I did once the same conclusion - I'd better write my app in PHP, because there are so many PHP coders, a dime a dozen. The truth was, that the coders for that dime where so lousy, that wiping after them was a real chore. My conclusion was, that once the codebase grew out of "basic stuff" and went into OOP, the dime a dozen coders couldn't keep up and the salary for a guy who can do decent OOP in PHP is the same for decent Python coder. It really doesn't pay off.
Dear slashdotters, if You are going to compare apples to cowboy boots, please don't.
RoR and.NET don't have anything in common (not even a single letter!), pursue different goals and are used for different purposes. Compare.NET to Java or Parrot if You must.
I think what it means is that the one who takes initiative in equal opportunity setups wins. This falls in line with common wisdom and in business world, being very persistent often is virtue. Also, if we look at military history, usually more aggressive civilisations win over more pacifistic and defense minded ones. Besides, based on game rules, the one who is the sole survivor wins, so no point in building pretty castles and nice cities - this consumes resources that might have been otherwise converted to direct damage to opponent. I think that Civilisation series had the nice alternative of launching a space ship as a winning move.
As somebody, who has to explain to clients, that an odd performance metric from some miracle site is not Alpha And Omega of judgement,here I go...
And if you ever change something but forget to change the file name, your visitors will have to reload everything on the damn page to get the current version of the one thing you changed. Assuming, of course, they even realize there should be a newer version than the one they're seeing. And assuming that they actually know how to do that.
For one, having the Expires header reduced the load-latency - Your JS and CSS files are unlikely to change within a scope of a day or an hour. In theory, the browser does not have to re-validate the files that have an Expires: header set. So, when the user clicks from one link to another in Your site, he makes less HTTP requests. This improves latency, especially as there is the two connections per host rule. As for site upgrades append the version number to a file (automated build scripts are there to help) - it is not difficult.
So, developers and admins: please set the Expires header, it is a Good Thing[tm]
And of course, instead of just downloading the file again and checking to see if changing ETags are actually a problem or just something you should be aware of, let's just unilaterally fail this test if anything uses ETags.
So yeah, people who don't know what they're doing will run this (not so much because they are the only ones who need profiling tools, but more because this gives them a place to start), and they will make the situation worse trying to pass these frankly asinine tests.
ETags is good and useful. Dynamically generated pages can report same ETag if information hasn't changed, so no need for client to reload the entire page. It is just as valid marker as Last-Modified. So, failing because something uses ETags is plain stupid.
How about ISPs try the obvious: block the DNS for known phishing sites.
e.g. Spam filter raises a warning to an e-mail that invites you to visit manlynessenhancer.biz. Solution: in ISP's DNS route manlynessenhancer.biz to a warning site that says: This is known phishing site, we've blocked it for Your protection.
I think this sounds pretty obvious, probably has been done:
Have an open source suite that allows anybody to verify the test results. Let the experts tweak the configuration for each database. Provide free downloads to databases and/or easy install. This way entire community is tweaking the configurations for different servers and posting back results.
Not only this would be a more or less "proper" benchmark, but also the secrets of db tuning, if there are any, will be revealed to public. Vendors get to brag if they are in top3, rest get a nice motivation to improve.
Because the summary says absolutely nothing about what is inside the article. FPGA? Magic elf technology? Let me me restate the the summary more succintly:
Hi Slashdot! I found a cool article about a maigcal piece called Tortola that is supposed to help software and hardware (cool, huh)? The big boys (IBM and Intel) are on it! Here's the link!
There is no escape from IT. Period. Every bit of life is transcended with IT. Everywhere you go, there are blinking lights. So, no matter what one does, the mind falls back to known skills. Amber light - transmission, Green light - connection. Let's take it further. IT is about system. Once the mind is trained to recognize systems and to sort them, there is no escape short of complete brainwash. Much like combat skills taught in army or wherever. If fire, then duck. So, only thing you can hope to do is to find someplace where IT doesn't bother You so much and live with it. I imagine substituting machines for humans could help. Try politics.
Kind of bypasses the point of detection, in a way.
One cane safely ass-u-me that if the storage is disconnected, then , if You look very very close, then You could detect a rootkit.
Though IF,
If the kit is in-mem only and subverts no system binaries and stores its support files somewhere under/home/maryjanesmith/ or somewhere on/var/www, in other words - locations with thouesand of changing files (TripWire won't work even with SHA1 or other non md5 sums)
Uses an unpatched hole or security lapse to activate itself (say, attacker checks if the rootkit is there, by sending some fancy ping and expecting a fancy pong, e.g.)
