Search Results

Search found 97980 results on 3920 pages for 'code security'.

Page 144/3920 | < Previous Page | 140 141 142 143 144 145 146 147 148 149 150 151 | Next Page >

Moving between sites using SAML

- by System Down

I'm tasked with developing an SSO system, and was guided towards using the SAML spec. After some research I think understand the interaction between a Service Provider and an ID Provider and how a user's identity is confirmed. But what happens when I redirect the user to another Service Provider? How do I ascertain the user's identity there? Do I send his SAML assertion tokens along with the redirect request? Or does the second Service Provider need to contact the ID Provider all over again?

Read the article
Internet Explorer : nouvelle vulnerabilité 0-day, les recommandations de Microsoft pour éviter l'exécution de code distant

Nouvelle vulnerabilité 0-day dans Internet Explorer 6,7 et 8 Qui permet l'exécution de code distant Une nouvelle vulnérabilité 0-day dans le navigateur de Microsoft, Internet Explorer vient d'être identifiée. La vulnérabilité pourrait être exploitée par des pirates afin de prendre un contrôle à distance du système vulnérable. La faille se situe au niveau du moteur HTML d'Internet Explorer et peut être exploitée lorsque le navigateur traite des fichiers CSS (Cascading Style Sheets). Avec pour résultat, la possible exécution d'un code arbitraire via une page Web malicieuse. La vulnérabilité touche les versions 7 et 6 d'internet Explorer sur ...

Read the article
How to hide process arguments from other users?

- by poolie

A while ago, I used to use the grsecurity kernel patches, which had an option to hide process arguments from other non-root users. Basically this just made /proc/*/cmdline be mode 0600, and ps handles that properly by showing that the process exists but not its arguments. This is kind of nice if someone on a multiuser machine is running say vi christmas-presents.txt, to use the canonical example. Is there any supported way to do this in Ubuntu, other than by installing a new kernel? (I'm familiar with the technique that lets individual programs alter their argv, but most programs don't do that and anyhow it is racy. This stackoverflow user seems to be asking the same question, but actually just seems very confused.)

Read the article
Facebook - Isn't this a big vulnerability risk for users? (After Password Change)

- by Trufa

I would like to know you opinions as programmers / developers. When I changed my Facebook password yesterday, by mistake I entered the old one and got this: Am I missing something here or this is a big potencial risk for users. In my opinion this is a problem BECAUSE it is FaceBook and is used by, well, everyone and the latest statistics show that 76.3% of the users are idiots [source:me], that is more that 3/4!! All kidding aside: Isn't this useful information for an attacker? It reveals private information about the user! It could help the attacker gain access to another site in which the user used the same password Granted, you should't use use the same password twice (but remember: 76.3%!!!) Doesn't this simply increase the surface area for attackers? It increases the chances of getting useful information at least. In a site like Facebook 1st choice for hackers and (bad) people interested in valued personal information shouldn't anything increasing the chance of a vulnerability be removed? Am I missing something? Am I being paranoid? Will 76.3% of the accounts will be hacked after this post? Thanks in advance!! BTW if you want to try it out, a dummy account: user: [email protected] (old) password: hunter2

Read the article
How to Detect and Fix an Infected PC

You may have noticed that your PC is not acting the way it used to when you first purchased it. If so, malware may be the culprit. Here are some ways to detect if your PC has been infected, as well as methods to correct any such problems to get things back to normal, as suggested by researcher Tim Armstrong of Kaspersky Lab. Malware Detection Irritating Popups Irritating popup windows are one of the telltale signs that your PC is infected with malware. One of the most common classes of malware driven popup windows comes in the form of scareware, or fake antivirus warnings. These popups tel...

Read the article
How to hide process arguments from other users?

- by poolie

A while ago, I used to use the grsecurity kernel patches, which had an option to hide process arguments from other non-root users. Basically this just made /proc/*/cmdline be mode 0600, and ps handles that properly by showing that the process exists but not its arguments. This is kind of nice if someone on a multiuser machine is running say vi christmas-presents.txt, to use the canonical example. Is there any supported way to do this in Ubuntu, other than by installing a new kernel? (I'm familiar with the technique that lets individual programs alter their argv, but most programs don't do that and anyhow it is racy. This stackoverflow user seems to be asking the same question, but actually just seems very confused.)

Read the article
Microsoft Releasing Windows 8 in Late October

The one thing Microsoft did not give was the exact date in October that this latest operating system would become available. But that may be difficult to predict. Brandon LeBlanc, Microsoft communications manager, stated only that Windows 8 is on track for a release to manufacturers (RTM) in August. The company, on average, produces a new version of Windows every three years; the last one to come out was Windows 7, back in October of 2009. The operating system will enjoy a widespread release, coming out in 109 languages across 231 markets throughout the world. It will be used not only in PCs...

Read the article
Avira Software Update Mistakenly Disabled Windows PCs

While Avira currently holds the number two ranking in terms of usage amongst antivirus manufacturers worldwide, its latest slipup will likely put a dent in its reputation. The problem with the latest service pack can be pinpointed to ProActiv, a program that monitors for any suspicious events that could lead to infection or attack. Users who applied the updates noticed that ProActiv was preventing their systems from booting, as critical Windows files could not run. Others also reported that ProActiv was blocking all .exe, or executable files, in Windows, making it impossible to launch appl...

