Review: Harmony Link

When it was announced back in September 2011 I was quite excited about the HarmonyLink. I got one as a gift this Christmas and after some initial efforts with it, my enthusiasm is a little dampened, but I still think the device has a lot of promise. There are some serious flaws that need to be addressed by Logitech before it can replace my Pronto TSU 2000.

I was surprised that it didn’t use the same Harmony Desktop software that worked with the 659, then I got excited because it appeared to be web based. The model is log into website, configure your Devices and Activities on the web and sync to your device – nice. Sadly if you try to log into your account on myharmony.com from a non supported platform you get this message:

The following platforms are supported:

Microsoft® Windows XP or Vista with Internet Explorer 7+, or Firefox 3+

Microsoft® Windows 7 with Internet Explorer 8+ or Firefox 3+

Intel Mac OS® 10.4.8+ with Firefox 3+ or Safari 4+

The reason for this is they use a custom browser plug-in to do the initial setup of the device. This sort of makes sense, as the HarmonyLink is a wifi device that needs to be told how to connect to your wireless network. The initial setup seems to be the only time you’ll need the USB cable provided. I also found it a bit uncomfortable being asked by a website to enter my WPA2 password.

Logitech could have made things much simpler. Provided a very simple utility on Windows and Mac OSX to do the device initialization. Of course you need to program the device to enable it for your wireless network, they have all the code they need to do this in a reasonable manner so it seems like just a dumb design decision to include it as part of the browser plugin.

Security fail: The website myharmony.com also wasn’t able to accept a < character in my password. It gets better, the Android app (and apparently the iOS app too) doesn’t remember your password. So you need to type it in from time to time. Strike two for password security. They do require at least 4 characters, I can think of some great four letter words that might fit. So the user is torn between using a strong password or a convenient one. Everyone who might want to use the remote may need to know the password, that’d be strike three on their security story.

Setting up the devices was pretty reasonable, it does require that you know the model numbers of your equipment but will provide suggestions if you’re close to the right name. I had trouble locating the IR4PS3 device (for control of the PS3) in the device database, I ended up succeeding by entering Sony as the manufacturer and IR4PS3 as the model – then the correction offered by the website (IR4PS3/IR4PS3) worked.

The remote is setup around the idea of Activities, such as “Watch TV”. This is a bit different than the flow I have setup with my Pronto so it’ll take some getting used to. They have three basic activities: Watch TV, Watch Movie, Listen to Music. You can have multiples of one type of activity and give them unique names, but they provide only 4 icons – which is very silly given how easy it should be to have many different icons.

They very first time you connect to the HarmonyLink using your Android or iOS device running the remote control app, you’ll likely have a firmware update and a sync of your data from the web. The Android app hung on me during the firmware update leaving me waiting and waiting. It required a reboot of my Android tablet and I was back in business.

I haven’t warmed up to the Android version of the app yet. The power off path wasn’t immediately obvious to me, I’ll have to see how others that get a chance to use the remote once I shake out all the major issues react to it. Responsiveness to button presses is pretty good, there doesn’t feel like there is any appreciable lag. You can edit the button layout, with the exception of the 4 way navigation pad which seems fixed (this is unfortunate as the IR4PS3 mapping for ‘ok’ doesn’t map to X).

I was disappointed to discover that there wasn’t a web UI on the HarmonyLink itself. You must use a supported device (Android, iOS) and run the app. I’ll need to break out Wireshark and take a look at what needs to be done to fix that.

As I started with, I’m still optimistic this is going to be a nice addition to my home theatre – but only once they address some of the shortcomings. Engadget gathered a long list of great comments which felt pretty much on target. There is also a suggestion thread in the Logitech forums. I hope Logitech is listening.

Review: CitiGeeks.com screen protectors

I used to be one of those that strongly believed screen protectors were not worth the money. Over time I had a series a devices which I carried with me daily with no screen protection, sure after a year or two I’d inevitably end up with a small scratch but at that point the value of the device had dropped significantly anyways. The cost of screen protectors seemed outrageous, you could buy from a brand name and pay a big price – or opt for the super cheap knock offs from eBay. I assumed the cheap ones were not worth the money as the name brand ones were 10x more expensive.

The first phone I had with a screen protector was the NexusOne. It came to me with a Zagg invisibleshield installed. The invisibleshield model was one of the ones with the self healing property and had a slightly mottled surface. This felt a little different than a naked screen, your finger had a little drag. It was easy to get used to this. I never bothered to remove the screen protector during the time I had that phone.

Readers of this blog will know that the next phone I had was an HTC Desire. This came with no screen protector. The screen showed a few tiny (nearly invisible) scratches in the Gorilla Glass screen. The scratches were not enough to bother me in day to day use. When I bought a case for the phone from eBay, a cheap screen protector came along with it. I wrote back then that I was pretty impressed with the screen protector as it felt exactly like the screen.

My current phone is a well used Samsung Galaxy S Vibrant (i9000m). It’s got a few nicks and dings, and a handful of fairly deep scratches on the screen. Honestly you don’t notice them in normal use, but you can see them if you look up close as should be evident in the picture below. This is the lower part of the phone close up, a lamp is reflected off the screen but hopefully the scratch marks are clear (a deep one is centered, about 1/4 down from the top).

While I liked the case, it added a lot of bulk to the HTC Desire. This round I decided against a case but thought a couple of bucks was worth getting some screen protection. A screen protector can also help hide some of the existing scratches on a screen (true from my experience).

After looking around a little, I decided on an anti-glare screen. The cost was a little bit more than the clear ones, but less than a cup of coffee more. The youtube video demonstrating it also looked pretty cool. I made the purchase from eBay, but it turns out CitiGeeks has a web store and is based in Canada.

The packaging looked professional and included their logo. What was inside is pictured below.

You get the screen protector, a small card that you use to prevent air bubbles when installing, and a cleaning cloth. They have very good installation instructions on their website, and a youtube video which is very helpful.

The resulting installed anti-glare screen looks very good on the phone, turning it into a matte black surface when off. You can see the anti-glare properties in the photo below giving a soft halo reflection of the light. It also does a reasonable job hiding some of the small scratches, but not the deeper ones. Again, during normal use you don’t see any of the scratches.

I wouldn’t recommend the anti-glare screen having used it for a while. It does cut down on glare, but I find it adds a strange sparkle effect to images. If you look at the picture at the top of this post the right side of the image shows some of this as a multi-color graininess. This is difficult to capture in a picture, but is quite distracting in some situations.

I will recommend CitiGeeks. They provided a 20% discount coupon for my next order (if you search for this coupon online you should be able to find it easily). They also have pretty good email support, even at off hours. When I got my Galaxy Tab, I bought a crystal clear protector for it using the coupon and was able to get a better price than eBay. The clear screen protector is completely invisible, I had two Galaxy Tabs next to each other – one with a protector and one without – you could not tell the difference.

Low cost screen protectors do work well, and pay for themselves with the peace of mind they provide you when you accidentally toss your car keys into the same pocket as your phone. Should you get one? I think it’s still personal preference, I’m sold on them but only if I can get them at very low cost.

Ubuntu Apache2 “trusted” SSL Certificate from StartSSL

I own the domain lowtek.ca and host a couple of personal projects as well as this blog on it. One of the areas is behind a password and that part of the site I redirect over to https to ensure that the communication is encrypted. While the whole Certificate Authority infrastructure has currently become questioned, the value of having a SSL connection between your browser and (hopefully) a specific destination machine still has value. I found a humorous youtube video that describes SSL basics if this is new to you.

If you were watching the tech news, you’ll have seen several of the CA’s had security breaches. Even StartSSL which this post will talk about using had some issues, but it seems that it wasn’t as bad as the others. There has even been some research into how to attack / break SSL entirely. The web is a scary place if you think too much about this stuff. Today SSL is the most convenient web security story there is, and for the most part it works well enough.

For most people hosting personal websites the simple path is to use a self signed certificate.  The one downside to this is that whatever browser you are using will not recognize the certificate as valid, you’ll either be prompted to download and remember it – or just trust it for this one session. The manner in which browsers trust commercial web sites https connections is the certificates are issued by one of the root CA’s (Certificate Authority). The CA is a trusted 3rd party which the browser can check with to validate the certificate the website is offering up.

Ubuntu has some guides on creating certificates. What I’ll try to do here is provide a specific example of using StartSSL to generate a free certificate that is accepted by most web browsers. Much of the details come from another blog that I referenced when creating my StartSSL certificate.

You’ll probably want to use FireFox. The web interface at StartSSL.com can be a bit finicky and FireFox is known to work – I used the somewhat old 3.6.25 version. Of course the first step is to sign-up and create an account on StartSSL. They use email confirmation and my greylisting caused a bit of a hiccup here, waiting a few minutes and resubmitting the sign-up succeeded just fine. Then there will be a wizard that takes you through the rest of the sign-up process.

At the end of your account sign up you’ll be encouraged to back up the client certificate that has been installed into your browser. As I understand it, they use the client certificate as a form of authentication that it is really you they are connected to. The FAQ has details on backing up the client certificate. If for some reason you lose your client certificate they have a FAQ for that too.

Next we want to return to the “Control Panel” and use the “Validations Wizard” to do the “Domain Name Validation”. This will require another email validation to ensure that you are the owner of the domain (you’ll need to be able to receive email for that domain).

Now we can actually create a certificate. There are pay options for certificates, but we want to use the free version. Use the “Certificates Wizard” to create a “Web Server SSL/TLS Certificate”. Again I’ll reference the very useful blog post from jasoncodes.com that describes this set of steps (I will replicate here for completeness).

