Search Results

Search found 18715 results on 749 pages for 'website attack'.

Page 255/749 | < Previous Page | 251 252 253 254 255 256 257 258 259 260 261 262  | Next Page >

• My hosting server giving memory allocation error

  - by Usman

  I have hosted my website on shared hosting linux server. As there are atmost 10-15 visitors come to my website daily but My wordpress website most of the times gives 500 Internal Server Error. I accessed my server Error Log following error is showing: [Tue Dec 04 08:57:45 2012] [error] [client 117.205.74.227] (12)Cannot allocate memory: couldn't create child process: /opt/suphp/sbin/suphp for /home/grasphub/public_html/index.php [Tue Dec 04 08:57:45 2012] [error] [client 117.205.74.227] (12)Cannot allocate memory: couldn't create child process: /opt/suphp/sbin/suphp for /home/grasphub/public_html/index.php [Tue Dec 04 08:57:43 2012] [error] [client 117.205.74.227] (12)Cannot allocate memory: couldn't create child process: /opt/suphp/sbin/suphp for /home/grasphub/public_html/index.php [Tue Dec 04 08:57:43 2012] [error] [client 117.205.74.227] (12)Cannot allocate memory: couldn't create child process: /opt/suphp/sbin/suphp for /home/grasphub/public_html/index.php [Tue Dec 04 08:57:42 2012] [error] [client 117.205.74.227] (12)Cannot allocate memory: couldn't create child process: /opt/suphp/sbin/suphp for /home/grasphub/public_html/index.php [Tue Dec 04 08:57:42 2012] [error] [client 117.205.74.227] (12)Cannot allocate memory: couldn't create child process: /opt/suphp/sbin/suphp for /home/grasphub/public_html/index.php [Tue Dec 04 08:57:41 2012] [error] [client 117.205.74.227] (12)Cannot allocate memory: couldn't create child process: /opt/suphp/sbin/suphp for /home/grasphub/public_html/index.php [Tue Dec 04 08:57:41 2012] [error] [client 117.205.74.227] (12)Cannot allocate memory: couldn't create child process: /opt/suphp/sbin/suphp for /home/grasphub/public_html/index.php [Tue Dec 04 08:57:40 2012] [error] [client 117.205.74.227] (12)Cannot allocate memory: couldn't create child process: /opt/suphp/sbin/suphp for /home/grasphub/public_html/index.php [Tue Dec 04 08:57:40 2012] [error] [client 117.205.74.227] (12)Cannot allocate memory: couldn't create child process: /opt/suphp/sbin/suphp for /home/grasphub/public_html/index.php [Tue Dec 04 08:57:32 2012] [error] [client 117.205.74.227] (12)Cannot allocate memory: couldn't create child process: /opt/suphp/sbin/suphp for /home/grasphub/public_html/index.php [Tue Dec 04 08:57:31 2012] [error] [client 117.205.74.227] (12)Cannot allocate memory: couldn't create child process: /opt/suphp/sbin/suphp for /home/grasphub/public_html/index.php [Tue Dec 04 08:57:29 2012] [error] [client 117.205.74.227] (12)Cannot allocate memory: couldn't create child process: /opt/suphp/sbin/suphp for /home/grasphub/public_html/index.php [Tue Dec 04 08:57:29 2012] [error] [client 117.205.74.227] (12)Cannot allocate memory: couldn't create child process: /opt/suphp/sbin/suphp for /home/grasphub/public_html/index.php [Tue Dec 04 08:57:26 2012] [error] [client 117.205.74.227] (12)Cannot allocate memory: couldn't create child process: /opt/suphp/sbin/suphp for /home/grasphub/public_html/index.php Is my hosting service really bad. And any solution. Thanks in advance.

