Daily Archives

Articles indexed Monday October 22 2012

Page 1/16 | 1 2 3 4 5 6 7 8 9 10 11 12  | Next Page >

  • What SDK I should choose on Amazon Web Service to build API on server app?

    - by Nguyen Minh Binh
    I am a newbie on Amazon Web Service. I have a task that setup then build a web service that provide APIs to Mac OS, iOS, Android client. There are some APIs and Database need to be kept in secure. I see that AWS support multiple platform such as Java, .Net, PHP,... It also support many Database Management System. Not yet, there are 2 special SDK for Android and iOS app. So, What should I choose (Java, .Net, PHP,...) to carry out my task? Does AWS support all webservice protocol? Does it support secure webservice? Thanks a lot.

    Read the article

  • How to install Win7 over top of WinXP partition?

    - by Zeno
    I have a 2TB hard drive with 2 partitions on it, one a C drive for WinXP and another for extra space. I have a Win7 Pro install DVD and I have formatted that C drive via the DVD; it is now a blank "Primary" partition. I attempted to go through the Win7 setup and install it on that partition, but it's giving me an error: Setup unable to create new system partition or locate existing system partition. See setup log files for more info Googling around leads me to believe the entire drive has to be "cleaned" (diskpart) but that would wipe the entire other non-OS partition and I need to keep that data. How can I install Win7 on this blank partition without losing data on the other partition?

    Read the article

  • System shuts down immediately after few sconds

    - by Anil
    I have a computer with following specification and was working fine after re-installing the system and refitting sink fan unit. Recently it shuts down automatically after a few seconds. I checked PSU by shorting pin no.s 13 & 14 as well as 14 & 15. It worked well means the PSU fan moves. But I never checked the voltages at different wires. I refitted the heat sink fan by applying thermal paste. but it behaved the same. Again I refitted the Heat Sink Fan, then it worked for 2 minutes and again shut down. Now it shuts down immediately after switching on. Mother board : M26GTM-3VP CPU : AMD athlon PSU : 450 watt Can anyone help?

    Read the article

  • Monitor-Specific Color Profile Results In Yellow Grayscale Images

    - by Zian Choy
    I recently purchased a new Acer S201hl monitor. Many lay reviews compliment its color accuracy with people noting only a bit of a blueish tinge. After a little time, Windows found, and I installed, the Acer drivers via Microsoft Update. During the installation process, the software installed an ICC profile for the monitor from Acer. I recently noticed that when I view photos using Windows Live Photo Gallery, the colors are wrong. For example, grayscale document scans appear with yellow backgrounds instead of white backgrounds. This happens with both my external monitors and my ThinkPad's built-in screen. When I removed the monitor-specific profile from the list of profiles associated with a monitor (for example, removing the Acer profile from the Acer monitor), the problem went away for that screen. I checked with Microsoft KB939395 and though it says "an incorrect color profile [...] is used for the monitor," the profile associated with my ThinkPad's screen seemed to be correct, based on its name.

    Read the article

  • Audio Static/Interference regardless of audio interface?

    - by Tom
    I currently am running a media center/server on a Lubuntu machine. The machine specs: Core 2 Duo Extreme EVGA SLI 680i MotherBoard 2 GB DDR2 Ram 3 Hard Drives no raid - WD Caviar Black, Green, and Samsung Spinpoint Galaxy GTX 220 1GB External USB Creative XI-FI Extreme Card 550W Power Supply This machine is hooked up through an optical cable to an ONKYO HTR340 Receiver through the XIFI card. Whenever I play any audio regardless if it is through XBMC, the default audio player, a flash video, etc, I get a horrible static sound that randomly gets louder. Here is a video of the sound: http://www.youtube.com/watch?v=SqKQkxYRVA4 This static comes in randomly, sometimes going away for short periods, but eventually always comes back. So far I have tried everything I could think of: Reinstalling OS Installing/upgrading/repairing PulseAudio/Alsa Installing alternate OSes, straight Ubuntu, Lubuntu, Xubuntu, Arch, Mint, Windows 7 Switching audio from the external card to internal Optical, audio out through HDMI, audio out through headphones Different ports on receiver (my main desktop sounds fine on the same sound system) Different optical cables Unplugging everything unnecessary from the motherboard (1 HD, 1 Stick of Ram, 1 Keyboard) Swapping out ram Swapping out the motherboard Replacing the Graphics Card (was replaced due to fan being noisy, not specifically for this problem) Different harddrives Swapping power supply Disabling onboard audio Pretty much everything short of swapping the CPU. I haven't been able to narrow down the problem and it is getting frustrating. Is it possible that the CPU is faulty and might cause a problem such as this, or that the PC case is shorting out the motherboard? Any kind of suggestions will be appreciated.