Read the article
How can robots beat CAPTCHAs?

- by totymedli

I have a website e-mail form. I use a custom CAPTCHA to prevent spam from robots. Despite this, I still get spam. Why? How do robots beat the CAPTCHA? Do they use some kind of advanced OCR or just get the solution from where it is stored? How can I prevent this? Should I change to another type of CAPTCHA? I am sure the e-mails are coming from the form, because it is sent from my email-sender that serves the form messages. Also the letter style is the same. For the record, I am using PHP + MySQL, but I'm not searching for a solution to this problem. I was interested in the general situation how the robots beat these technologies. I just told this situation as an example, so you can understand better what I'm asking about.

Read the article
Website (X)HTML Code Change Detection [closed]

- by 0pt1m1z3

I am looking for an enterprise-grade service or a tool that can be used to scan / fingerprint websites and notify when major XHTML code changes are detected. The tool should be able to continuously scan thousands of websites and determine the percentage of HTML code that has been modified since the last run. And then either save the data where it can be easily accessed or send periodic notifications. I know of services like ChangeDetect.com, but they don't do markup only changes and instead focus on everything, including content. We don't really care about presentation content, because a lot of sites we need to cover are updated frequently with content.

Read the article
Why do password strength requirements exist? [migrated]

- by Bozho

Password strength is now everything, and they force you to come up with passwords with digits, special characters, upper-case letters and whatnot. Apart from being a usability nightmare (even I as a developer hate it when a website requires a complex password), what are the actual benefits of having strong passwords (for website authentication)? Here are the prerequisites of a system that handles authentication properly: store passwords using bcrypt (or at least use salt+hash) - hard-to-impossible to find the original password when an attacker gets the database lock subsequent password attempts with a growing cooldown - no brute-force via the site

Read the article
How do web servers enforce the same-origin policy?

- by BBnyc

I'm diving deeper into developing RESTful APIs and have so far worked with a few different frameworks to achieve this. Of course I've run into the same-origin policy, and now I'm wondering how web servers (rather than web browsers) enforce it. From what I understand, some enforcing seems to happen on the browser's end (e.g., honoring a Access-Control-Allow-Origin header received from a server). But what about the server? For example, let's say a web server is hosting a Javascript web app that accesses an API, also hosted on that server. I assume that server would enforce the same-origin policy --- so that only the javascript that is hosted on that server would be allowed to access the API. This would prevent someone else from writing a javascript client for that API and hosting it on another site, right? So how would a web server be able to stop a malicious client that would try to make AJAX requests to its api endpoints while claiming to be running javascript that originated from that same web server? What's the way most popular servers (Apache, nginx) protect against this kind of attack? Or is my understanding of this somehow off the mark? Or is the cross-origin policy only enforced on the client end?

Read the article
Techniques to prevent non-official clients in network gaming?

- by UpTheCreek

In multi-player network games, what techniques exist to try to ensure that users are connecting with the official client application, and not some hacked client app? I realise there is probably no sure-fire way to do this, but rather I'm interested in techniques that can be employed to mitigate the problem. I'm especially interested in any techniques that can be used for web based games, but I imagine most can be applied generally. Thank you!

Read the article
Botnet Malware Sleeps Eight Months Activation, Child Concerns

Daily Safety Check experts used a computer forensic analysis of a significant botnet that consisted of Carberp and SpyEye malware to come up with the details for their report. The analysis found that the botnet profiled the behavior of the slave computers it infected, similar to surveillance techniques used by law enforcement agencies, for an average of eight months. During the eight months, the botnet analyzed each computer's users and assigned ratings to certain activities to form a complete profile for each. Doing so allowed those behind the scheme to determine which were the most favora...

Read the article
Microsoft Launches Outlook.com

Microsoft announced the news in its Outlook blog, calling the new service modern email for the next billion mailboxes. The company is touting a fresh, clean user interface with fewer pixels in the header and no display ads; it should work well on portable devices. Another key point: it uses Exchange ActiveSync to synchronize your mail, calendar and social experience across your smartphone, tablet and desktop computer. Perhaps the biggest advance, though, is that Microsoft is connecting the email service to Facebook, Twitter, LinkedIn, Google; Skype will be part of this list, too, though i...

