Groovy, Twitter, and Basic Authentication

The other day, Scott Davis published an article at developerWorks entitled Practically Groovy:  SwingBuilder and the Twitter API, Part 2.  I’m sure you won’t be surprised to hear that it’s a good article.  No surprise there, given Scott’s excellent reputation and abilities.

As it turned out, though, I was teaching a Java Web Security class when the article came out and we’d already discussed mechanisms for doing authentication.  In the article, Scott pointed out that while Twitter prefers OAuth authentication (see here for details), they allow for HTTP Basic authentication.

Scott wrote a nice Groovy GUI client, based on Groovy’s excellent SwingBuilder.  The authentication part looked like this:

def authString = "username:password".getBytes().encodeBase64().toString()
def conn = addr.toURL().openConnection()
conn.setRequestProperty("Authorization", "Basic ${authString}")

The process starts with a username and a password and concatenates them together with a colon in the middle. Then you convert the result into a byte array by calling getBytes(). Then, as you can see from the GroovyDocs, Groovy adds an encodeBase64() method to byte[]. The return type is a Writable, which is then converted back to a String using the normal toString() method.

Add the word “Basic” in front of it and you’ve got an authorization header that can be used in an HTTP request.

Okay, that’s cool, and it works, but whoa is that dangerous. Say I’m a sniffer on the network. I see a request go by, and inside it I find:

Authorization: dXNlcm5hbWU6cGFzc3dvcmQ=

We now have a beautiful illustration of the difference between encoding and encrypting. Just because this is Base 64 encoded doesn’t mean it can’t be read. All I have to do is write:

def (user,pass) = new String("dXNlcm5hbWU6cGFzc3dvcmQ=".decodeBase64()).split(':')

and lo and behold, I’ve got the username and password. This works because Groovy gives the String class a nice, convenient decodeBase64() method, and String has a constructor that takes the resulting byte array as an argument. I’m also using the new (as of Groovy 1.6) mechanism that allows me to return two separate values from a method call, so here I return the username and password separately from the split() method.

Of course, the real reason this works is that HTTP basic authentication passes the encoded string in nice, clear text. No decryption is required. If this was being transmitted over HTTPS, at least the network would be encrypted, but there’s no requirement for that.

Yikes. I’d guess the Twitter web site itself uses form authentication over HTTPS, but I wonder how many of those client-side Twitter applications are just doing basic authentication like this?

Maybe I should change my Twitter password.

Just for reference, here’s a complete script showing both encoding and decoding, with some assertions for completeness:

def u = 'username'
def p = 'password'
def encoded = "$u:$p".getBytes().encodeBase64().toString()
println "$u:$p -> $encoded"
assert encoded == 'dXNlcm5hbWU6cGFzc3dvcmQ='
def (user,pass) = new String(encoded.decodeBase64()).split(':')
println "(user,pass) = ($user,$pass)"
assert user == u
assert pass == p

Live blogging World Series Game 4: Yankees/Phillies

11:48 pm: It’s over.  The Yankees win 7-4, as the Phillies hit three balls to Mark Teixeira, the best fielder the Yankees have.

Cliff Lee now has to save the Phillies season.  Even if he does, though, it’s hard to imagine the Phillies beating the Yankees three straight times.  That just doesn’t happen in the playoffs.

Except in 2004, of course. 🙂

Johnny Damon made himself a ton of money tonight.  His arm is dead, his range is lousy and getting worse, and his hitting is fading badly.  But he turned a single into essentially a triple at a critical time in the World Series, so somebody will give him a big contract this off season.  I only pray it’s not the Sox.

As I’ve said before, I root for several ex-Sox: Nomar, Pedro, even Manny.  But I will never, ever forgive Johnny Damon.

11:44 pm: The irony is that assuming Rivera can hold a 3-run lead (and we’ll have major news if not), then the win actually goes to Joba, who gave up the tying run.  Yeah, that’s fair.

11:41 pm: Posada singles home two runs and is tagged out trying to stretch it into a double.  But now it’s 7-4 Yankees.  The game, and very probably the series, is over.

11:38 pm: A-Rod doubles, as he has all this post-season.  It’s now 5-4 Yankees.

11:37 pm: And he hits Teixeira!  Now we have runners on the corners with two outs.  We now have A-Rod up.

The funny part is, if A-Rod fails here, he’s a choker, but they’ll conveniently forget that Jeter just struck out himself.