    Read the article

  • Windows 8 will only recognize the Blu Ray ROM, if the install disk is present at boot time

    - by aceinthehole
    If I have the install disk in the blu ray ROM drive at boot time and subsequently remove the disk and replace it with blu ray media everything functions as I'd expect. However, if I have no media present, or another disk in the drive at boot time, then windows 8 does not seem to recognize that the blu ray player is even present in the computer. It is not present in the 'my computer' screen, device manager does not show the player, and scanning for new hardware yields nothing. It seems that the driver is installed and working as expect, what is it about having the windows 8 install disk in the drive or not that would cause this kind of behavior?

    Read the article

  • How do I "clean" ghost Windows Store apps from Windows 8?

    - by Shahar Prish
    I am trying to run the Windows App Cert Kit (Edit: on my local machine)and am getting two entries for one of my apps. This could be because of something I did a while ago - however - I cant figure out how to uninstall that other app. When I type the name of the app on the start screen, I get just one item listed (which is the kosher app, not the ghost app) Where is information about such apps kept and how do I "clean" it?

    Read the article

  • Core Audio sound driver has an error

    - by Raj More
    I have been using Virtual DJ on my machine. The setup is where I want audio to play over the headphones and use a USB sound card to play audio into my headphones so I can listen to music before I play it for everybody. However, the last time I tried, I got an error message saying "Error in the sound driver of Core Audio. Your sound card is probably not connected, or the settings are incorrect". If I use the headphone by themselves, the USB sound card by itself, or my speakers by themselves, they all work individually. How do I go about figuring out what's wrong here?

    Read the article

  • What's the maximum safe temperature for a HD Radeon 6870?

    - by Adrian Grigore
    I'm running a passively cooled HD Radeon 6870 in my PC. While using 3D Acceleration, the temperature climbs up to 95 degrees Celsius according to SpeedFan. It seems a bit hot, but on the other hand I've seen other GPUs being specified to run up to 120 Degrees Celsius. The system is very stable, but Battlefield 3 crashes every few hours or so. On the other hand it might be the game's fault and not related to the GPU temperature at all. Does anyone know where I can find some manufacturer specs on the maximum allowed temperature for this GPU? Thanks, Adrian

    Read the article

  • Ofice for Mac 2011 does not start, how do I repair the database?

    - by RomanT
    After a TimeMachine restore; Office 2011 is having kittens over permissions it would seem. Having attempted a 'repair' out of Disk Utility, am still seeing: there is a problem with the Office database upon startup, after which Word/Excel work without issues. Outlook on the other hand won't even start. Given the obvious message here "You do not have write access to the Outlook application folder" – where is the DB located to check?

    Read the article

  • SQL SERVER – Vacation, Travel and Study – A New Concept

    - by pinaldave
    Quite often when developers go to training sessions they either find it very boring because of study or great because they treat it as a vacation. There should be a perfect balance between study and extra activities. Studying is Boring Studying is very hard. Nobody likes to study, very few people are going to list “studying” as one of their favorite hobbies.  Already my young daughter knows she doesn’t want to study, and I don’t want to either.  If you read my blog regularly you know that I am always saying that we need to be students for life.  However, all philosophy aside, if you are put in a room with an instructor to study for eight hours a day, you are going to feel bored, uncomfortable, and unhappy.  I was a trainer myself, and I understand that all-day study sessions are no fun – even for the trainer.  I always tried to be entertaining, but even eight hours of jokes and laughter is tiresome.  Eight hours at a comedy club would be boring after a little while – and if we can’t even enjoy fun stuff for eight hours straight, how can we expect to study for eight hours straight? Studying for Career or Certification Even those who have advanced degrees and went to college for years, or even decades, find studying hard.  There is a difference between studying for a career and studying for a certification.  At least to get a degree there is a variety of subjects, with labs, exams, and practice problems to make things more interesting.  You can also choose your major and what you want to spend your time studying.  For certification you do not have this luxury.  You have to learn and memorize specific parts, and there is no option to change your major if you don’t like it.  Your option is to gain your certification, or fail.  Many people will find that last option unacceptable. Studying at Vacation We have established: eight hours of uninterrupted study is boring.  That is why I am so excited about what my very good friend is doing with Koenig Solutions.  His whole goal was to make classes that are intensive but not in a traditional format.  He adds in aspects of the vacation.  It is true that you will study and sit with instructors for six or eight hours a day, but in the mornings and evenings you can go out and see the sights in exotic locations.  He has chosen the locations for his training courses for their proximity to tourist attractions like the Himalayas, the Taj Mahal, and Goa, India’s most popular resort town.  Every location has access to great experiences like river rafting, safari tours, or meditation.  There are five locations to choose from: Dehli, Dehradun, Shimla (close to the Himalayas), Goa Beach, and Dubai.  After a day of classes and hours of sight-seeing, you will be more than ready to return to campus tired and ready to study.  This is the kind of study I can do! My friend’s point is that studying and fun can still go hand-in-hand.  How many times have we heard a professor say this?  But this time it is true.  There is great fun in learning in exotic locations.  If you want to travel in India and are interested in also taking the opportunity to learn something, let Koenig Solutions know. Reference: Pinal Dave (http://blog.sqlauthority.com) Filed under: PostADay, SQL, SQL Authority, SQL Query, SQL Server, SQL Tips and Tricks, T SQL, Technology