  Read the article

• What can I do about Hack Attempts

  - by Matt

  I have an ASP.net website hosted using the Ultidev Web Server Pro. Every day I get a steady stream of errors generated by my application where page requests were requested and denied. This is obviously someone/something trying to find any exploits on my website. Here is an example log: 28/08/2012 11:37:11 - File not Found:http://MyWebServer/phpmyadmin/index.php 28/08/2012 11:37:11 - File not Found:http://MyWebServer/phpMyAdmin/index.php 28/08/2012 11:37:12 - File not Found:http://MyWebServer/phpMyAdmin-2/index.php 28/08/2012 11:37:12 - File not Found:http://MyWebServer/php-my-admin/index.php 28/08/2012 11:37:13 - File not Found:http://MyWebServer/phpMyAdmin-2.2.3/index.php 28/08/2012 11:37:13 - File not Found:http://MyWebServer/phpMyAdmin-2.2.6/index.php 28/08/2012 11:37:14 - File not Found:http://MyWebServer/phpMyAdmin-2.5.1/index.php 28/08/2012 11:37:14 - File not Found:http://MyWebServer/phpMyAdmin-2.5.4/index.php 28/08/2012 11:37:15 - File not Found:http://MyWebServer/phpMyAdmin-2.5.5-rc1/index.php 28/08/2012 11:37:15 - File not Found:http://MyWebServer/phpMyAdmin-2.5.5-rc2/index.php 28/08/2012 11:37:15 - File not Found:http://MyWebServer/phpMyAdmin-2.5.5/index.php 28/08/2012 11:37:16 - File not Found:http://MyWebServer/phpMyAdmin-2.5.5-pl1/index.php 28/08/2012 11:37:16 - File not Found:http://MyWebServer/phpMyAdmin-2.5.6-rc1/index.php 28/08/2012 11:37:17 - File not Found:http://MyWebServer/phpMyAdmin-2.5.6-rc2/index.php 28/08/2012 11:37:18 - File not Found:http://MyWebServer/phpMyAdmin-2.5.6/index.php 28/08/2012 11:37:18 - File not Found:http://MyWebServer/phpMyAdmin-2.5.7/index.php 28/08/2012 11:37:19 - File not Found:http://MyWebServer/phpMyAdmin-2.5.7-pl1/index.php 28/08/2012 13:52:07 - File not Found:http://MyWebServer/admin/pma/translators.html Is this normal? Is there anything I can do to protect myself against this?

  Read the article

• Tie stock quote value to cell in Excel 2011 Mac

  - by vedantchandra

  I've been working on a mock stock portfolio in Excel, and I've been looking for ways to automatically update the data, eg. stock price and P/E ratio. I have tried using a web query to MSN Money, but that just brings up the whole stock quote across multiple cells, I want data to be updated in individual cells only. The only web query solution I can think of is if someone hosted a website where each value in the stock quote was saved on a different HTML file. I could then WebQuery to that file for each cell requiring that value. However, no website offers this. So in essence, is there any tool on Excel 2011 Mac that will let me pull individual values from a stock quote and assign them to a single cell?

  Read the article

• Strange robots.txt - how and why did it get there?

  - by Mick

  I recently created a very simple, pure HTML website which I have hosted with "hostmonster". Hostmonster had very good reviews on some comparison website and in general so far they appear to be perfectly good in every way... At least I thought so until just now... I have been making lots of edits to my site on an almost daily basis. My site now appears on the first page (7th on the list) for my most important keyphrase when doing a google search. But I did notice some problem with the snippet chosen by google. I asked a question on this site about snippets and got some great answers. I then made some modifications to my meta data and within 48hrs the google snippet for my search was perfect. The odd thing though was that looking at the "cached" version google had, it appeared that the cache was still very odl- like three weeks previous. This seemed very odd - how could it be that the google robots had read my new metadata without updating the cache? This puzzled me greatly. Just now it occurred to me that maybe I had some goofey setting in my robots.txt file. I didn't actually remember even making one - but I thought I'd have a look just in case. Much to my horror, I saw that there was a robots.txt and it contained the disturbing text below: sitemap: http://cdn.attracta.com/sitemap/728687.xml.gz Intuitively this looks like some kind of junk, spam trick, and I had indeed been getting some spam from "attracta". So my questions are: 1. Should I simply delete this robots.txt? 2. Was the file there all along - placed there because of some commercial tie-in between attracta and hostmonster. 3. Does the attracta robots file explain the lack of re-caching?