11:35 pm: Damon stole 2nd, then saw that nobody was covering 3rd (because of the defensive shift for Tex) and just about walked there.  Now a wild pitch is a disaster.  Lidge has to be careful with his breaking ball.

11:33 pm: Lidge goes full count against Damon, too.  Damon fouls off 2 pitches and then singles.  Here comes Teixeira, which is not good.

11:29 pm: The guys at Baseball Prospectus are incensed that Girardi let his team blow a 1-run lead without getting either Hughes or Rivera into the game.  They hate the way so many teams manage to the save statistic.

Meanwhile, Lidge throws the same low strike that’s worked all game, but doesn’t get it against Jeter.  Instead the count goes full.  (And some people say baseball is boring.  As Joe Posnanski says, it is boring, and then it’s not.  That’s what makes it great.)

Lidge gets the K on Jeter.  Wow.

11:25 pm: Joe Buck is doing his best to reverse jinx Lidge by reciting all the bad statistics from this year (11 blown saves, etc).  We’ll see if it works.

It works on Matsui anyway, who pops to short.

11:23 pm: Here comes Brad Lidge.  As a Sox fan, I was very nervous this year every time Papelbon came in, and the playoffs showed I was right.  That is nothing, NOTHING, compared to what the Phillies fans are feeling right now.

11:21 pm: End of the 8th.  Talk about your true outcomes.  Joba goes K, K, HR, K.

(For those who don’t know, the “three true outcomes” are K, HR, and BB.  For each of them, the fielders might as well not have bothered to come out of the dugout.)

11:19 pm: Werth K’s on a high, inside pitch.  All fastballs from Joba.  Then Ibanez K’s too.

And just when it looked like Joba was going to strike out the side, Pedro Feliz takes a 3-2 fastball out of the park.  It’s tied again, 4-4.

11:13 pm: It’s Joba time!  Now anything can happen, from three straight K’s to three straight HR’s.

11:10 pm: Middle of the 8th. Ryan Madson takes over for the Phillies, against A-Rod, Posada, and Cano.

He K’s A-Rod without ever pitching him inside (where he’s supposed to be vulnerable).  He walks Posada, and then Cano drops a total bloop down the LF line between three fielders.  Bad, bad luck.

Swisher K’s on a very nice pitch that curved into the strike zone, and got Gardner to pop up to end the inning.

It’s Werth plus the bottom of the order in the 8th, hoping to score before Rivera comes in.

10:57 pm: Ryan Howard takes a strike on a off-speed ball, then a strike on a fastball strike.  Howard finally pops up yet another outside slider, and it’s inning over.  At the end of 7 innings, it’s 4-3 Yankees.

Now we get to see what the middle of the Yankees line up can do against the Phillies relievers.

10:54 pm: Utley crushes a ball into the stands and it’s a one-run game.  Yankees 4-3.  I was going to say that Girardi will probably let CC face Howard, since he still hasn’t done anything with the slider, but no, he’s gone.  That last pitch was a hanger, though, so that may have had something to do with it.

Now let’s see what Howard (and maybe Werth) can do with Damaso Marte.

10:50 pm: This has GOT to be the inning for the Phillies.  CC is almost done and the top of the lineup is up.

Two hard hit balls right at fielders (one to 3B, one to RF) and it’s two outs.  It’s time for Utley/Howard/Werth to win it.  Or not.

10:43 pm: Look, I read all the Sherlock Holmes stories as a kid, and again in grad school when I was trying to avoid my thesis.  I never remember him diving out of a window into the Thames.

10:41 pm: 7th inning stretch time.  CC bats to start the top of the 7th, so he’s definitely staying in, even after 95 pitches.  I guess Girardi really doesn’t trust his set-up men.  Makes you wonder, though, how easy it will be for CC to come back for a game 7.

Chan Ho Park comes in for the Phillies.

Jonah Keri points out that though Blanton looked good, he still gave up 4 runs in 6 innings.  He definitely thinks Lee should have pitched instead.

10:33 pm: End of the 6th.  Feliz moves to 2nd on Ruiz’s ground out, bringing in our first pitch hitter, Ben Francisco.  He flies out quietly to CF on the first pitch.  CC had now given up only 2 runs in 6 innings, and Rivera will pitch the 9th.  CC will no doubt start the 7th, too.  The window of opportunity is closing, especially if the Phillies left-handed batters can’t figure out how to lay off that low, outside slider.