    Read the article

  • Toorcon14

    - by danx
    Toorcon 2012 Information Security Conference San Diego, CA, http://www.toorcon.org/ Dan Anderson, October 2012 It's almost Halloween, and we all know what that means—yes, of course, it's time for another Toorcon Conference! Toorcon is an annual conference for people interested in computer security. This includes the whole range of hackers, computer hobbyists, professionals, security consultants, press, law enforcement, prosecutors, FBI, etc. We're at Toorcon 14—see earlier blogs for some of the previous Toorcon's I've attended (back to 2003). This year's "con" was held at the Westin on Broadway in downtown San Diego, California. The following are not necessarily my views—I'm just the messenger—although I could have misquoted or misparaphrased the speakers. Also, I only reviewed some of the talks, below, which I attended and interested me. MalAndroid—the Crux of Android Infections, Aditya K. Sood Programming Weird Machines with ELF Metadata, Rebecca "bx" Shapiro Privacy at the Handset: New FCC Rules?, Valkyrie Hacking Measured Boot and UEFI, Dan Griffin You Can't Buy Security: Building the Open Source InfoSec Program, Boris Sverdlik What Journalists Want: The Investigative Reporters' Perspective on Hacking, Dave Maas & Jason Leopold Accessibility and Security, Anna Shubina Stop Patching, for Stronger PCI Compliance, Adam Brand McAfee Secure & Trustmarks — a Hacker's Best Friend, Jay James & Shane MacDougall MalAndroid—the Crux of Android Infections Aditya K. Sood, IOActive, Michigan State PhD candidate Aditya talked about Android smartphone malware. There's a lot of old Android software out there—over 50% Gingerbread (2.3.x)—and most have unpatched vulnerabilities. Of 9 Android vulnerabilities, 8 have known exploits (such as the old Gingerbread Global Object Table exploit). Android protection includes sandboxing, security scanner, app permissions, and screened Android app market. The Android permission checker has fine-grain resource control, policy enforcement. Android static analysis also includes a static analysis app checker (bouncer), and a vulnerablity checker. What security problems does Android have? User-centric security, which depends on the user to grant permission and make smart decisions. But users don't care or think about malware (the're not aware, not paranoid). All they want is functionality, extensibility, mobility Android had no "proper" encryption before Android 3.0 No built-in protection against social engineering and web tricks Alternative Android app markets are unsafe. Simply visiting some markets can infect Android Aditya classified Android Malware types as: Type A—Apps. These interact with the Android app framework. For example, a fake Netflix app. Or Android Gold Dream (game), which uploads user files stealthy manner to a remote location. Type K—Kernel. Exploits underlying Linux libraries or kernel Type H—Hybrid. These use multiple layers (app framework, libraries, kernel). These are most commonly used by Android botnets, which are popular with Chinese botnet authors What are the threats from Android malware? These incude leak info (contacts), banking fraud, corporate network attacks, malware advertising, malware "Hackivism" (the promotion of social causes. For example, promiting specific leaders of the Tunisian or Iranian revolutions. Android malware is frequently "masquerated". That is, repackaged inside a legit app with malware. To avoid detection, the hidden malware is not unwrapped until runtime. The malware payload can be hidden in, for example, PNG files. Less common are Android bootkits—there's not many around. What they do is hijack the Android init framework—alteering system programs and daemons, then deletes itself. For example, the DKF Bootkit (China). Android App Problems: no code signing! all self-signed native code execution permission sandbox — all or none alternate market places no robust Android malware detection at network level delayed patch process Programming Weird Machines with ELF Metadata Rebecca "bx" Shapiro, Dartmouth College, NH https://github.com/bx/elf-bf-tools @bxsays on twitter Definitions. "ELF" is an executable file format used in linking and loading executables (on UNIX/Linux-class machines). "Weird machine" uses undocumented computation sources (I think of them as unintended virtual machines). Some examples of "weird machines" are those that: return to weird location, does SQL injection, corrupts the heap. Bx then talked about using ELF metadata as (an uintended) "weird machine". Some ELF background: A compiler takes source code and generates a ELF object file (hello.o). A static linker makes an ELF executable from the object file. A runtime linker and loader takes ELF executable and loads and relocates it in memory. The ELF file has symbols to relocate functions and variables. ELF has two relocation tables—one at link time and another one at loading time: .rela.dyn (link time) and .dynsym (dynamic table). GOT: Global Offset Table of addresses for dynamically-linked functions. PLT: Procedure Linkage Tables—works with GOT. The memory layout of a process (not the ELF file) is, in order: program (+ heap), dynamic libraries, libc, ld.so, stack (which includes the dynamic table loaded into memory) For ELF, the "weird machine" is found and exploited in the loader. ELF can be crafted for executing viruses, by tricking runtime into executing interpreted "code" in the ELF symbol table. One can inject parasitic "code" without modifying the actual ELF code portions. Think of the ELF symbol table as an "assembly language" interpreter. It has these elements: instructions: Add, move, jump if not 0 (jnz) Think of symbol table entries as "registers" symbol table value is "contents" immediate values are constants direct values are addresses (e.g., 0xdeadbeef) move instruction: is a relocation table entry add instruction: relocation table "addend" entry jnz instruction: takes multiple relocation table entries The ELF weird machine exploits the loader by relocating relocation table entries. The loader will go on forever until told to stop. It stores state on stack at "end" and uses IFUNC table entries (containing function pointer address). The ELF weird machine, called "Brainfu*k" (BF) has: 8 instructions: pointer inc, dec, inc indirect, dec indirect, jump forward, jump backward, print. Three registers - 3 registers Bx showed example BF source code that implemented a Turing machine printing "hello, world". More interesting was the next demo, where bx modified ping. Ping runs suid as root, but quickly drops privilege. BF modified the loader to disable the library function call dropping privilege, so it remained as root. Then BF modified the ping -t argument