Then even an offline inspection can be bypassed.
Besides, I'm sure a lot of businesses will take the risk of running potentially compromised server, than incur downtime.
Now, the Challenge is: What to do, to lock down system so that it is possible to verify the kernel and some userspace against a known good state and the system always gives veritable results?
I think that SELinux already does a lot of that - limits root's access. You can setup its policy so, that it will only allow executing binaries and load modules from from read-only partition. The point, is to lock down the box to such state, where only physical access allows security sensitive part modification. I know this is inconvenient,but if some Good Practices [tm] are followed, then a machine once-setup can run with config unchanged for a Year or so. Have some sort of Patch Tuesday or rely on trusted and secured binaries that allow package updated only if their strong crypto signatures validate.
On an end note, securing and maintaining a system like this with existing tools (that I am aware of) is timeconsuming and hence - expensive. So, the cost-benefit ratio might be nearing the "Let's just re-roll the system on suspected cracks" scenraio. For SMB at least.
In one of the replies by crew of SG(A|-1), they said, that it was impractical, due to schedule for the actors to learn "stargate klingon". Besides, it would require heavy use of subtitling which a lot of people dislike. There is no "in-game" explanation for this.
I think VCs think along the lines: "4 mil is peanuts, and if this guy can make wikipedia - something every other schoolkid uses for homework, he probably can stumble upon something that can be monetized. So, we know that it is high risk, but it could be high profit too." Anyway, for some vc's 4 mil is what their Yacht costs in maintenance ( year) .
Dear AC, Since the dawn of time, there have been positional markers for SQL. SELECT * from bar where baz=? . This way, You not only allow the ' and \ and other characters to enter the DB unaltered (as they should!), but also You protect yourself from trivial SQL injection by not composing queries. However, people assume (the ass-You-Me), that once it's in SQL server, it is safe. Many stored procedures use dynamic queries (EXECUTE 'SELECT * from bar where baz='''||somevalue'''';) and do not do escaping (pg has a special function for it btw).
However, nothing beats input validating for data consitency. Do it in SQL via CHECK (condition) or at input time.
As usual, the RFID passport leaks information and is easy to clone. I don't want to sound trollish, but the major force behind biometric passports worldwide is Homeland Security in USA: "You want visa free entrance to US? Make biometric passports!". Honestly, this is plain bullying. Besides, if the border guard thinks the passport is "secure", then he'll spend less time thinking about that person and just rely on the big "OK" that pops on his screen when he swipes the thing instead of evaluating the person with his brain and guts. TFA mentions brute-force protection. For a thing, like credit card, that can be replaced within 3-5 days, it's ok, but for a passport, that some joker "brute-forced" and now it is locked, it is really tragic, especially if You are away from home and this is Your only ID. I think that the ID should be un-trivial to counterfeit. It should deter "common" people from tampering with it for some small, petty crimes. For well funded operations, obtaining a real passport isn't a problem - bribe the migration official and he issues You one on whatever name. My slightly watered point is - ID should be used for "some" identification. Trust is a human thing and not machine solvable. Heck, Your motherboard may be bugged right now by some weird conspiracy and no matter what security measures You take, such as bug sweeps or cable checks, You're screwed already since CIA and NSA and Mossad altered the CPU. It's a human thing.
Re:What backwards compatibility has it broken?
on
PHP 5.2.0 Released
·
· Score: 1
Amen brother! Cue the differences between behavoir for PHP on windows and PHP on Linux. The ocasional memory corruption (I've expirienced it myself), the no namespaces, the.... Whatever, as long as people don't kill each other.
Most of the toys mentioned in article are pretty lame and sucky.
Granted, for the PI or Spy that buys everything off-the-shelf, the counter-surveilance mentioned works, but otherwise it sucks, here's why (pont by point)
White-noise generators assume that You have no access to the room or that it is impossible to plant a small piece on the person. Say, bump in "accidentally" into the CEO in question and place a 5 square milimeter chip. It will have an internal clock and mic. Once the CEO is out in fresh air, it will transmit the data back in one encrypted burst and destroy the information it had.
Pretty much the same applies for cameras. One, you assume they are broadcasting within some pre-defined spectrum and do so all the time. Again, do a remote on/off or encrypted packet burst and such suverlance mechanisms fail. Besides, with advent of WiFi, if your super agent picks up emissions in 2.4Ghz range, he'll assume it's wifi and let it rest. Also, you can sramble the transmission, do a frequeny hop and bob knows what else.