10:30 pm: Gardner replaces Cabrera in CF when Cabrera pulls up lame running to 1B.  Better defense, but lousy hitter.  If the Phils don’t start hitting, though, it’s not going to matter.

Feliz gets on with one out, ensuring that the pitcher’s spot will indeed come up this inning.

10:25 pm: Middle of the 6th.  This time Howard really did catch the ball in the air (I think), but he flipped to Blanton anyway for the out.  McCarver is sure it short-hopped, but I thought it looked the other way.  Turns out it didn’t matter.

Swisher swung hard at ball 4, but Blanton walks him anyway.  Blanton gets Cabrera, though, to end the inning.

He’s up to 93 pitches, and the pitcher’s spot is due up 4th in the bottom of the 6th.  If the spot comes up, he should be done.  If not, well, they sent Pedro out for the 7th when they shouldn’t have…

At last, the Cialis commercials have started.  Bummer.

10:13 pm: End of the 5th, still 4-2 Yankees.  I’d never heard of a “quick pitch” before this series, but now it’s happening a lot.  Sabathia got Utley on one, apparently, pitching before he was ready.  Now it’s Howard’s turn to do something spectacular, but he pops up instead.  Sigh.

McCarver said that Jeter came out to Sabathia to make sure he wasn’t changing signs without letting Jeter know, but that’s not at all what it looked like he was saying.

Werth just missed crushing a pitch for another HR.  He strikes out instead.

Sabathia’s pitch count is now well into the 80’s.  He isn’t showing any signs of fatigue that I can see.  He’ll definitely go one more inning.  If it’s quick, maybe two.

10:04 pm: Maybe the problem is that I think of the strike zone as an absolute, when in reality it’s a probability distribution.  The two inches off the right side of the plate are a strike about 75% of the time.

(Keeping in mind that 80% of all statistics are made up on the spot, of course.)

10:03 pm: In case you’re wondering, the game moves a LOT faster when you’re live blogging it.

After 76 pitches, it’s now two on and nobody out for Sabathia.  This is a big opportunity for the Phils.  (I know — duh.  I plead too much exposure to Buck/McCarver.)

9:55 pm: Middle of 5th.  A-Rod hits a soft fly to end the inning.  An inside pitch very nearly hit him, though he didn’t try very hard to get out of the way.  At least we’re spared that controversy.

The Avatar movie is being hyped relentlessly.  I remember hearing that the initial trailer was very badly received.

Here’s the thing, though.  The greatest trailer I ever saw, and it was truly a work of art, was for Star Wars I: The Phantom Menace.  That just about sums it up.

9:54 pm: Blanton gets Tex to fly out, leading to A-Rod with two men on and two out.  If Blanton doesn’t get him, it probably doesn’t matter what the pitch count is.

9:51 pm: McCarver: “Lead-off walks always score.”  I never would have guessed.

That’s it — the Phillies outfielders are definitely playing too deep.  Damon bloops a single to make it 4-2 Yankees.

9:49 pm: Utley tries to make a spectacular flip to 2nd on a grounder by Cabrera but can’t do it.  Now Yankees have 1st and 2nd with nobody out, but Sabathia up.  Sabathia can’t get the bunt down, fouling the bunt with two strikes and bringing up Jeter.

Tweeps are understandably upset that Jeter won the Hank Aaron award ahead of Joe Mauer, but he singles here to make it 3-2 Yankees.

9:44 pm: Ugh. Swisher walks on 4 pitches, though two of them were arguable strikes.  The zone is definitely low, but I can’t tell if it’s outside or not any more.

9:42 pm: I don’t understand why the Yankees didn’t tag Howard anyway, if they thought he missed the plate.  Sure, Posada threw to 2nd to try to stop the advance, but they could have thrown back, right?  After Posada threw would have been a good time for Howard to go back and touch the plate, too.

9:40 pm: End of the 4th, tied 2-2. McCarver mentions that Feliz is slumping against left-handed pitching, so naturally he lines the next pitch for a single.  Howard challenges Damon’s arm (of course) and beats the throw, assuming he ever touched the plate, which he probably didn’t.  Feliz takes 2nd on the throw.

Then an intentional walk, but it’s to get to the pitcher so maybe that’s okay.  Blanton obliges by striking out on 3 pitches.