to execute the -t filename as root. It's best to show what this modified ping does with an example: $ whoami bx $ ping localhost -t backdoor.sh # executes backdoor $ whoami root $ The modified code increased from 285948 bytes to 290209 bytes. A BF tool compiles "executable" by modifying the symbol table in an existing ELF executable. The tool modifies .dynsym and .rela.dyn table, but not code or data. Privacy at the Handset: New FCC Rules? "Valkyrie" (Christie Dudley, Santa Clara Law JD candidate) Valkyrie talked about mobile handset privacy. Some background: Senator Franken (also a comedian) became alarmed about CarrierIQ, where the carriers track their customers. Franken asked the FCC to find out what obligations carriers think they have to protect privacy. The carriers' response was that they are doing just fine with self-regulation—no worries! Carriers need to collect data, such as missed calls, to maintain network quality. But carriers also sell data for marketing. Verizon sells customer data and enables this with a narrow privacy policy (only 1 month to opt out, with difficulties). The data sold is not individually identifiable and is aggregated. But Verizon recommends, as an aggregation workaround to "recollate" data to other databases to identify customers indirectly. The FCC has regulated telephone privacy since 1934 and mobile network privacy since 2007. Also, the carriers say mobile phone privacy is a FTC responsibility (not FCC). FTC is trying to improve mobile app privacy, but FTC has no authority over carrier / customer relationships. As a side note, Apple iPhones are unique as carriers have extra control over iPhones they don't have with other smartphones. As a result iPhones may be more regulated. Who are the consumer advocates? Everyone knows EFF, but EPIC (Electrnic Privacy Info Center), although more obsecure, is more relevant. What to do? Carriers must be accountable. Opt-in and opt-out at any time. Carriers need incentive to grant users control for those who want it, by holding them liable and responsible for breeches on their clock. Location information should be added current CPNI privacy protection, and require "Pen/trap" judicial order to obtain (and would still be a lower standard than 4th Amendment). Politics are on a pro-privacy swing now, with many senators and the Whitehouse. There will probably be new regulation soon, and enforcement will be a problem, but consumers will still have some benefit. Hacking Measured Boot and UEFI Dan Griffin, JWSecure, Inc., Seattle, @JWSdan Dan talked about hacking measured UEFI boot. First some terms: UEFI is a boot technology that is replacing BIOS (has whitelisting and blacklisting). UEFI protects devices against rootkits. TPM - hardware security device to store hashs and hardware-protected keys "secure boot" can control at firmware level what boot images can boot "measured boot" OS feature that tracks hashes (from BIOS, boot loader, krnel, early drivers). "remote attestation" allows remote validation and control based on policy on a remote attestation server. Microsoft pushing TPM (Windows 8 required), but Google is not. Intel TianoCore is the only open source for UEFI. Dan has Measured Boot Tool at http://mbt.codeplex.com/ with a demo where you can also view TPM data. TPM support already on enterprise-class machines. UEFI Weaknesses. UEFI toolkits are evolving rapidly, but UEFI has weaknesses: assume user is an ally trust TPM implicitly, and attached to computer hibernate file is unprotected (disk encryption protects against this) protection migrating from hardware to firmware delays in patching and whitelist updates will UEFI really be adopted by the mainstream (smartphone hardware support, bank support, apathetic consumer support) You Can't Buy Security: Building the Open Source InfoSec Program Boris Sverdlik, ISDPodcast.com co-host Boris talked about problems typical with current security audits. "IT Security" is an oxymoron—IT exists to enable buiness, uptime, utilization, reporting, but don't care about security—IT has conflict of interest. There's no Magic Bullet ("blinky box"), no one-size-fits-all solution (e.g., Intrusion Detection Systems (IDSs)). Regulations don't make you secure. The cloud is not secure (because of shared data and admin access). Defense and pen testing is not sexy. Auditors are not solution (security not a checklist)—what's needed is experience and adaptability—need soft skills. Step 1: First thing is to Google and learn the company end-to-end before you start. Get to know the management team (not IT team), meet as many people as you can. Don't use arbitrary values such as CISSP scores. Quantitive risk assessment is a myth (e.g. AV*EF-SLE). Learn different Business Units, legal/regulatory obligations, learn the business and where the money is made, verify company is protected from script kiddies (easy), learn sensitive information (IP, internal use only), and start with low-hanging fruit (customer service reps and social engineering). Step 2: Policies. Keep policies short and relevant. Generic SANS "security" boilerplate policies don't make sense and are not followed. Focus on acceptable use, data usage, communications, physical security. Step 3: Implementation: keep it simple stupid. Open source, although useful, is not free (implementation cost). Access controls with authentication & authorization for local and remote access. MS Windows has it, otherwise use OpenLDAP, OpenIAM, etc. Application security Everyone tries to reinvent the wheel—use existing static analysis tools. Review high-risk apps and major revisions. Don't run different risk level apps on same system. Assume host/client compromised and use app-level security control. Network security VLAN != segregated because there's too many workarounds. Use explicit firwall rules, active and passive network monitoring (snort is free), disallow end user access to production environment, have a proxy instead of direct Internet access. Also, SSL certificates are not good two-factor auth and SSL does not mean "safe." Operational Controls Have change, patch, asset, & vulnerability management (OSSI is free). For change management, always review code before pushing to production For logging, have centralized security logging for business-critical systems, separate security logging from administrative/IT logging, and lock down log (as it has everything). Monitor with OSSIM (open source). Use intrusion detection, but not just to fulfill a checkbox: build rules from a whitelist perspective (snort). OSSEC has 95% of what you need. Vulnerability management is a QA function when done right: OpenVas and Seccubus are free. Security awareness The reality is users will always click everything. Build real awareness, not