Finally, Jamil asked an extremely relevant question, given the state of the web game market - is it possible to get an ‘AAA game experience’ through the web interface?

Pardo was blunt: “I dunno, not until Microsoft, Intel, and Apple get their shit together. There’s such a dichotomy with hardware these days. With Microsoft, I think they have a bit of lip service with PC gaming. They have their own game system now, so I don’t think it’s really in their best interest to support [PC].”

However, he noted: “There’s been some Apple resurgence, so maybe Dell and Apple will get together and make a consumer box that has a decent graphics card in it, who knows? I do think it’s going to happen, but I wouldn’t be surprised if it doesn’t happen with Microsoft.”

Without commenting at all about Apple’s stance on this, it is obvious to me that if Apple continues to increase their market share as current public data indicates, there’s going to be a shift of mentality in game studios still interested in developing for the PC platform. They’re going to seriously start looking at those millions of Mac customers who may have an available budget for the games they make. Of course, part of those customers are already buying those games thanks to Boot Camp, but there is an economic and psychological argument to be made that Mac versions of those games would get you an even larger share of that growing market.

It’s also interesting to note that Apple’s market is closer to that of consoles, in the sense that hardware diversity is much lower and there is greater integration between the OS, the software that runs on that OS and the hardware on which those two run, while retaining some of the advantages of the PC, such as less control from the hardware manufacturer (which Pardo cites as a problem for WoW content patches), the ubiquity of a pointing device and keyboard, more storage space, more mature development tools and the ability to develop and test on the same hardware.

Creating a certificate authority

Although I haven’t tested a self-signed CA certificate as the SSL server’s certifiate, reading around the web suggests it will not make Firefox 3 happy. Since it doesn’t cost all that much time to do it, let’s generate a certificate authority.

1. Open Keychain Access
2. I’ve had issues with Certificate Assistant using my login keychain, so to avoid any problems, create a new keychain for certificates.
3. 
   Use the Create a Certificate Authority… command from the Keychain Access > Certificate Assistant menu.
4. 
   Enter the name of the CA certificate, select Self Signed Root CA as the type and make sure the Let me override defaults checkbox is checked.
5. 
   Enter the desired serial number and validity period. Firefox 3 will actually remember certificate serial numbers and reject a new certificate with the same serial number as a previous certificate (coming from the same authority, that is), so make sure you’re keeping track of serial numbers.

   The User Certificate Type must be set to SSL Server.

   The other settings are for generating a pretty CA web page to let people make certificate requests for your new authority (you may want to use that), and to sign your certificate invitation.

6. 
   Enter the basic contact information for the CA certificate. The Name (Common Name) field doesn’t have to be a valid domain name, since the CA certificate won’t be used by any server.
7. 
   The default values for this step are fine.
8. 
   This step allows to specify default key pair settings for any leaf certificate you create with the CA certificate as the root. The default values are fine.
9. 
   The CA certificate must have a Key Usage Extension with at least the Signature and Certificate Signing capability bits set. If either one of those capabilities are not specified, Firefox 3 will reject any child certificate of the CA certificate.
10. 
    This step allows to specify default key usage extension settings for any leaf certificate created with the CA certificate as the root. SSL server certificates must have at least the Key Encipherment and Key Agreement capability bits set. If either one of those capabilities are not specified, Firefox 3 will reject the certificate.
11. 
    Although documentation suggests this may not be necessary, giving the CA certificate an extended key usage extension with at least the SSL Server Authentication capability bit set has no serious consequences and provides additional insurance that Firefox 3 will be happy. Note that the default value is All, which should include SSL Server Authentication, but again no harm done in being pedantic.
12. 
    This step allows to specify default extended key usage extension settings for any leaf certificate created with the CA certificate as the root. SSL server certificates must have at least the SSL Server Authentication capability bit set. If that capability is not specified, Firefox 3 will reject the certificate.
13. 
    The CA certificate must have a basic constraints extension with at least the Use this certificate as a certificate authority option specified. If it is not, Firefox 3 will reject any child certificate of the CA certificate.
14. 
    This step allows to specify default basic constraints extension settings for any leaf certificate created with the CA certificate as the root. SSL server certificates must not have the Use this certificate as a certificate authority option specified (while having a basic constraints extension). If the extension is missing or that option is specified, Firefox 3 will reject the certificate.
15. 
    Any certificate with the SSL Server type must have a subject alternate name extension specifying either the dNSName field or the iPAddress field. Obviously there are no special constraints on the value of either of those fields for the CA certificate.
16. 
    Again, any certificate with the SSL Server type must have a subject alternate name extension specifying either the dNSName field or the iPAddress field. The value of those fields must match the domain name or IP address which clients will use to contact SSL servers using any child certificate of the CA certificate. Obviously, we will have to override this value when creating each such child certificate unless we’re creating them for the same server all the time. Nevertheless, Certificate Assistant requires a value to be specified to continue, so provide a reasonable default.
17. 
    Select the keychain in which the CA certificate will be stored. If you want browsers using Keychain Services to accept child certificates of the CA certificate, check the On this machine, trust certificates signed by this CA checkbox. Note that, as the label implies, this will affect the trust setting for the CA certificate for the entire machine, not just your specific system user. Consider the consequences of that choice carefully. It is possible to change trust settings on a per-user basis.
18. 
    Success!