Read the article
Code Camp 2013 Harrisburg PA

- by raysmithequip

Originally posted on: http://geekswithblogs.net/raysmithequip/archive/2013/10/15/154349.aspxThe Centrral Pensylvania Dot Net Users Group will be hosting a code camp nov 2 2013. The Schedule is already on our groups' webpage, http://centralpenn.web121.discountasp.net/home/CodeCamp2013/tabid/109/Default.aspxYou will find the schedule on the pull down tab. Registration is free, you will have to use Meetup to register. http://www.meetup.com/Central-Penn-Dot-Net-User-Group/events/141788672/Sign in to Meetup and register to attend Code Camp!! Learning will be plentiful, the giveaways will be COOL!! So you gotta be there!!!In a couple of days I will post the schedule here in an effort to spread the word. ray smith n3twu

Read the article
Microsoft Unveils Xbox SmartGlass

SmartGlass won't be available to consumers until the fall, and if the reviews of the feature's capability are any indication, it's going to feel like a very long wait. SmartGlass lets you switch from watching something on your TV to watching it on your tablet or smartphone, and vice versa. But that's only the beginning. SmartGlass also lets developers turn smartphones and tablets into Xbox 360 controllers. Thus, if you're playing a sports-based game with your friends, you can enter your strategic plays into your smartphone, so he can't tell what your team is about to do. Or, with a baseball ga...

Read the article
code cowboy on the team

- by MK01

How do you deal with a team member who is senior to you and always jumps on other people's projects and completes them over night or over the weekend? She seems to work 80 hour weeks whether there is an emergency or not and it is somewhat difficult to predict which part of your todo list she is going to strike next. Sometimes days of your work are wasted because on Monday morning you find a checkin completing the project you've spent most of the previous week working on. To people asking of the quality: Usually it is quite good but: there is also a lot of refactoring of code involved, including code 'owned' by other team members, w/o regard for the test coverage, with the obvious results.

Read the article
Creating Stored Procedures with Managed Code

This article is intended to illustrate how to implement a stored procedure with managed code.

Read the article
Does facebook store multiple password hashes for each user?

- by loxxy

I noticed that Facebook allows multiple variants of my own password : My password as it is. My password with first letter capitalized. My password with all letters capitalized. It is commonly known that passwords are stored as hashes. So my question is, does facebook store multiple hashes for each user? Since the hash of each variant should be completely different... Or am I missing something, here? And there may be more combinations, besides the one I observed as well. This is obviously done to provide a better user experience & they probably have a statistical explanation of people repeating these mistakes. But I could not help but wonder, is it worth to increase so many lookups (in their database) just to help the user type a wrong password? On top of this, they warn about the caps lock (even though they don't seem to care) :

Read the article
Entity Framework, Code First: where is the database?

- by Marko Apfel

With Entity Framework 5 in Visual Studio 2012 the code first feature could let you come to the question “Where is the automatically created database located?” I run in the question after changing the model which throws during the next run this error: “The model backing the 'MyContext' context has changed since the database was created. Consider using Code First Migrations to update the database (http://go.microsoft.com/fwlink/?LinkId=238269).” Okay – clear I thought “delete the database”. But where is the database and what type is it??? In this constellation the frameworks generates a localDB. You could access this database via SQL Server Object Explorer. For the first time you have to add this localDB. The server name is “(localdb)\v11.0”: And so we could browse through the content of this database. It got the same name like the context class.

Read the article
How to properly code in Unity? [on hold]

- by Vincent B.

I'm fairly new to Unity (yet I touched it and made a few proto with it) and I'd like to know how I'm supposed to work with it. I'm student in programming so I'm used to C/C++ with SDL/SFML, writing code and only using Input/Graphics/Network libs. I followed a few Unity guides and it was way more around drag & drop on scenes and a bit of scripting to activate it all, which disturbed me. So I fond a way to only use one GameObject and use a Singleton to launch code and display stuff (for 2d games at least). At the end of the day I make games not using "Instantiate" or such at all. Is it the right way ? Am I supposed to do this ? How much are your scenes populated (in a professional environment) ? When should I stop coding and start using the editor ?

Read the article
Microsoft Offers Cheap Windows 8 Upgrade

Though the software giant hasn't answered all of the questions, Computerworld collected many of them in one place and included the answers. You can also visit Microsoft's blog post for the details. Starting at general availability, if your PC is running Windows XP, Windows Vista, or Windows 7 you will qualify to download an upgrade to Windows 8 Pro for just $39.99 in 131 markets. And if you want, you can add Windows Media Center for free through the 'add features' option within Windows 8 Pro after your upgrade, the Microsoft blog post helpfully states. If you choose to upgrade, the Windows 8...

Read the article
How safe is ubuntu?

- by VJo

Last week I started desktop sharing using krfb. Since I continue last session, this program keep on starting again. Two days ago I noticed messages poping up saying something like "rejecting uninvited connection from (some ip)", but today I figured it might be because of this and I was right. The krfb was running in the background. Hence the question. How safe is ubuntu? Should I expect someone to connect to my computer and erase everything I got on disk? EDIT To extend my question : how safe it is comparing to other OSs (windows, mac,...)? How safe it is comparing to other distros?

Read the article
Will using HTTPS hurt my site's SEO or other statistics?

- by yannbane

I've set up a WordPress blog. Since I have to log into it from many different locations/machines, I've also got an SSL certificate, and set up Apache to redirect HTTP to HTTPS. It all works, but I'm wondering whether that's an overkill. Since most people who go to my site don't have to log in, I'm starting to wonder whether HTTPS has some drawbacks. If so, should I look for a way to make HTTPS optional?

Read the article

< Previous Page | 140 141 142 143 144 145 146 147 148 149 150 151 | Next Page >