compliance driven checkbox, and have it integrated into the culture. Pen test by crowd sourcing—test with logging COSSP http://www.cossp.org/ - Comprehensive Open Source Security Project What Journalists Want: The Investigative Reporters' Perspective on Hacking Dave Maas, San Diego CityBeat Jason Leopold, Truthout.org The difference between hackers and investigative journalists: For hackers, the motivation varies, but method is same, technological specialties. For investigative journalists, it's about one thing—The Story, and they need broad info-gathering skills. J-School in 60 Seconds: Generic formula: Person or issue of pubic interest, new info, or angle. Generic criteria: proximity, prominence, timeliness, human interest, oddity, or consequence. Media awareness of hackers and trends: journalists becoming extremely aware of hackers with congressional debates (privacy, data breaches), demand for data-mining Journalists, use of coding and web development for Journalists, and Journalists busted for hacking (Murdock). Info gathering by investigative journalists include Public records laws. Federal Freedom of Information Act (FOIA) is good, but slow. California Public Records Act is a lot stronger. FOIA takes forever because of foot-dragging—it helps to be specific. Often need to sue (especially FBI). CPRA is faster, and requests can be vague. Dumps and leaks (a la Wikileaks) Journalists want: leads, protecting ourselves, our sources, and adapting tools for news gathering (Google hacking). Anonomity is important to whistleblowers. They want no digital footprint left behind (e.g., email, web log). They don't trust encryption, want to feel safe and secure. Whistleblower laws are very weak—there's no upside for whistleblowers—they have to be very passionate to do it. Accessibility and Security or: How I Learned to Stop Worrying and Love the Halting Problem Anna Shubina, Dartmouth College Anna talked about how accessibility and security are related. Accessibility of digital content (not real world accessibility). mostly refers to blind users and screenreaders, for our purpose. Accessibility is about parsing documents, as are many security issues. "Rich" executable content causes accessibility to fail, and often causes security to fail. For example MS Word has executable format—it's not a document exchange format—more dangerous than PDF or HTML. Accessibility is often the first and maybe only sanity check with parsing. They have no choice because someone may want to read what you write. Google, for example, is very particular about web browser you use and are bad at supporting other browsers. Uses JavaScript instead of links, often requiring mouseover to display content. PDF is a security nightmare. Executible format, embedded flash, JavaScript, etc. 15 million lines of code. Google Chrome doesn't handle PDF correctly, causing several security bugs. PDF has an accessibility checker and PDF tagging, to help with accessibility. But no PDF checker checks for incorrect tags, untagged content, or validates lists or tables. None check executable content at all. The "Halting Problem" is: can one decide whether a program will ever stop? The answer, in general, is no (Rice's theorem). The same holds true for accessibility checkers. Language-theoretic Security says complicated data formats are hard to parse and cannot be solved due to the Halting Problem. W3C Web Accessibility Guidelines: "Perceivable, Operable, Understandable, Robust" Not much help though, except for "Robust", but here's some gems: * all information should be parsable (paraphrasing) * if not parsable, cannot be converted to alternate formats * maximize compatibility in new document formats Executible webpages are bad for security and accessibility. They say it's for a better web experience. But is it necessary to stuff web pages with JavaScript for a better experience? A good example is The Drudge Report—it has hand-written HTML with no JavaScript, yet drives a lot of web traffic due to good content. A bad example is Google News—hidden scrollbars, guessing user input. Solutions: Accessibility and security problems come from same source Expose "better user experience" myth Keep your corner of Internet parsable Remember "Halting Problem"—recognize false solutions (checking and verifying tools) Stop Patching, for Stronger PCI Compliance Adam Brand, protiviti @adamrbrand, http://www.picfun.com/ Adam talked about PCI compliance for retail sales. Take an example: for PCI compliance, 50% of Brian's time (a IT guy), 960 hours/year was spent patching POSs in 850 restaurants. Often applying some patches make no sense (like fixing a browser vulnerability on a server). "Scanner worship" is overuse of vulnerability scanners—it gives a warm and fuzzy and it's simple (red or green results—fix reds). Scanners give a false sense of security. In reality, breeches from missing patches are uncommon—more common problems are: default passwords, cleartext authentication, misconfiguration (firewall ports open). Patching Myths: Myth 1: install within 30 days of patch release (but PCI §6.1 allows a "risk-based approach" instead). Myth 2: vendor decides what's critical (also PCI §6.1). But §6.2 requires user ranking of vulnerabilities instead. Myth 3: scan and rescan until it passes. But PCI §11.2.1b says this applies only to high-risk vulnerabilities. Adam says good recommendations come from NIST 800-40. Instead use sane patching and focus on what's really important. From NIST 800-40: Proactive: Use a proactive vulnerability management process: use change control, configuration management, monitor file integrity. Monitor: start with NVD and other vulnerability alerts, not scanner results. Evaluate: public-facing system? workstation? internal server? (risk rank) Decide:on action and timeline Test: pre-test patches (stability, functionality, rollback) for change control Install: notify, change control, tickets McAfee Secure & Trustmarks — a Hacker's Best Friend Jay James, Shane MacDougall, Tactical Intelligence Inc., Canada "McAfee Secure Trustmark" is a website seal marketed by McAfee. A website gets this badge if they pass their remote scanning. The problem is a removal of trustmarks act as flags that you're vulnerable. Easy to view status change by viewing McAfee list on website or on Google. "Secure TrustGuard" is similar to McAfee. Jay and Shane wrote Perl scripts to gather sites from McAfee and search engines. If their certification image changes to a 1x1 pixel image, then they are longer certified. Their scripts take deltas of scans to see what changed daily. The bottom line is change in TrustGuard status is a flag for hackers to attack your site. Entire idea of seals is silly—you're raising a flag saying if you're vulnerable.