We can finally appreciate the fruit of our labour. Double-clicking the CA certificate in Keychain Access will allow you to confirm that all the required settings, options and capabilities are properly configured. It should look like this:

Creating a SSL server leaf certificate

I will not repeat the entire sequence of operation presented for the CA certificate, but rather focus on the steps that are specific to the creation of a SSL server leaf certificate. Make sure to keep in mind the various restrictions mentioned above concerned leaf certificates, since we have to override the default values we specified during the creation of the CA certificate and Certificate Assistant is not nice enough to fill in those defaults .

1. 
   Use the Create a Certificate… command from the Keychain Access > Certificate Assistant menu.
2. 
   Enter the domain name that clients will be using to access the SSL server as the certificate’s name, and choose Leaf as the certificate type. Make sure to check Let me override defaults since we need to edit some of the certificate’s settings from the defaults we specified earlier.
3. 
   Enter a serial number different than that of the CA certificate and different than that of any other leaf certificate you have already created, even if they were for the same domain. Firefox 3 checks and keeps track of certificate serial numbers and will reject a certificate re-using a serial number. Also make sure that the certificate type is set to SSL Server, otherwise Firefox 3 will reject the certificate.
4. 
   The Name (Common Name) field must match the domain clients will use to connect to the SSL server, otherwise Firefox 3 will reject the certificate.
5. 
   Select the CA certificate created earlier.
6. 
   SSL server certificates must have a key usage extension with the Key Encipherment and Key Agreement bits set. If they are not, Firefox 3 will reject the certificate.
7. 
   SSL server certificates must have an extended key usage extension with the SSL Server Authentication bit set. If it is not, Firefox 3 will reject the certificate.
8. 
   SSL server certificates must have a basic constraints extension with the Use this certificate as a certificate authority option disabled.
9. 
   SSL server certificates must have a subject alternate name extension with either the dNSName field or the iPAddress field specified. The values for those fields should match what clients will use to connect to the SSL server. In order words, the value for the dNSName field should match the value of the Name (Common Name) field of the certificate (specified in step 4) and the value iPAddress field should match the IP address to which the dNSName domain resolves.
10. 
    Success again!

We can once more appreciate the fruit of our labour. Double-clicking the certificate in Keychain Access will allow you to confirm that all the required settings, options and capabilities are properly configured. It should look like this:

Going from the keychain to Apache

As a common scenario, here’s the straightforward way to export certificates stored in a keychain in a format suitable for Apache’s mod_ssl.

