Latest Contributions by RandallWilliams

As has been announced, Esri will soon remove support for TLS 1.0 and TLS 1.1 on ArcGIS Online. Esri has provided test endpoints that users can work with to check that their applications will continue to function as expected. However, in some cases users have questions about legacy or custom apps or may want to understand how their apps behave when abstracted away from the tools that Esri has provided. Fortunately, you can test your apps prior to the current cutoff date April 16, 2019 without the test endpoints Esri has provided. To do this, we’ll use the Fiddler web debugging tool. Fiddler is a powerful web debugging tool that allows users to view and manipulate web sessions, and also gives us a LOT of insight into what’s happening under the hood. Let’s compare a patched instance of ArcGIS Desktop against an unpatched instance so that we can see the difference first hand. First, we’ll want to download and install the Fiddler tool. Once installed, we’ll want to take the default options. If you’re already familiar with Fiddler, open the Options dialog, click the HTTPS tab, and uncheck the ‘Decrypt HTTPS Traffic’ option. Next, configure your app. If you’re working with ArcGIS Desktop or an application that uses .Net to manage outbound internet (WinINET), fiddler should configure Internet Explorer’s proxy options for you. If you’re testing a JAVA app, your app will need to support the ability to use an outbound proxy and be configured to do so. By default, Fiddler listens on the localhost interface on port 8888. In this case, since I’m comparing ArcGIS Desktop, I know that I don’t need to configure an outbound proxy for this test to work. For this test, I’ll compare the ArcGIS Online search capability in ArcCatalog. Open ArcCatalog From the File menu, click ‘sign in’  From the Windows menu, click the ‘Search’ option: In the Search pane, select ‘ArcGIS Online’ Open Fiddler Enter a term in the Catalog search box. Anything will do. Click the magnifying glass to search. Check Fiddler. Select a session in fiddler: On the right side, under the ‘Inspectors’ tab, click the ‘Textview’ subtab. Check for the TLS version: Note that I can see that I’m using TLS 1.2 in my outbound communication – which makes sense, my instance of ArcGIS Desktop is patched!! But what if it’s unpatched, or I don’t know, or I’m curious, or I’ve modified this workflow slightly to test some app OTHER than ArcGIS Desktop? What will that look like? In that case, Fiddler won’t tell us that the app is using TLS 1.2. Instead, it’ll state something else in this case, TLS 1.0. Hopefully this helps provide some ideas as to how you can test and troubleshoot your own applications, as well as potentially validate some of ours.  Best, Randall ... View more

ArcGIS Data Store 10.6.1 Security Update 1 Patch released! This patch resolves a security vulnerability, within the intranet, that allows remote code execution using elevated privileges on the operating system on which the tile cache data store is installed and configured. Description Esri® announces the ArcGIS Data Store 10.6.1 Security Update 1 Patch. This patch addresses a security vulnerability within the intranet that allows remote code execution using elevated privileges on the operating system on which the tile cache data store is installed and configured. Esri strongly encourages all customers with ArcGIS Enterprise to install this patch at the earliest possible opportunity. It deals specifically with the issues listed below under Issues Addressed with this patch. The ArcGIS Data Store 10.6.1 Security Update 1 Patch cannot be uninstalled from the tile cache data store using the patch remove utility. As such, see the uninstall instructions to reset the ArcGIS Data Store to the pre-patch state if needed. Esri recommends users working with older versions of ArcGIS Enterprise upgrade to 10.6.1 to apply this patch. A fix for this issue is built into ArcGIS Enterprise 10.7. ... View more