    Read the article

  • What should be done with class names that conflict (common) framework names

    - by Earlz
    What should be done exactly when the most obvious class name for a component is taken by a framework? In my case, I need to make a class that describes an HTTP request. Of course, the most common name is "taken" as System.Web.HttpRequest. What should I do? This project will be used in a web context, so I'd really rather not force people to not import the System.Web namespace, or type out all of my class names manually. What is the usual way of dealing with this? I can come up with this: Prefix class name with a project shortname Try to come up with a different name that means the same thing(I've tried and can't come up with anything) Force users to choose between namespaces

    Read the article

  • ASP.NET MVC Controllers & Actions In Regards To URLs And SEO

    - by user1066133
    The general idea is that if I were to create an MVC site, simple pages such as the contact and about pages will be placed under the Home Controller. So my URL would look like http://www.mysite.com/home/contact, and http://www.mysite.com/home/about. The above works just fine, but I really don't like the idea of having the "home" portion in the URL. So what negatives would there be if I decided to make a controller name of Contact and About and just added a single Index action so that way the URL would be simplified to http://www.mysite.com/contact and http://www.mysite.com/about. This method looks cleaner. Do any of you do the same or something similar? I've been trying to work on SEO for an escort service site I've developed and when you search for the females the link looks like http://www.mysite.com/escorts/female-escorts, and like-wise for males. I'm wondering if I should remove the Escorts Controller and just create a Female_Escorts Controller with an Index Action only so it comes out like the above as http://www.mysite.com/female-escorts.

    Read the article

  • Is a simple iPhone app more appealing to users than a mobile website?

    - by Ryan
    My client wants to do an iPhone app because she's found that people are significantly more likely to use the iPhone app over a mobile optimized site. The iPhone app is very simple - it just displays a couple images and some text. As a programmer I'd much rather do a mobile site given the simple nature of the content. From a technical perspective I feel that it's overkill to use an iPhone app in this situation. Does it make sense to build an iPhone when a mobile site would suffice, simply because your users would much rather it be an iPhone app? Is there anyway to easily convince users that a mobile site is just as easy to use?