The first step of creating a certificate we can skip, as we plan to create our own Certificate Signing Request (CSR) locally. Execute the follwoing on your server, obviously replacing mydomain.ca with your domain name:

openssl req -new -newkey rsa:4096 -days 380 -nodes -keyout mydomain.ca.key -out mydomain.ca.csr

There will be several questions posed to you during this, here is a dump of the questions and some example answers:

Country Name (2 letter code) [AU]:CA
State or Province Name (full name) [Some-State]:YourStateOrProvince
Locality Name (eg, city) []:YourCity
Organization Name (eg, company) [Internet Widgits Pty Ltd]:SomeName
Organizational Unit Name (eg, section) []:
Common Name (eg, YOUR name) []:mydomain.ca
Email Address []:secret_email@mydomain.ca

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

Some of the answers can be blank as should be evident above. If you’re having trouble with the 2 letter country codes, check on wikipedia. I did find a reference that suggested that the common name must exactly match the host name of your server, you might note that I’m not using a www prefix here. This will allow me to re-use this same certificate for email and other things in theory, it also follows the no-www approach. I opted to leave the challenge password blank.

The second step of the wizard on StartSSL for creating a certificate will ask for a cut & paste of the mydomain.ca.csr we just created. Paste the entire contents of the file in, and move on to the next step where you should see that the request was received.

Moving along the next step is to “Add Domains”, since we’ve only validated one domain this should be easy. As part of this process it will ask for one sub domain. I used “www” since that will still resolve correctly to the lowtek.ca domain.

The remainder of the steps should be straight forward, you’ll arrive at the “Save Certificate” screen. You’ll want to save three things: 1) Text box contents as mydomain.ca.crt, then save-as the 2) intermediate and 3) root CA certificates (last two should be sub.class1.server.ca.pem and ca.pem respectively).

Now we need to install into Apache2. I’ll assume you’re running Ubuntu.

We’ll start by copying the .crt and .pem files we saved from the final step on StartSSL into the /etc/apache2/ssl directory. We also want the .key file that was created when we made our CSR copied to the same directory.

Again I must credit jasoncodes.com, this is almost verbatim from his site. Run the following as root.

cd /etc/apache2/ssl
mv ca.pem startssl.ca.crt
mv sub.class1.server.ca.pem startssl.sub.class1.server.ca.crt
cat startssl.sub.class1.server.ca.crt startssl.ca.crt > startssl.chain.class1.server.crt
cat mydomain.ca.{key,crt} startssl.chain.class1.server.crt > mydomain.ca.pem
ln -sf mydomain.ca.pem apache.pem
chown root:root *.crt *.key *.pem
chmod 640 *.key *.pem

Now we need to modify the apache config file /etc/apache2/sites-available/ssl and add the following within the <VirtualHost> block:

SSLEngine On
SSLCertificateFile /etc/apache2/ssl/mydomain.ca.crt
SSLCertificateKeyFile /etc/apache2/ssl/mydomain.ca.key
SSLCertificateChainFile /etc/apache2/ssl/startssl.chain.class1.server.crt

Check that your Apache config parses as valid:

apache2ctl -t

And then restart Apache with the new config:

sudo /etc/init.d/apache2 reload

Here is the the verification process verbatim from jasoncodes.com:

Run the following after restarting Apache to check the certificate chain:

echo HEAD / | openssl s_client -connect localhost:443 -quiet > /dev/null

You should see something like:

depth=2 /C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Certification Authority
verify error:num=19:self signed certificate in certificate chain
verify return:0

A depth of 2 and a return value of 0 is good. If the certificate chain is wrong, you’ll probably see something like:

depth=0 /description=12345-ABCDEF123456/C=XX/O=Persona Not Validated/OU=StartCom Free Certificate Member/CN=host.example.com/emailAddress=hostmaster@example.com
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 /description=12345-ABCDEF123456/C=XX/O=Persona Not Validated/OU=StartCom Free Certificate Member/CN=host.example.com/emailAddress=hostmaster@example.com
verify error:num=27:certificate not trusted
verify return:1
depth=0 /description=12345-ABCDEF123456/C=XX/O=Persona Not Validated/OU=StartCom Free Certificate Member/CN=host.example.com/emailAddress=hostmaster@example.com
verify error:num=21:unable to verify the first certificate
verify return:1

I was pleased to see that it all verified correctly for me. Visiting https://lowtek.ca resulted in a green lock icon under Google Chrome.

The StartSSL certificate expires in 1 year, so next year around this time I’ll be doing the same process. There is another CA (AffirmTrust) I came across that offers free 3 year certificates, I have no experience with them but would be interested to hear if anyone tries them out. There is CACert as well, but it doesn’t appear to be included in any of the browsers – limiting the usefulness of a certificate from them.