1. Select the desired certificate from the Certificates or My Certificates category in Keychain Access (with the containing keychain selected, of course). The certificate item should have a disclosure triangle which once expanded will reveal the certificate’s private key. Indeed, we need to export both the certificate and its private key.
2. Use the File > Export Items… command.
3. 
   Use the Personal Information Exchange (.p12) format to export the certificate.
4. 
   Although you provide a password with which to encrypt the private key, since Apache requires it to be unencrypted in order to start automatically, simply don’t provide any password. You may want, however, to choose a secure export location, such as a private temporary folder that doesn’t get backed up by Time Machine or an encrypted disk image.
5. Open Terminal.
6. Run the following commands to export the certificate and the private key (unencrypted) to OpenSSL’s PEM format which mod_ssl requires.

   openssl pkcs12 -in example.com.p12 -nokeys -nodes -out example.com.crt
   openssl pkcs12 -in example.com.p12 -nocerts -nodes -out example.com.crtkey

All that’s left to do is ship out the .crt and .crtkey files to your SSL server and to securely delete all 3 files (.p12, .crt and .crtkey) from your local computer.

Loose ends because Firefox 3 can’t bother to fully support Mac OS X

When you connect with Firefox 3 to your SSL server with its shiny new certificates, Firefox 3 is still going to give you one of its famous gray error pages, stating that the certificate authority that signed the server’s certificate is not trusted. This is because, unlike every other browser for Mac OS X, Firefox can’t bother to use Keychain Services to verify certificate trust and therefore doesn’t know anything about the CA certificate stored in one of your keychains.

However this is a simple matter to fix. In the same error page, click on the Or you can add an exception… link, then on the Add Exception button. In the dialog that follows, first click on the Get Certificate button, make sure the Permanently store this exception checkbox is checked and finally click on the Confirm Security Exception button.

I’ll take this time to mention that that dialog is so poorly designed, with the Cancel button on the right of the dialog and of the “confirm action” button, contrary to Mac OS X HIG guidelines, not to mention the default button is that Get Certificate button which itself shouldn’t even be there – Firefox 3 should clearly fetch the certificate automatically. End of design commentary .

After that, Firefox 3 will trust the certificate and you should be good to go. You could also export the CA certificate and add it to Firefox 3’s list of trusted roots, an exercise I leave to the reader.

While watching the iPhone SDK announcement video, I noticed some odd things in my beloved Xcode. Some UI elements were looking different. And indeed, the iPhone SDK includes a new version of Xcode (and many other dev tools) which may be of interest for anyone doing Mac OS X development. Some of the highlights:

• Brand-new “New Project” and “New File” dialogs. I really like them, and the new templates make more sense.
• Multi-platform support. Each platform can provide its own set of tools and SDKs. This was obviously added to support the iPhone. So the big picture now is Platforms > SDKs > Architectures.
• Preview of gcc-4.2 and llvm-gcc-4.2. I am really excited to check this two out, particularly the LLVM powered compiler, which brings to Mac OS X developers modern link-time optimization that Microsoft Visual Studio and Intel CC customers have enjoyed for many years now. LLVM is the future of gcc compiler technologies, and it’s great to start seeing that get out into a lot of people’s hands.
• Improved support for conditional build settings (AKA per-architecture build settings).

I hope to see the final version of Xcode 3.1 to be released at this year’s WWDC, if not some manner of new beta release.

Well today, NVIDIA made CUDA available for Mac OS X. This is a sign that times are changing for Apple when they start to make such a kind of inroad. And of course, everyone in the (probably small) Mac HPC business and in the scientific community is probably very happy about this.

So if you own NVIDIA hardware, go grab it and give it a try!

Give it a try. As far as I’m concerned, my only deception so far is not being able to buy a license already.

Because of the way APE works, it’s most likely it’s simply preventing loginwindow from properly starting. Under the covers, the Mac OS X kernel is still “happily” humming along. So it’s not a BSOD as it is generally understood — just a coincidence.

Edit: Mac OS X certainly can kernel panic. But its death screen is not an intimidating blue screen. It’s a nice message telling you to reboot your computer (or a not-too-helpful dump if you passed the kernel certain debug boot flags).

• My internship at Apple is soon coming to an end. It was an absolutely fantastic experience, which I will surely talk about some more in future entries, NDA permitting :p
• There will be a new MPQKit release sometime by the end of August. It will likely be the last beta release before the release candidate for 1.0, which will happen sometime in September.
• I have started intensive work on Riven X again, and there is a lot more to come for that project as well. There will also be a new binary release by the end of August. I plan on finishing this project before next summer (for real this time).
• StarCraft II will be awesome.
• OpenGL 3 (codenamed Longs Peak) will go final sometime in September or October. This is fantastic news for OpenGL, as LP brings some much needed fresh air to the API, particularly in the realm of object model and data / state transfer efficiency. It will be a while before we see LP implementations ship to customers, but at least the spec will be out there.

