Jul 24
Defcon MQ sequrity session
icon1 Niklas | icon2 Tags: , . | icon4 07 24th, 2007| icon33 Comments »

Looks like there is going to be a very interesting session on WebSphere MQ security at Defcon. The presenter is Martyn Ruks who has a history of investigating IBM protocols. As WMQ and WMQ security in particular is of great interest to me, this session sounds like something really worth visiting. Too bad I won’t be anywhere near Vegas at the time, and I’m assuming Defcon won’t publish any video of the presentations. However, Martyn has published a presentation he held at Defcon 14 so I keep my hopes high.

Based on the published abstract, it doesn’t sound like any real new attack will be shown, but rather that Martyn will go through the usual, poor ways that WMQ are set up from a security standpoint. Fact is that at most places I’ve seen WMQ installed it has been wide open to any attacker. Most companies seems to think that it’s used internally and therefore is safe. Besides, it’s pretty invisible to most people, just humming along doing its work. Hackers on the other hand most surely know about it and how to attack it. And those of us consulting on WMQ really needs to learn the best ways of protecting an installation. And, I do think that IBM needs to do a better job of securing WMQ out of the box, currently it’s unsecure by default, something which should not be acceptable these days.

Update: this presentation is now available over at Google Video.

Technorati Tags: , , ,

Jul 12

As has already been reported in several blogs, IBM has released a new supportpac for exposing WebSphere MQ queues and topics as HTTP resources. The supportpac aims at being RESTful, at least that’s what you are lead to believe from the banner on the main WMQ site.

However, much like the ActiveMQ REST support, the RESTfulness, or even basic HTTP compliance does have it’s rough edges.

The supportpac exposes a queue on a URL looking like http://example.com/wmq/msg/queue/FOO. On this resource, three basic operations is allowed:

  • POST: will push a new message to the queue
  • GET: will peek at the first message from the queue
  • DELETE: will pop the first message from the queue

Now, there are several problems here. For example, the GET and DELETE is done at the queue URL, but actually works on a different resource, the message. The way the DELETE is done, the expectation would be to remove the queue itself. And the GET should return some representation of the queue, such as a listing of the available messages. On top of this, DELETE must be idempotent, however in this case, doing multiple DELETEs will result in very different results (different messages being read). In addition, re-doing a failed DELETE (for example due to being in-doubt because of a network failure) could lead to multiple messages being lost (note that IBM makes it clear that this is the case).

All that being said, as been shown on rest-discuss lately, designing a queue with the standard HTTP methods is not entirely straight-forward and might lead to a both complex and odd (from a queuing perspective) API. Adding simplicity in the mix, and not supporting assured delivery, the design chosen in the WMQ supportpac might be understandable.

Besides the issues above, I think a big improvement to the API would be if it supported resource discovery. The examples below describe this, in addition to suggesting a better design for pushing, peeking and popping messages:

  • http://example.com/wmq returning a list of the available queue managers
  • http://example.com/wmq/myqm returning a list of the available destinations on that specific queue manager.
  • As discussed above, the http://example.com/wmq/myqm/queue/FOO resource should return a list of available messages on that specific destination. This resource also supports the POST as described above.
  • http://example.com/wmq/myqm/queue/FOO/nextmsg redirecting to the first message of the queue
  • http://example.com/wmq/myqm/queue/FOO/123456789 identifying a specific message and supports the GET and DELETE requests as described above.

In a comment on an earlier post here, James Strachan of ActiveMQ notes that he would like to design a fully RESTful API for ActiveMQ. Maybe that could be a chance to dive deeper into this interesting area.

As noted on the Hursley WMQ blog, IBM is looking for feedback on the code, so hopefully some of these issues could be taken care of.

Jul 12
Size matters
icon1 Niklas | icon2 Tags: , . | icon4 07 12th, 2007| icon3No Comments »

Sometimes it’s interesting just to watch the obvious differences between competing products:

The EJB3 feature pack for WAS: 767 Mb
The entire Geronimo installation: 75 Mb

Jul 9
Known from TV
icon1 Niklas | icon2 Tags: , . | icon4 07 9th, 2007| icon31 Comment »

Today, we had a house call from the major news show at the national Swedish television. They’re making a segment on kiva.org and wanted to interview us on why we choose to use it. The reporter found us from me and Eva blogging when first starting to use the site. Luckily, I managed to almost completely escape to camera, Eva took the biggest hit.

The topics of the questions focused on how we found Kiva and why one would choose Kiva over a more traditional poverty fighting organization. The also interviewed another guy in Stockholm, should be interesting to watch.

Should air on the news tomorrow, it will be interesting how their story ends up and how Eva looks on TV :-). The segment should appear online, I’ll add a link when it does. Okay, it aired today and is up on the web. Based on Eva’s face I really wonder what is on that screen :-)