    Read the article

  • Distinguishing repetitive code with the same implementation

    - by KyelJmD
    Given this sample code import java.util.ArrayList; import blackjack.model.items.Card; public class BlackJackPlayer extends Player { private double bet; private Hand hand01 = new Hand(); private Hand hand02 = new Hand(); public void addCardToHand01(Card c) { hand01.addCard(c); } public void addCardToHand02(Card c) { hand02.addCard(c); } public void bustHand01() { hand01.setBust(true); } public void bustHand02() { hand02.setBust(true); } public void standHand01() { hand01.setStand(true); } public void standHand02() { hand02.setStand(true); } public boolean isHand01Bust() { return hand01.isBust(); } public boolean isHand02Bust() { return hand02.isBust(); } public boolean isHand01Standing() { return hand01.isStanding(); } public boolean isHand02Standing() { return hand02.isStanding(); } public int getHand01Score(){ return hand01.getCardScore(); } public int getHand02Score(){ return hand02.getCardScore(); } } Is this considered as a repetitive code? providing that each method is operating a seperate field but doing the same implementation ? Note that hand01 and hand02 should be distinct. if this is considered as repetitive code, how would I address this? providing that each hand is a seperate entity

    Read the article

  • What is the best database design and/or software to model a thesaurus?

    - by Miles O'Keefe
    I would like to design a web app that functions as a simple thesaurus : a long list of words with attributes, all of which are linked to each other. Wikipedia defines it as: In Information Science, Library Science, and Information Technology, specialized thesauri are designed for information retrieval. They are a type of controlled vocabulary, for indexing or tagging purposes. Such a thesaurus can be used as the basis of an index for online material. The Art and Architecture Thesaurus, for example, is used to index the Canadian Information retrieval thesauri are formally organized so that existing relationships between concepts are made explicit. What database software, design or model would best fit this? Are PHP and MySQL good technologies to handle it?

    Read the article

  • Is Unix/Linux adoption a measure of developer skill? [closed]

    - by adeptsage
    Is Linux/Unix based OS adoption for development (or recreation) a rough measure of the awareness, adaptability and/or skill of a developer, after considering factors like learning curve for effective code testing via the CLI, basic scripting, tweaking, etc. I have no intention of starting flame wars between Windows and Linux as better dev environments, and personal choice of OSes for dev, but what i do wish to know is that - will the level of adaptability of a person who uses a Unix based system be defined by the fact that he programs on a Unix based OS?

    Read the article

  • Problem while installing amd driver on ubuntu 12.10 on my dell inspiron 5520

    - by Arun
    I have a dell inspiron 5520 which has switchable graphics mode with amd radeon hd 7600m. I have recently installed ubuntu 12.10 alongside windows. But i can't install the driver for grahics card. While typing "sudo apt-get install fglrx-installer" it says unable to locate the package. While adding the repository ubuntu-x-swat/x-updates it shows error that "The requested URL /ubuntu-x-swat/x-updates/ubuntu/dists/quantal/main/binary- i386/Packages was not found on this server." In another attempt i download driver from amd-driver site, and then installing from terminal it shows that some errors come while installing and I get the blank screen only. So how to install the amd driver on my laptop.

    Read the article

  • How to reenable Documents on iPhone?

    - by Matt
    So, I regularly plug in my iPhone to my computer to get voice recordings off of it. However, every time I plugged it in "iPhone" and "Documents on iPhone" would both mount, and "Documents on iPhone" would pop up automatically. As I normally don't need anything on there it was a bit of a nuisance, so I opened a terminal and ran: sudo apt-get install libimobiledevice-utils;idevicepair unpair && idevicepair pair as suggested a here This, however, took away my access to "Documents on iPhone" completely, and didn't provide an alternative like putting it in a folder on the main "iPhone" device. Now I actually NEED to get something off there. Is there anyway to get "Documents on iPhone" back? I would prefer it still didn't pop up automatically but that's a sacrifice I'm willing to make. UPDATE: I ran idevicepair pair and unplugged and replugged my phone. I now have Documents back but it still annoyingly opens every time I plug in.

    Read the article

  • Second display running off laptop VGA not correctly positioned (offset left and up)

    - by Filthy Pazuzu
    I have black bars on the right and bottom of my display! I'm running my laptop's VGA output to an recognized as a It is 20", but the assumed 3" difference does not account for the incorrect position. Everything displays fine. It runs high-res video beautifully. But it's 3/4" offset left and an unreasonably annoying 1/4" offset up. I've tried going through the display's annoying & useless menu, but it doesn't have any way to adjust the position. I'm certainly no linux newbie, but on this Ubuntu (Pangolin, BTW) I can't figure out how to make simple positional display changes on Ubuntu. It's not only frustrating, it's a bit humiliating! So. Does anyone know of an app that will allow me to make basic display position alterations? ("App" - annoyingly trendy, but a useful word - no matter how grating.) Thanks, & Cheers, Paz

    Read the article

  • HyperV integration services v3.4 for 12.10?