About that phone-line tap: Do we live in dark ages? Nobody has analogue phones and taps that feed off phone current.You can't detect it over ISDN lines (most offices) and it deosn't do anything for cell networks.
No comments on vapourstream:)
I have to admit, that the laser window snooping is the most effective in the list, as it is probably the easiest method and most reliable.
For nice security, go low-tech : Have a friendly chat near a cooler (no windows), in a bath-house (most devices choke on humid air, transmission also would suck) or in a pool or sea (waves splashing, children, loud music).
Besides, the entire chain of communications should be scure, aka TEMPEST approach - if once bit of wire is not tempest - entire chain is invalid. If one of the two persons in conversation, repeats what he heard over dinner table with his wife - what's the point?
Saving data to cookie is not a good idea, for one, it is limiting, for two it usually encourages some mocked up format or half-assed serialization done. AJAX is about having a useful backend, no?
Forms can be easily submited by adding a onSubmit='myfunction();return false;' , and from that myfunc, read one by one the input elements in form and send it off. In ajax case, the only reason to use forms is that return key works as a submission key, but i suspect it can be overriden aswell. The only thing that probably can't be worked around are file uploads , as they require a proper submission.
You could sign the software yourself or you could execute it from a shell that is trusted. The idea is that any trust is explicit as opposed to implicit.
Let me get on the "Linux does not need this" bandwagon a bit...
The ZoneAlaram and likes, that do per application filtering came out as a response to trojans and spyware and their core purpose was to alert if something that is not from the dozens of applications the user has mindlessly clicked "Yes, accept permanently" wants to connect. If there is very little potential spyware, then why have this program? ( On a side note, I think any self respecting trojan should include some disable mechanism against zonealarm or at least should ride on top of internet explorer or mozilla as an extension/plugin/annoying HotBar, not to mention hijacking Microsoft Messenger or other programs likely on the list. It could even "observe" what is allowed to connect and then modify those). Besides, I hope that in very near future linux distros will ship with SELinux enabled, so that installing 3d party applications can be done only through trust verification mechanism (everything in signed.rpm/.deb , for example) so that executing 3d party unverified programs will raise an alarm. (Yes, I am aware of scripting and Java problems in this case)
As for the second thing, well.. for every problem, there is a netfilter plugin or combination that can do this already, so only thing missing is GUI. However most applications that i'd like to limit (Bittorrent, Revconnect, http downloader of sorts) can already do it at app level.
Slashdot Mirror
My favorite has to be this:
/path/to/directory . The first slash is where it should look for the directory.
:)
Q: How do I delete a directory in linux?
A: You do rm -rf /
Somehow, people didn't think it was very funny
I did once the same conclusion - I'd better write my app in PHP, because there are so many PHP coders, a dime a dozen. The truth was, that the coders for that dime where so lousy, that wiping after them was a real chore.
My conclusion was, that once the codebase grew out of "basic stuff" and went into OOP, the dime a dozen coders couldn't keep up and the salary for a guy who can do decent OOP in PHP is the same for decent Python coder.
It really doesn't pay off.
Dear slashdotters, if You are going to compare apples to cowboy boots, please don't.
RoR and .NET don't have anything in common (not even a single letter!), pursue different goals and are used for different purposes. Compare .NET to Java or Parrot if You must.
I think that Daisy, Daisy should be translated not so litrary, for example: "Shiroka, strana moya..."
I think what it means is that the one who takes initiative in equal opportunity setups wins. This falls in line with common wisdom and in business world, being very persistent often is virtue.
Also, if we look at military history, usually more aggressive civilisations win over more pacifistic and defense minded ones.
Besides, based on game rules, the one who is the sole survivor wins, so no point in building pretty castles and nice cities - this consumes resources that might have been otherwise converted to direct damage to opponent.
I think that Civilisation series had the nice alternative of launching a space ship as a winning move.
Did You mean: Warning, do not taunt the happy internet2 (ball)?
For one, having the Expires header reduced the load-latency - Your JS and CSS files are unlikely to change within a scope of a day or an hour. In theory, the browser does not have to re-validate the files that have an Expires: header set. So, when the user clicks from one link to another in Your site, he makes less HTTP requests. This improves latency, especially as there is the two connections per host rule. As for site upgrades append the version number to a file (automated build scripts are there to help) - it is not difficult.