  Read the article

• How can I remove HTTP headers with .htaccess in Apache?

  - by Daniel Magliola

  I have a website that is sending out "cache-control" and "pragma" HTTP headers for PHP requests. I'm not doing that in the code, so I'm assuming it's some kind of Apache configuration, as suggested by this question (you don't really need to go there for this question's context) I don't have anything in my .htaccess files, so it's gotta be in Apache's configuration itself, but I can't access that, this is a shared hosting, I only have FTP access to my website's directory. Is there any way that I can add directives to my .htaccess files that will remove the headers added by the global configuration, or otherwise override the directive so that they're not added in the first place? Thank you very much Daniel

  Read the article

• How to drastically improve code coverage?

  - by Peter Kofler

  I'm tasked with getting a legacy application under unit test. First some background about the application: It's a 600k LOC Java RCP code base with these major problems massive code duplication no encapsulation, most private data is accessible from outside, some of the business data also made singletons so it's not just changeable from outside but also from everywhere. no business model, business data is stored in Object[] and double[][], so no OO. There is a good regression test suite and an efficient QA team is testing and finding bugs. I know the techniques how to get it under test from classic books, e.g. Michael Feathers, but that's too slow. As there is a working regression test system I'm not afraid to aggressively refactor the system to allow unit tests to be written. How should I start to attack the problem to get some coverage quickly, so I'm able to show progress to management (and in fact to start earning from safety net of JUnit tests)? I do not want to employ tools to generate regression test suites, e.g. AgitarOne, because these tests do not test if something is correct.

  Read the article

• how insecure is my short password really?

  - by rika-uehara

  Using systems like TrueCrypt, when I have to define a new password I am often informed that using a short password is insecure and "very easy" to break by brute-force. I always use passwords of 8 characters in length, which are not based on dictionary words, which consists of characters from the set A-Z, a-z, 0-9 I.e. I use password like sDvE98f1 How easy is it to crack such a password by brute-force? I.e. how fast. I know it heavily depends on the hardware but maybe someone could give me an estimate how long it would take to do this on a dual core with 2GHZ or whatever to have a frame of reference for the hardware. To briute-force attack such a password one needs not only to cycle through all combinations but also try to de-crypt with each guessed password which also needs some time. Also, is there some software to brute-force hack truecrypt because I want to try to brute-force crack my own passsword to see how long it takes if it is really that "very easy".

  Read the article

• Live chat solutions

  - by Lèse majesté

  What good live chat/live help solutions are available (preferably for use on a site hosted on a LAMP stack and free)? I'm looking for a way to allow our sales and customer service reps to talk directly with visitors to our site. I've looked at phpopenchat, but it looks very unpolished. The only other free live chat app I've come across looked egregious. The aesthetics and UI design alone made me shudder to think what the underlying code might look like. This isn't a critical feature, and it wouldn't be hard to code up myself, so I'm not really looking for commercial software or paid services (unless there's a really compelling reason to use them). I'm just wondering if any other webmasters have come across a satisfactory free/open source solution for providing live customer support on their website. As a side note, live voice chat would also be an option, but it has to be be designed (or customizable) for customer support rather than a public chatroom. Edit: Looking at the responses, it looks like there probably aren't going to be many free solutions for this type of business-oriented chat solution, so feel free to post answers even if they are commercial solutions as long as they're a good value. Also feel free to post any alternate live support solutions (such as the Skype recommendation) that could be in someway integrated with a website. This will give me a good lay of the land for what people are actually using for live support, and I think will be more helpful to others reading this question.