    - by nlee
    Networking is sloooow with v3.1 How to upgrade to Integration Services v3.4 in 12.10? modinfo output in 12.10 filename: /lib/modules/3.5.0-17-generic/kernel/drivers/hv/hv_vmbus.ko version: 3.1 license: GPL srcversion: B1AA963EEFBAE322D970F14 alias: acpi*:VMBus:* alias: acpi*:VMBUS:* depends: intree: Y vermagic: 3.5.0-17-generic SMP mod_unload modversions

    Read the article

  • How to install Radeon 3670 HD graphics drivers for Ubuntu 10.04 64 bit with OpenGL 2.0 support?

    - by Daniel
    I've been having trouble with getting graphics drivers to work that support OpenGL 2.0. I've had some luck with the Ubuntu drivers, however these only support OpenGL 1.3. I thought I would document the methods that I have tried both to see if anyone else has ideas, and to save time for people with a similar problem. System details: Ubuntu 10.04 (Lucid) 64 bit Kernel Linux 2.6.32-44-generic GNOME 2.30.2 ATI Mobility Radeon HD 3670 Attempted Methods The methods I have tried are: 1. Installing Proprietary Drivers using the "Hardware Drivers" (Jockey) GUI This GUI offers an "ATI/AMD proprietary FGLRX graphics driver" however any attempts to install it result in a "Sorry, installation of this driver failed" error. The log file is here. There is an Ask Ubuntu question that covers this scenario, and notes that there is a known bug with Jockey. 2. Installing the Proprietary Drivers manually The answer to the question above linked to this wiki page, which gives instructions for installing Catalyst 12.6. This supported hardware list states that the 3670 is not supported in 12.6, and 12.4 must be used. This is somewhat confusing, as AMD's website suggests that the 12.6 driver should be installed for the 3670. There have been user reports that R600 (the GPU inside the 3670 card) doesn't work with 12.6, so I'm sticking with 12.4. I'm following these instructions to install the proprietary drivers on Lucid. I downloaded the 12.4 driver from the AMD website. Building the package worked fine, generating the fglrx, fglrx-dev, fglrx-amdcccle, and fglrx-modaliases deb packages successfully. However, when I try to install these using dpkg it gives me these errors. The make log referenced in the error is here. Ask Ubuntu References What is the correct way to install ATI Catalyst Video Drivers? Cannot install ATI/AMD FGLRX restricted graphic drivers Is my ATI graphics card supported in Ubuntu?

    Read the article

  • Log php errors in ubuntu

    - by resting
    I followed the setup here: Where is the PHP error log When I look into /var/log/php_errors.log, I could see some PHP errors. PHP Warning: file_get_contents(/var/www/...): failed to open stream: No such file or directory in ... But what I'm trying to see is the error when I removed a semicolon from a statement. That error above has no relation to file from where I removed the semicolon so we can just ignore that. When I access the page with the removed semicolon, I get The website encountered an error while retrieving https://myapp/download/decode/testfile. It may be down for maintenance or configured incorrectly. HTTP Error 500 (Internal Server Error): An unexpected condition was encountered while the server was attempting to fulfill the request. But no logs in /var/log/php_errors.log. How do I see the error that usually says which line and which file the process failed? The real reason for trying to see the error is because I have a very huge loop, that throws the HTTP 500 error and I can't see the exact error. I'm just simulation with a removed semicolon to test things out. Other settings: error_reporting = E_ALL & ~E_DEPRECATED display_errors = On On Ubuntu 10.04.4 LTS Update Ok, I managed to get the error message to display. Parse error: syntax error, unexpected T_IF in ... However, it's still not logged. It wasn't displaying previously because Cakephp's debug level was at 0. Setting it to 2 displays the message, but no logs.

    Read the article

  • Nautilus will not launch after update to 12.10

    - by dereksalerno
    I updated to Ubuntu 12.10 today from 12.04 using the graphical update tool. Everything seemed to be fine until I went to open Nautilus, and it would not open. Bizarrely, I am able to open a file that I happen to have on my desktop, but when I click on the launcher, it never opens. When I enter 'nautilus' in the terminal, I get this: (nautilus:8557): Gdk-CRITICAL **: gdk_x11_display_get_xdisplay: assertion `GDK_IS_DISPLAY (display)' failed zsh: segmentation fault (core dumped) nautilus I am not a total novice with ubuntu or linux, but all I can tell is that there is some problem with X. Can someone please point me in the right direction as far as fixing this? I really don't want to have to do a fresh install. Thank you very much.

    Read the article

1 2 3 4 5 6 7 8 9 10 11 12  | Next Page >