So, developers and admins: please set the Expires header, it is a Good Thing[tm]
ETags is good and useful. Dynamically generated pages can report same ETag if information hasn't changed, so no need for client to reload the entire page. It is just as valid marker as Last-Modified. So, failing because something uses ETags is plain stupid.
How about ISPs try the obvious:
block the DNS for known phishing sites.
e.g. Spam filter raises a warning to an e-mail that invites you to visit manlynessenhancer.biz.
Solution: in ISP's DNS route manlynessenhancer.biz to a warning site that says:
This is known phishing site, we've blocked it for Your protection.
Mod parent up, the most insightful post over here in recent months.
I think this sounds pretty obvious, probably has been done:
Have an open source suite that allows anybody to verify the test results. Let the experts tweak the configuration for each database. Provide free downloads to databases and/or easy install. This way entire community is tweaking the configurations for different servers and posting back results.
Not only this would be a more or less "proper" benchmark, but also the secrets of db tuning, if there are any, will be revealed to public. Vendors get to brag if they are in top3, rest get a nice motivation to improve.
Just my $2,000,000
Because the summary says absolutely nothing about what is inside the article. FPGA? Magic elf technology?
Let me me restate the the summary more succintly:
Hi Slashdot!
I found a cool article about a maigcal piece called Tortola that is supposed to help software and hardware (cool, huh)?
The big boys (IBM and Intel) are on it!
Here's the link!
There is no escape from IT. Period. Every bit of life is transcended with IT. Everywhere you go, there are blinking lights. So, no matter what one does, the mind falls back to known skills. Amber light - transmission, Green light - connection. Let's take it further. IT is about system. Once the mind is trained to recognize systems and to sort them, there is no escape short of complete brainwash. Much like combat skills taught in army or wherever. If fire, then duck. So, only thing you can hope to do is to find someplace where IT doesn't bother You so much and live with it. I imagine substituting machines for humans could help.
Try politics.
Just plug in a spellchecker Co-Processor! I think no ordinary CPU could handle such massive mistakes
Kind of bypasses the point of detection, in a way.
One cane safely ass-u-me that if the storage is disconnected, then , if You look very very close, then You could detect a rootkit. Though IF,
Then even an offline inspection can be bypassed.
Besides, I'm sure a lot of businesses will take the risk of running potentially compromised server, than incur downtime.
Now, the Challenge is: What to do, to lock down system so that it is possible to verify the kernel and some userspace against a known good state and the system always gives veritable results? I think that SELinux already does a lot of that - limits root's access. You can setup its policy so, that it will only allow executing binaries and load modules from from read-only partition. The point, is to lock down the box to such state, where only physical access allows security sensitive part modification. I know this is inconvenient,but if some Good Practices [tm] are followed, then a machine once-setup can run with config unchanged for a Year or so. Have some sort of Patch Tuesday or rely on trusted and secured binaries that allow package updated only if their strong crypto signatures validate.
On an end note, securing and maintaining a system like this with existing tools (that I am aware of) is timeconsuming and hence - expensive. So, the cost-benefit ratio might be nearing the "Let's just re-roll the system on suspected cracks" scenraio. For SMB at least.
In one of the replies by crew of SG(A|-1), they said, that it was impractical, due to schedule for the actors to learn "stargate klingon". Besides, it would require heavy use of subtitling which a lot of people dislike. There is no "in-game" explanation for this.
I think VCs think along the lines: "4 mil is peanuts, and if this guy can make wikipedia - something every other schoolkid uses for homework, he probably can stumble upon something that can be monetized. So, we know that it is high risk, but it could be high profit too."
Anyway, for some vc's 4 mil is what their Yacht costs in maintenance ( year) .
Sacrifice a virgin, get a galon of hydrogen fuel!
Dear AC,
Since the dawn of time, there have been positional markers for SQL. SELECT * from bar where baz=? . This way, You not only allow the ' and \ and other characters to enter the DB unaltered (as they should!), but also You protect yourself from trivial SQL injection by not composing queries.
However, people assume (the ass-You-Me), that once it's in SQL server, it is safe. Many stored procedures use dynamic queries (EXECUTE 'SELECT * from bar where baz='''||somevalue'''';) and do not do escaping (pg has a special function for it btw).
However, nothing beats input validating for data consitency. Do it in SQL via CHECK (condition) or at input time.
As usual, the RFID passport leaks information and is easy to clone.
I don't want to sound trollish, but the major force behind biometric passports worldwide is Homeland Security in USA: "You want visa free entrance to US? Make biometric passports!". Honestly, this is plain bullying.