Howard finally gets a hit.  Sabathia tried yet another slider, but this one got a lot of the plate.  Then he actually stole 2nd when Posada, clearly surprised, couldn’t get the ball out of his glove.  So the lead-off hitter is on 2nd with nobody out.

In the manager interview, Girardi says C.C. could go 100 to 120 pitches.  But the real question is whether he’ll be able to control them as he tires.  We’re up to 66 pitches after 4 innings.

9:26 pm: Middle of 4th.  Blanton looks great and has only thrown 44 pitches.

McCarver says Posada couldn’t argue his strike three call because he has to get behind the plate and hope for consistency, but maybe he didn’t argue because it was a strike.

A-Rod flies out, to a big cheer from the crowd.  Apparently he annoys Phillies fans as much as Sox fans.

So we have a commercial based on Wayne’s World (at least 20 years old) and one based on Lassie (double that or more).  Either the advertising people are old, or they think the target audience is old.  I guess that figures, since the kids can’t make it to the end of the game. At least the Cialis commercials haven’t started yet.

9:18 pm: End of 3rd.  Joe Buck reminds us that lead-off hitters are important.  It’s that kind of insight and analysis that makes a World Series announcer.

Teixeira makes another good defensive play at 1B.  After watching the travesty the Yankees got from their first basemen last year, it’s been remarkable watching Tex this year.  Unfortunately.

This inning the high pitches were strikes.  Maybe the ump has a dinner date tonight.

1-2-3 inning for Sabathia, who has thrown 46 pitches after 3.

9:10 pm: End of 2 1/2.  Great play by Feliz on the Jeter grounder to 3rd. I love the fact that they said yesterday that Pedro Feliz has the most accurate arm of any 3B in the league.  That’s a great asset to have.

Another ball call on a strike, followed by a strike call on a ball.  Make up call or just incompetence?  You decide.  Actually, it looks like this ump has a very low strike zone that extends about 2 inches outside, too.

9:00 pm: End of 2nd. Jonah Keri points out that C.C. is getting 15 mph separation between his fastball and his slider.  That’s a lot.  We’ll see if he can maintain it as the innings add up.  The Phillies really need to be patient to let the pitch count climb.

The game is moving right along.  I expect it to really drag later, especially when the Yankees’ manager (Girardi) starts shuffling relievers.  The key for the Phillies is to get C.C. out of there early enough that they can crush the bullpen before Rivera comes in.  The opposite is true, too, except that the Yankees are probably salivating at the prospect of seeing Brad Lidge in a close game.

8:55 pm: Middle of the 2nd. Blanton gets the outs despite the fact the Yankees are making solid contact.  The hard hits are going to right, and easy flies are going to left.  Again, small sample size, but we’ll see if it holds.

You also knew the FOX dweebs would find a way to promote Brett Favre again.  I expect to hear about him at least a dozen more times before the night is out.

8:47 pm: That outside slider is still getting Phillies out.  2-1 Yankees at the end of 1.

The pitch count is adding up for Sabathia.  Of course, Pettitte had over 50 pitches after two innings yesterday, and we know how that worked out.

The idiot in the new Windows 7 commercial makes me want to buy a Mac.  That’s not good.

8:45 pm: Ouch.  Another K for Howard.  That was a really, really good pitch, though.  The ump’s strike zone is low and outside, and so was that pitch.  No way he could take it.

If they actually intentionally walk Werth, Joe Posnanski’s head will explode.  McCarver thinks they only reason they don’t do it is because it’s still the first inning.  The real reason not to do it is that it’s stupid.  Intentional walks are almost always a bad idea, and this would be no exception.

8:42 pm: Utley doubles home Victorino, and it’s 2-1 Yankees, bringing up Ryan Howard.  TV lives on small sample sizes (tiny in this case), so they keep bringing up the possibility of another K.

Posada is jumping around to catch Sabathia, implying C.C. is having trouble finding his targets.  We’ll see if he settles down.  Maybe both managers were wrong — Lee should be in there, and C.C. shouldn’t. 🙂

8:31 pm: End of the top of the first, 2-0 Yankees.  I liked the way the throw from left field hit Damon in the head.

Baseball is such a game of inches.  Utley made a great grab of that lead-off hit by Jeter, but slipped when he tried to get up to throw him out.  If he makes that out, it might have been a different inning.