  Read the article

• Architecture- Tracking lead origin when data is submitted by a server

  - by Kevin

  I'm looking for some assistance in determining the least complex strategy for tracking leads on an affiliate's website. The idea is to make the affiliate's integration with my application as easy as possible. I've run into theoretical barriers, so i'm here to explore other options. Application Overview: This is a lead aggregation / distribution platform. We will be focusing on the affiliate portion of this website. Essentially affiliates sign up, enter in marketing campaigns and sell us their conversions. Problem to be solved: We want to track a lead's origin and other events on the affiliate site. We want to know what pages, ads, and forms they viewed before they converted. This can easily be solved with pixel tracking. Very straightforward. Theoretical Issues: I thought I would ask affiliates to place the pixel where I could log impressions and set a third party cookie when the pixel is first called. Then I could associate future impressions with this cookie. The problem is that when the visitor converts on the affiliate's site and I receive their information via HTTP POST from the Affiliate's server I wouldn't be able to access the cookie and associate it with the lead record unless the lead lands on my processor via a redirect and is then redirected back to the affiliate's landing page. I don't want to force the affiliates to submit their forms directly to my tracking site, so allowing them to make an HTTP POST from their server side form processor would be ideal. I've considered writing JavaScript to set a First Party cookie but this seems to make things more complicated for the affiliate. I also considered having the affiliate submit the lead's data via a conversion pixel. This seems to be the most ideal scenario so far as almost all pixels are as easy as copy/paste. The only complication comes from the conversion pixel- which would submit all of the lead information and the request would come from the visitor's machine so I could access my third party cookie.

  Read the article

• Nginx Forward SSL for single site

  - by Will.brown

  I have a nginx server setup and it works fine for http however i would like to bypass the proxy for https connection. I want it so that when someone goes to my ip https:// ip1 (Nginx server) it bypasses ngix and forwards all traffic to https:// ip2(webserver) i do not need ngix to do this for any ssl website just one particular website. SO Client to https:// ip1 to https:/ /ip2 to https:// ip1 to client pc I just want the nginx to not intercept the connection and forward it on and on return forward the connection to client Im guessing i do this by nat mascarade buy not exactly sure how to do it and if i will need to tell nginx to ignore ssl aswell can someone help me please this has gone me stuck

  Read the article

• Mobile Phone Browser Emulators/Simulators

  - by Jessie

  I work in QA in a .NET shop and recently part of my testing process has started to involve testing our company website on mobile devices. At least one of our techs uses an HTC Desire. After tons of googling I still can't find a good online emulator for testing websites on different types of mobile devices. Is anyone aware of a website that I can test across multiple mobile platforms? Or even an online HTC or Blackberry browser emulator? I've found an iphone/opera mini simulator, but that's about it. Also, I realize there are a lot of SDK's that include emulators, but I'd rather not have to set up an entire SDK just to use an emulator.

  Read the article

• Using rsync to take backup of folder

  - by Ali

  Hi, I have a server (Linux) with NAS which is mounted as folder "mount" I have website in "public_html" folder. I want to take backup of website in mount folder automatically at certain intervals for e.g. every hour. I read that there is something called "rsync" which is used to make two folders sync. And it doesn't copy all files every time and instead matches if the file has been changed and then only update changed files. How do I use it to make automatic backups? I have root access to server. Thanks

  Read the article

• Detecting Units on a Grid

  - by hammythepig

  I am making a little turn based strategy game in pygame, that uses a grid system as the main map to hold all the characters and the map layout. (Similar to Fire Emblem, or Advance Wars) I am trying to determine a way to quickly and efficiently (i.e. without too much of a slow down) check if there are any characters within a given range of the currently selected character. So to illustrate: O = currently selected character X = squares within range Range of 1: X X O X X Range of 2: X X X X X X O X X X X X X Range of 3: X X X X X X X X X X X X O X X X X X X X X X X X X Now I have to tell the user who is in range, and I have to let the user choose who to attack if there are multiple enemies in range. If I have a 5x5 grid, filled with " " for empty and numbers for the characters: [ ][ ][ ][ ][4] [ ][1][ ][ ][ ] [ ][ ][ ][ ][ ] [ ][ ][2][3][ ] [ ][ ][ ][ ][ ] Depending on which character the user selects, I would like to show the user which other characters are in range. So if they all had a range of 3: 1 can hit 2 2 can hit 1 or 3 3 can hit 2 4 cannot hit anyone. So, How do I quickly and/or efficiently run though my grid and tell the user where the enemies are? PS- As a bonus, if someone could give an answer that could also work for a minimum distance type range, I would give them a pat on the back and a high five, should they ever travel to Canada and we ever meet in life. For example: Range of 3 to 5: (- is out of range) X X X X X X X X X X X X - X X X X X X - - - X X X X X X - - O - - X X X X X X - - - X X X X X X - X X X X X X X X X X X X