Besides, if the border guard thinks the passport is "secure", then he'll spend less time thinking about that person and just rely on the big "OK" that pops on his screen when he swipes the thing instead of evaluating the person with his brain and guts.
TFA mentions brute-force protection. For a thing, like credit card, that can be replaced within 3-5 days, it's ok, but for a passport, that some joker "brute-forced" and now it is locked, it is really tragic, especially if You are away from home and this is Your only ID.
I think that the ID should be un-trivial to counterfeit. It should deter "common" people from tampering with it for some small, petty crimes. For well funded operations, obtaining a real passport isn't a problem - bribe the migration official and he issues You one on whatever name.
My slightly watered point is - ID should be used for "some" identification. Trust is a human thing and not machine solvable.
Heck, Your motherboard may be bugged right now by some weird conspiracy and no matter what security measures You take, such as bug sweeps or cable checks, You're screwed already since CIA and NSA and Mossad altered the CPU. It's a human thing.
Amen brother! Cue the differences between behavoir for PHP on windows and PHP on Linux. The ocasional memory corruption (I've expirienced it myself), the no namespaces, the.... Whatever, as long as people don't kill each other.
Most of the toys mentioned in article are pretty lame and sucky. Granted, for the PI or Spy that buys everything off-the-shelf, the counter-surveilance mentioned works, but otherwise it sucks, here's why (pont by point)
White-noise generators assume that You have no access to the room or that it is impossible to plant a small piece on the person. Say, bump in "accidentally" into the CEO in question and place a 5 square milimeter chip. It will have an internal clock and mic. Once the CEO is out in fresh air, it will transmit the data back in one encrypted burst and destroy the information it had.
Pretty much the same applies for cameras. One, you assume they are broadcasting within some pre-defined spectrum and do so all the time. Again, do a remote on/off or encrypted packet burst and such suverlance mechanisms fail. Besides, with advent of WiFi, if your super agent picks up emissions in 2.4Ghz range, he'll assume it's wifi and let it rest. Also, you can sramble the transmission, do a frequeny hop and bob knows what else.
About that phone-line tap: Do we live in dark ages? Nobody has analogue phones and taps that feed off phone current.You can't detect it over ISDN lines (most offices) and it deosn't do anything for cell networks.
No comments on vapourstream :)
I have to admit, that the laser window snooping is the most effective in the list, as it is probably the easiest method and most reliable. For nice security, go low-tech : Have a friendly chat near a cooler (no windows), in a bath-house (most devices choke on humid air, transmission also would suck) or in a pool or sea (waves splashing, children, loud music).
Besides, the entire chain of communications should be scure, aka TEMPEST approach - if once bit of wire is not tempest - entire chain is invalid. If one of the two persons in conversation, repeats what he heard over dinner table with his wife - what's the point?Saving data to cookie is not a good idea, for one, it is limiting, for two it usually encourages some mocked up format or half-assed serialization done. AJAX is about having a useful backend, no?
Forms can be easily submited by adding a onSubmit='myfunction();return false;' , and from that myfunc, read one by one the input elements in form and send it off. In ajax case, the only reason to use forms is that return key works as a submission key, but i suspect it can be overriden aswell. The only thing that probably can't be worked around are file uploads , as they require a proper submission.
You could sign the software yourself or you could execute it from a shell that is trusted. The idea is that any trust is explicit as opposed to implicit.
Let me get on the "Linux does not need this" bandwagon a bit... .rpm/.deb , for example) so that executing 3d party unverified programs will raise an alarm. (Yes, I am aware of scripting and Java problems in this case)
The ZoneAlaram and likes, that do per application filtering came out as a response to trojans and spyware and their core purpose was to alert if something that is not from the dozens of applications the user has mindlessly clicked "Yes, accept permanently" wants to connect. If there is very little potential spyware, then why have this program? ( On a side note, I think any self respecting trojan should include some disable mechanism against zonealarm or at least should ride on top of internet explorer or mozilla as an extension/plugin/annoying HotBar, not to mention hijacking Microsoft Messenger or other programs likely on the list. It could even "observe" what is allowed to connect and then modify those). Besides, I hope that in very near future linux distros will ship with SELinux enabled, so that installing 3d party applications can be done only through trust verification mechanism (everything in signed
As for the second thing, well.. for every problem, there is a netfilter plugin or combination that can do this already, so only thing missing is GUI. However most applications that i'd like to limit (Bittorrent, Revconnect, http downloader of sorts) can already do it at app level.
Nothing is sharper than Sharpie!
Or a witty saying...