8:30 pm: “The opening pitch was brought to you by ….”  The stupid promotions begin.

A-Rod plunked again.  McCarver thinks it was an accident, but it’s the third time in two days.  The umps warned both sides, so no obvious pay back.  We’ll see what the Yankees do anyway.  They certainly can’t afford to have Sabathia thrown out.  Advantage Phillies, other than the fact A-Rod is now on base.

8:20 pm: Tim McCarver thinks the Phillies should have pitched Cliff Lee on short rest, so not doing so must be the right move.

Okay, just because he says it doesn’t mean it’s automatically wrong.  But it’s awfully likely to be wrong.

The people I follow are split on the decision.  Lee has never gone on short rest before and this is a big stage to do it on, but the Phil’s really can’t afford to lose this game.  Sabathia will be going on three day’s rest.  We’ll see how that works out, too.  If the Phillies don’t hit, it won’t matter much.

(By the way, don’t expect me to keep updating this frequently.  I’ll settle into more of a rhythm as time goes on.)

Also, if you want to contact me, I’m available at .

8:15 pm: In case you’re interested, I’m in downtown Parkersburg, WV this week, teaching an Intro Java class.  I haven’t taught Intro Java in years, but the class was available when I was still in my, “there’s a recession going on so say yes to everything” mode.  It should be an interesting experience, though.  I plan to get a fair amount of work done on my book (“Making Java Groovy,” coming soon from O’Reilly) this week as well.

8:05 pm: Isn’t waving a white towel supposed to mean you surrender?  That bothers me.  Maybe I’m just being a curmudgeon.

Another horrible thing about FOX’s coverage of baseball is the way they desperately try to find sponsors for everything.  This whole “introduce the game and hype Avatar at the same time” thing is truly annoying, and they’re just getting started.

8:00 pm: Jonah Keri’s live blog of game 4 can be found at .

7:50 pm: In general, MLB announcers are the best announcers in any sport.  They’re clever, know the game, and are used to telling stories when they have time to fill.  I’ve been very fortunate that the local Red Sox announcers are particularly good.

NBA announcers are usually good as well.  I don’t watch as much basketball, at least not until the playoffs, because I get very frustrated by my inability to tell what a foul is anymore.  Still, Hubie Brown is great, and he’s not alone.

College basketball announcers tend to be solid, once you get past the rah-rah ones (and mute Dick Vitale).

The NFL has a handful of good announcers, like Troy Aikman and Chris Collinsworth, and a lot of really bad ones.   The transition from baseball season to football season is always such a drop in announcer quality, but so be it.

College football announcers should never be allowed near a microphone, with the possible exception of Bob Griese.  They are simply horrible, living off one cliche after another, most of which are just wrong.

And yet, with all the great baseball announcers out there, once we hit the World Series we’re saddled with the travesty that is Joe Buck and Tim McCarver.  I just can’t understand how either got the job, and I really can’t imagine how they keep it.  Blech.

Most of this night I’ll watch with the sound muted, but I’ll be forced to unmute occasionally.  That’ll no doubt generate more posts here.

7:30 pm: Two factors have increased my enjoyment of the World Series this year.  First, two of my favorite baseball writers, Jonah Keri and Joe Posnanski, are “live blogging” each game, though I really only follow Jonah Keri’s.  Second, Twitter has really broken through to the mainstream.

That deserves it’s own paragraph.  I joined Twitter (@kenkousen) a long time ago, but didn’t do anything with it for the longest time.  Then, to my surprise, I discovered that almost the entire Groovy and Grails core teams were there, and that they tweeted all the cool things they were doing on a regular basis.  I suddenly had a community to follow, and that made all the difference.

As Twitter grew and grew, I slowly added people I enjoyed following.  By now there are several baseball people I like there, like both the above mentioned guys and lots of others (@JPosnanski, @robneyer, @keithlaw, @joe_sheehan, and @jonahkeri).  They’re so much better than listening to the inanities of Joe Buck and Tim McCarver on FOX, who should never, ever be allowed to broadcast a baseball game.  They’re a complete travesty.  Thank goodness I now have an alternative!

A note on how I’m going to handle the “live” aspect of this blog.  I’m going to continually edit this post, but I’ll actually go through the motion of posting it, in the wildly unlikely event that anybody wants to follow me on it.  We’ll see how that works out.

%d bloggers like this: