Encrypt. It can also be more complex, e.g. in the case of banks — suppliers carefully verify whether the company exists, what the company does, and how they apply security measures. The difference can then be seen in the certificate preview, browsers distinguish these stronger certificates, e.g. by showing the name of the company for which it is issued.

Regular certificates can be certificates for a single domain, or wildcard certificates — for all sub pages at the same time, as above — *sejm.gov.pl Thanks to this, the same certificate can also be used on the website. https://posiedzenia.sejm.gov.pl, or https://poslowie.sejm.gov.pl.

Stronger certificates are always issued only to a specific domain — this significantly increases the costs of issuing certificates for many sub pages, but provides better protection when the certificate is used only in 1 place. For example, the ING Bank has a person certified for the home page and for the login page.

Why do we store and verify certificates of certification authorities locally instead of asking a trusted server if the certificate is ok?

1. 1. We connect to the Internet in various places, we do not know network administrators, Internet providers, etc. It would not be wise to trust everyone that they will send our packages asking for verification to the right place.
2. 2. To make changes to our computer, we must have administrator rights.
3. 3. Our computer can thus detect suspicious network activity — just this discrepancy between the certificate and the website we are on. For example, if the Internet provider changed our DNS servers, or directed traffic not where we would like it — for example, a bank’s bank website. In the screen below, I redirected my traffic from pkobp.pl to wp.pl, the browser immediately picked up the trick. ?
   
4. 4. As a result, the network traffic is much lower
5. 5. Where would it be the “internet center” that tells us that the certificate is ok? The Internet is a distributed network and in the event of failure of one region with the current solution, everything works smoothly.

In summary

SSL / TLS, apart from and all protocols based on them, provide us not only with encryption between us and the server, they also make sure that the pages we visit are the ones we want to see. They are designed to immunize us as much as possible against attacks by hackers or dishonest administrators. The above examples were based on websites, but identical processes are used, for example, when sending e-mails, connecting to application servers, etc. and in each of these cases, we should use trusted certificates, even if they sometimes cost a lot of money. When writing the program, let’s not cut corners, an SSL connection without a certificate from a trusted provider is not worth much, because anyone can redirect our traffic anywhere, and our program will accept such a certificate anyway. Anyone can issue a certificate for any domain, but not everyone can issue a trusted certificate.

Anyone can set it up and use it, and you wouldn’t want to create an account here, would you? ?

The post What does it mean to have an SSL? appeared first on Yumasoft.

The event was divided into 4 thematic paths:

• – NET
• – Application Architecture
• – Cloud Computing
• – JavaScript

I was mainly interested in the .Net and Application Architecture paths.

Build your software on solid foundations (Application Architecture) – Marcin Bałda

Comparison of the process of building a house to creating software. The lecture was mainly devoted to discussing SOLID principles that allow for production of high-quality software. The author focused on the importance of the application skeleton design and building solid foundations for future functionalities. The lecture was based only on theoretical issues.

Useful links:
Lecture description – in Polish
https://scotch.io/bar-talk/s-o-l-i-d-the-first-five-principles-of-object-oriented-design

REST Services with AWS Lambda and .Net Core (.NET) – Marcin Bałda

Presentation of the capabilities of the AWS Lambda platform in .NET projects. The speaker showed that .NET also works well with cloud services other than Microsoft Azure. He built a small application connecting to the AWS cloud and introduced its basic functions, such as recognizing objects in images and categorizing them using artificial intelligence.

Useful links:
https://aws.amazon.com/blogs/compute/developing-net-core-aws-lambda-functions/

Ports and Adapters (Application Architecture) – Dominik Przybysz

A very interesting lecture on ports and adapters architecture and a comparison with the layered architecture, which is currently the most widely used. Thanks to ports and adapters, we can freely change the operation of the application, and also easily scale its individual elements. This architecture also allows us to freely divide a monolithic application into microservices, as well as cooperate with various data suppliers/recipients. During the lecture, Domain Driven Design concepts and suggestions on how to model the application using the DDD approach were also addressed.

Useful links:
https://github.com/alien11689/ports-and-adapters-example
https://en.wikipedia.org/wiki/Domain-driven_design
https://herbertograca.com/2017/09/14/ports-adapters-architecture/

Secure Domain (Application Architecture) – Dominik Przybysz

The lecture was about the most common mistakes programmers make when writing code. The author presented various situations where the programmer, knowing the assumptions of e.g. Clean Architecture, misinterpreted them so that the application was built on weak foundations and thus difficult to expand in the future. The speaker also presented tools that help create better code and better define application domains.

Useful links:
Video from the conference – in Polish

History of Asynchronous in .NET – Marcin Tyborowski

During the lecture, the author presented the history of asynchronous programming in .NET and discussed the pros and cons of different approaches.

• – Thread and Threadpool – the first approach to multithreading in .NET: creating threads is very expensive and without proper control we can easily cause memory leaks
• – APM – a very non-intuitive approach, because of which multi-threaded applications have become illegible to programmers without a solid understanding of multithreading; it does not work in .NET Core
• – Event-based asynchronous pattern – a much easier approach than APM, but still the code is very different from the synchronous code
• – Task Parallel Library – thread creation is fast, adding lambda expressions has greatly increased the readability of the code, but the code is still different from the synchronous code
• – Async / await – the final version of multithreading in .NET – easy, understandable and fast

Useful links:
https://tyborowski.it/history-of-asynchronous-in-net/
https://github.com/tbr09/Multithreading

Make your applications intelligent – short tutorial how you can add artificial intelligence to your apps (.NET) – Michał Jankowski

Overview of how you can quickly turn a simple application into an application that uses artificial intelligence, based on the example of creating a photo storage program. Thanks to the Cognitive Service, the cloud automatically recognizes unauthorized photos, such as pornographic material with approximately 99% efficiency. This significantly reduces the amount of work needed to check all photos. Cognitive Services also allows you to describe photos and thus categorize them. During the presentation the lecturer created a program connecting to Cognitive Services.

Useful links:
https://www.youtube.com/watch?v=IBCqHy27ndE
https://azure.microsoft.com/en-us/services/cognitive-services/

Clean Domain Model: Domain-Driven Design tactically and practically (.NET) – Kamil Grzybek

During the presentation, the lecturer discussed how to practically implement a clean domain model using DDD and C#. The author showed many examples of how to conduct a conversation about the proper domain of the application. During the presentation it was also shown how to avoid primitive types in the program and how to write unit tests correctly for code written in this way. During the presentation, a modular monolith created with the DDD principles was presented as a counterweight to currently very popular microservices, which are also used where they do not make sense.

Useful links:
Lecture slides – in Polish
https://github.com/kgrzybek/modular-monolith-with-ddd

The post The 4DEVELOPERS Katowice 2019 conference appeared first on Yumasoft.