  Read the article

• Interpreting Munin graphs showing available entropy and MySQL slow queries in sync

  - by user64204

  We're experiencing performance issues on our website, and after reviewing our munin graphs, the only metrics we've found in sync are Available entropy and MySQL slow queries, with the latter influenced by our number of logged in users: Based on the wikipedia entropy page, my understanding is that entropy is the amount of randomness (here measured in bytes) that the system can use for various tasks, mainly cryptography and functions that require random input. Since the peaks in available entropy and MySQL slow queries are occurring in sync and at regular interval, that the number of MySQL slow queries is proportional to our number of Drupal users whereas the peaks in available entropy seem to be much more constant and less proportional to these 2 metrics, we're thinking available entropy is the reflect of a root cause which, combined with the traffic to our website, is causing those slow queries (and not the opposite, slow queries influencing the entropy). Accordingly: Q: What underlying problem do you think could cause regular peaks in available entropy that could have an influence on MySQL's ability to process queries?

  Read the article

• Web application/ site service (like Google App Engine) for PHP/ MySQL and Postgres

  - by Simon

  I would like to find a service similar to Google App Engine for PHP/ MySQL/ Postgres sites/ applications. We host two different types of site. i). PHP/ Mysql/ Zend Framework <VirtualHost *:80> DocumentRoot "/home/websites/website.com/public" ServerName website.com # This should be omitted in the production environment SetEnv APPLICATION_ENV development <Directory "/home/websites/website.com/public"> Options Indexes MultiViews FollowSymLinks AllowOverride All Order allow,deny Allow from all RewriteEngine On RewriteCond %{REQUEST_FILENAME} -s [OR] RewriteCond %{REQUEST_FILENAME} -l [OR] RewriteCond %{REQUEST_FILENAME} -d RewriteRule ^.*$ - [NC,L] RewriteRule ^.*$ index.php [NC,L] </Directory> </VirtualHost> ii). Matrix CMS - PHP/ Postgres + loads of pear classes <VirtualHost *:80> ServerName server.example.com DocumentRoot /home/websites/mysource_matrix/core/web Options -Indexes FollowSymLinks <Directory /home/websites/mysource_matrix> Order deny,allow Deny from all </Directory> <DirectoryMatch "^/home/websites/mysource_matrix/(core/(web|lib)|data/public|fudge)"> Order allow,deny Allow from all </DirectoryMatch> <DirectoryMatch "^/home/websites/mysource_matrix/data/public/assets"> php_flag engine off </DirectoryMatch> <FilesMatch "\.inc$"> Order allow,deny Deny from all </FilesMatch> <LocationMatch "/(CVS|\.FFV)/"> Order allow,deny Deny from all </LocationMatch> Alias /__fudge /home/websites/mysource_matrix/fudge Alias /__data /home/websites/mysource_matrix/data/public Alias /__lib /home/websites/mysource_matrix/core/lib Alias / /home/websites/mysource_matrix/core/web/index.php/ </VirtualHost> My key requirements are: I don't want to worry/ know/ care about the server/ infrastructure Secure/ up to date software/ os Good monitoring Automatic scalability SLA I apologise for the length of the question. In short all I want to do is i). create vhost, ii). create db iii). install app/ site iv). relax. Thanks. Edit: I include the Matrix vhost because that is the only complication that I cannot really do via a .htaccess file.

  Read the article

• Coldfusion multiserver instance hangs

  - by David Sedeño

  I have a coldfusion 8 multiserver setup with IIS in Windows 2008 Standard SP2 and when one instance "hangs" (I can't connect to the instance from fusion reactor) the web server throws a "503 service unavailable". The remains instance seems to works ok in fusion reactor but the website have only the 503. I have to restart jvm processes and IIS to get the website work again. The jvm processes have the option -Xmx2048m and the instanaces have 2.5Gb allocated. Maybe the jvm process reach the 2Gb limit and stop working? Can be a problem between IIS and CF instances? I'm new to CF debugging process, how can I find why the instance hangs? Thanks

  Read the article

• Nginx Ip Whitelist

  - by Will

  Is it possible to create a ip whitelist for my nginx proxy server without adding allow or deny in the config file is it possible i can get nginx to link to a separate database to check if the user is allowed to access the website . Ideally i could do with nginx linking to an external database or at minimum a list off allowed ips on the same server so i can easily update the list whit out restarting nginx every time. In the future i would like to link nginx to my website and a user will login and there ip will be linked to there account and they will be able to update there ip if it has changed to there new one to grant them access so i need to keep in mind that it would be easyer to do this if i have external list off ips in some kind off database any help is apreshiated

  Read the article

• Generate or update a PDF to include an encrypted, hidden watermark?

  - by Dave Jarvis

  Background Using LaTeX to write a book. When a user purchases the book, the PDF will be generated automatically. Problem The PDF should have a watermark that includes the person's name and contact information. Question What software meets the following criteria: Applies encrypted, invisible watermarks to a PDF Open Source Platform independent (Linux, Windows) Fast (marks a 200 page PDF in under 1 second) Batch processing (exclusively command-line driven) Collusion-attack resistant Non-fragile (e.g., PDF - EPS - PDF still contains the watermark) Well documented (shows example usages) Ideas & Resources Some thoughts and findings: Natural language processing (NLP) watermarks. Apply steganography on a randomly selected image. http://openstego.sourceforge.net/cmdline.html The problem with NLP is that grammatical errors can be introduced. The problem with steganography is that the images are sourced from an image cache, and so recreating that cache with watermarked images will impart a delay when generating the PDF (I could just delete one image from the cache, but that's not an elegant solution). Thank you!

  Read the article

• Get OWA and ActiveSync working on server using HTTP redirect in IIS 7

  - by eric

  We have two servers on our LAN. One is a Windows 2003 Server domain controller running Exchange 2003. The other is a stand-alone Windows 2008 server running IIS 7. Our company website runs on the IIS 7 (2008) server, so the firewall forwards port 80 to this. How can I get OWA and ActiveSync to work with this setup? And without using SSL. I have tried setting up a website on the IIS 7 box (mail.ourdomain.com) and using HTTP redirect to point to http://mailserver/exchange, but this doesn't work. Do we have to purchase an SSL certificate for this to work?

  Read the article

• International search: how to show different domains in Google+ Local?

  - by Baumr

  Background A site has multiple ccTLDs: example.com for people in the US, example.co.uk for UK users, example.de for Germany, example.fr for France, etc. Searching for certain city keywords will return a list of Google+ Local (formerly Places): Each links to the corresponding company website that is visible. Problem When searching on www.google.de, the domain of the site intended for US users (example.com) appears instead of the corresponding ccTLD (example.de) aimed at German users. This applies to all languages. In my opinion and for the purposes of this business, it's not good user experience: searchers would most likely prefer to book on a site localized for them (e.g. in their language and currency). Question Is it possible to return different ccTLDs in these local search listings for users across the globe? Currently, Google+ Local seems to only support supports adding a single "Website" field. Solutions I have considered Creating duplicate Google Places listings for each URL would be spammy (and not viable when there's 100s of locations, each needing a listing in 8 languages). I don't see the hreflang annotation helping either, and GWMT geotargeting is already set.

  Read the article

• Googlebot visit but no cache update - why?