Much more coming in a week.

Of course Blizzard is closer to my heart, so I invite Mac users that play and enjoy Blizzard games to congratulate them for their exceptional work. Blizzard has kept Mac gaming alive through the difficult years and are now driving the development of OpenGL, not only on Mac OS X by constantly pushing the stack to its limits and helping us improve OpenGL, but also by actively participating in the OpenGL ARB. They have my utmost respect and they totally deserve this award. Congratulations again.

Check out all the winners at the Apple Design Awards 2007 page.

*Ahem* This is Jean-Francois Roy, live from Montréal-Pierre Elliott Trudeau International Airport. Tonight we have a special program, with exciting news about my various projects, and more! For a recap of what my summer projects are, have a look at Summer game plan.

Airport?

That’s right, I am leaving tomorrow today for beautiful San Francisco to assist Apple’s yearly Worldwide Developers Conference. In short, this is the most exciting week of the year for all Mac developers, with probably over 3000 of us converging on Moscone West convention center for sessions, labs, thematic lunches and evening fun in downtown clubs.

I thought it would be entertaining to post some pictures of where I currently am. After all, I am showing my geekiness by doing an all-night pre-WWDC coding marathon. Unfortunately, I only have my cell phone’s digital camera at my disposal, so these won’t be the greatest pictures ever. In any case and without further ado:

Cindy travels with me.

A table, some power, energy drinks. What else can you ask for?

Where I am.

Drinks are served all night!

Some of the airport.

And some more of it.

Riven X

Truth be told, I have neglected Riven X these past 2 months. Between World of Warcraft, Longinus (the name of my World of Warcraft DKP and raid statistics system) and my summer internship at CHUL, I simply have not had the time to work on it seriously.

However, Riven X will be my priority at WWDC, as far as my projects are concerned. There are several components in my engine that need improvement, and I will take full advantage of Apple’s engineers in the various labs to address known issues. Stay tuned for more!

Longinus

Ah, so much to say about this. The project has become a lot bigger than I originally anticipated. Its objective is now to be a generic raid statistics tracking system as well as a generic (meaning extensible) item distribution system. An IDS is basically a method by which a guild distributes items that drop during raids to participating members. Alexstraza Dragon Riders uses slightly modified English auctions for example, while Trinity uses a zero-sum-based system.

There are two major components to Longinus.

The first is a World of Warcraft interface AddOn (thus written in Lua and XML) which handles gathering data during raids (such as player deaths, connection and disconnect events, joined raid and left raid events, boss fights (duration, outcome)) and in-game IDS functionality (for example, running an auction in the case of my guild).

The second is a Django-powered Python web application. Right now it only handles basic administrative functionality (officer checkout and commit), but I will eventually add public views to browser and consult raid statistics and all that good stuff.

The basic cycle of operation is as follows: an officer makes a data checkout. This essentially exports data the in-game AddOn required to function properly from the online database to a Lua file World of Warcraft will load (in WoW jargon, a saved variables Lua file). That checkout exists in the database and has a UUID, checkout timestamp, checkout officer, commit timestamp and commit officer (the latter two are of course initially NULL). There is no limit on the number of concurrent checkouts.

The officer then uses the in-game AddOn during raids for as long as he or she wants. However, after 3 days, Longinus will remind the officer, at most once per day, to commit back the data to the online database. When the officer does so, essentially by submitting his checkout saved variables file in a simple web form, the web application merges and updates the data in the database with the information from the saved variables file.

I’d like to finish by point (again) at the Trac wiki for Longinus. It’s got some interesting stuff, particularly the wowsv Python module, which not only loads Lua files (or Lua code as string data), but also serializes Python collections back to Lua code.

Wrapping up

Because Andrew is tired, I am going to wrap this entry now. Besides, I don’t have much else to report at this time. This was Jean-Francois Roy, for /dev/klog, in Montréal-Pierre Elliott Trudeau International Airport.