  - by Mick

  I have made a new plain vanilla HTML website. I have been making regular modifications to it on an almost daily basis. The site is hosted by hostmonster and as part of their service they offer "awstats" to let you know assorted details of visitors to the site. One thing is puzzling me. According to awstats, a "robot/spider" calling itself "Googlebot" visited my site as recently as today (28th June 2011), but when I find my site on google (e.g. by searching for "full reserve banking") the cache is dated only the 5th June. I always thought that a visit from the google robot was synonymous with a cache update. Am I wrong? Or have I accidentally put something in the site telling google that nothing has been updated? EDIT: It seems a moderator has removed the name of my website, so there is now no chance that anyone could check out if I had made some error on my site :-( ... but anyway, in answer to paulmorriss' question, here is what aw stats was telling me:

  Read the article

• nVidia driver is not installed for x64 Windows 7 (Vaio VGN-SZ460N)

  - by Sergey Osypchuk

  I just upgraded memory to 4GB for Sony Vaio VGN-SZ460N laptop and trying to install Windows 7 x64. All works fine with default drivers, except video - I am not able to set resolution more than 1024x768. Technical specification says that this model is using: Chipset : Intel® 945GM Processor : NVIDIA® GeForce® Go 7400 notebook graphics processing unit (GPU) and Intel® Graphics Media Accelerator 950 I was trying to use Intel 945GM driver, for Windows 7 Ultimate x64 and get error: This computer does not meet the mininum requirements for installing the software Also, I was trying to download nVidia GeForce Go 7400 x64 but it says that there is no compatible hardware. Actually, it has disclaimer that those drivers doesn't work for Sony vaio and recomendation to use OEM website. Sony website has only 32-bit version of driver which says that it cannot be installed and x64 should be used... Any ideas?

  Read the article

• An adequate message authentication code for REST

  - by Andras Zoltan

  My REST service currently uses SCRAM authentication to issue tokens for callers and users. We have the ability to revoke caller privileges and ban IPs, as well as impose quotas to any type of request. One thing that I haven't implemented, however, is MAC for requests. As I've thought about it more, for some requests I think this is needed, because otherwise tokens can be stolen and before we identify this and deactivate the associated caller account, some damage could be done to our user accounts. In many systems the MAC is generated from the body or query string of the request, however this is difficult to implement as I'm using the ASP.Net Web API and don't want to read the body twice. Equally importantly I want to keep it simple for callers to access the service. So what I'm thinking is to have a MAC calculated on: the url, possibly minus query string the verb the request ip (potentially is a barrier on some mobile devices though) utc date and time when the client issues the request. For the last one I would have the client send that string in a request header, of course - and I can use it to decide whether the request is 'fresh' enough. My thinking is that whilst this doesn't prevent message body tampering it does prevent using a model request to use as a template for different requests later on by a malicious third party. I believe only the most aggressive man in the middle attack would be able to subvert this, and I don't think our services offer any information or ability that is valuable enough to warrant that. The services will use SSL as well, for sensitive stuff. And if I do this, then I'll be using HMAC-SHA-256 and issuing private keys for HMAC appropriately. Does this sound enough? Have I missed anything? I don't think I'm a beginner when it comes to security, but when working on it I always. am shrouded in doubt, so I appreciate having this community to call upon!

  Read the article

• How to ban fans from a specific country - Facebook

  - by Lukas

  my question is kind of weird, because i want thousands of fans to dislike my page! Since this is not a common problem I hardly can find anything about it! my facebook page just got spammed with thousands of "fans" from a specific country. When I set a coountry restriction for that country, will the fans be banned and the number of fans be the same as before the spam-attack? I really need to get rid of those fans. I already restricted that country and facebook actually updated the chart where I can see where my fans are coming from. So fb knows that I have those "fans", but the number of likes remains the same... Any idea? It is not possible to ban every fan 1 by 1 because I can only see the last 100 fans.

  Read the article

• Ways for managing the installation and configuration of various software applications and settings i

  - by EmpireJones

  What are some ways for managing the installation and configuration of various software applications and settings in group of linux development and server computers? Is a set of basic scripts a good means of attack? I was thinking about just having a ton of scripts, such as: setup_dev_env [install|uninstall|reinstall] setup_nfs [...] setup_nfs_share [...] setup_http [...] setup_memcache_node [...] Is there any better method? It would be nice to be able to "upgrade" an installation script too, for example, to change common development settings.

  Read the article

< Previous Page | 251 252 253 254 255 256 257 258 259 260 261 262  | Next Page >