Search Results

Search found 18933 results on 758 pages for 'dynamic programming'.

Page 436/758 | < Previous Page | 432 433 434 435 436 437 438 439 440 441 442 443  | Next Page >

  • Installing a DHCP Service On Win2k8 ( Windows Server 2008 )

    - by Akshay Deep Lamba
    Introduction Dynamic Host Configuration Protocol (DHCP) is a core infrastructure service on any network that provides IP addressing and DNS server information to PC clients and any other device. DHCP is used so that you do not have to statically assign IP addresses to every device on your network and manage the issues that static IP addressing can create. More and more, DHCP is being expanded to fit into new network services like the Windows Health Service and Network Access Protection (NAP). However, before you can use it for more advanced services, you need to first install it and configure the basics. Let’s learn how to do that. Installing Windows Server 2008 DHCP Server Installing Windows Server 2008 DCHP Server is easy. DHCP Server is now a “role” of Windows Server 2008 – not a windows component as it was in the past. To do this, you will need a Windows Server 2008 system already installed and configured with a static IP address. You will need to know your network’s IP address range, the range of IP addresses you will want to hand out to your PC clients, your DNS server IP addresses, and your default gateway. Additionally, you will want to have a plan for all subnets involved, what scopes you will want to define, and what exclusions you will want to create. To start the DHCP installation process, you can click Add Roles from the Initial Configuration Tasks window or from Server Manager à Roles à Add Roles. Figure 1: Adding a new Role in Windows Server 2008 When the Add Roles Wizard comes up, you can click Next on that screen. Next, select that you want to add the DHCP Server Role, and click Next. Figure 2: Selecting the DHCP Server Role If you do not have a static IP address assigned on your server, you will get a warning that you should not install DHCP with a dynamic IP address. At this point, you will begin being prompted for IP network information, scope information, and DNS information. If you only want to install DHCP server with no configured scopes or settings, you can just click Next through these questions and proceed with the installation. On the other hand, you can optionally configure your DHCP Server during this part of the installation. In my case, I chose to take this opportunity to configure some basic IP settings and configure my first DHCP Scope. I was shown my network connection binding and asked to verify it, like this: Figure 3: Network connection binding What the wizard is asking is, “what interface do you want to provide DHCP services on?” I took the default and clicked Next. Next, I entered my Parent Domain, Primary DNS Server, and Alternate DNS Server (as you see below) and clicked Next. Figure 4: Entering domain and DNS information I opted NOT to use WINS on my network and I clicked Next. Then, I was promoted to configure a DHCP scope for the new DHCP Server. I have opted to configure an IP address range of 192.168.1.50-100 to cover the 25+ PC Clients on my local network. To do this, I clicked Add to add a new scope. As you see below, I named the Scope WBC-Local, configured the starting and ending IP addresses of 192.168.1.50-192.168.1.100, subnet mask of 255.255.255.0, default gateway of 192.168.1.1, type of subnet (wired), and activated the scope. Figure 5: Adding a new DHCP Scope Back in the Add Scope screen, I clicked Next to add the new scope (once the DHCP Server is installed). I chose to Disable DHCPv6 stateless mode for this server and clicked Next. Then, I confirmed my DHCP Installation Selections (on the screen below) and clicked Install. Figure 6: Confirm Installation Selections After only a few seconds, the DHCP Server was installed and I saw the window, below: Figure 7: Windows Server 2008 DHCP Server Installation succeeded I clicked Close to close the installer window, then moved on to how to manage my new DHCP Server. How to Manage your new Windows Server 2008 DHCP Server Like the installation, managing Windows Server 2008 DHCP Server is also easy. Back in my Windows Server 2008 Server Manager, under Roles, I clicked on the new DHCP Server entry. Figure 8: DHCP Server management in Server Manager While I cannot manage the DHCP Server scopes and clients from here, what I can do is to manage what events, services, and resources are related to the DHCP Server installation. Thus, this is a good place to go to check the status of the DHCP Server and what events have happened around it. However, to really configure the DHCP Server and see what clients have obtained IP addresses, I need to go to the DHCP Server MMC. To do this, I went to Start à Administrative Tools à DHCP Server, like this: Figure 9: Starting the DHCP Server MMC When expanded out, the MMC offers a lot of features. Here is what it looks like: Figure 10: The Windows Server 2008 DHCP Server MMC The DHCP Server MMC offers IPv4 & IPv6 DHCP Server info including all scopes, pools, leases, reservations, scope options, and server options. If I go into the address pool and the scope options, I can see that the configuration we made when we installed the DHCP Server did, indeed, work. The scope IP address range is there, and so are the DNS Server & default gateway. Figure 11: DHCP Server Address Pool Figure 12: DHCP Server Scope Options So how do we know that this really works if we do not test it? The answer is that we do not. Now, let’s test to make sure it works. How do we test our Windows Server 2008 DHCP Server? To test this, I have a Windows Vista PC Client on the same network segment as the Windows Server 2008 DHCP server. To be safe, I have no other devices on this network segment. I did an IPCONFIG /RELEASE then an IPCONFIG /RENEW and verified that I received an IP address from the new DHCP server, as you can see below: Figure 13: Vista client received IP address from new DHCP Server Also, I went to my Windows 2008 Server and verified that the new Vista client was listed as a client on the DHCP server. This did indeed check out, as you can see below: Figure 14: Win 2008 DHCP Server has the Vista client listed under Address Leases With that, I knew that I had a working configuration and we are done!

    Read the article

  • Is it okay to be generalist?

    - by Londoner
    I work at a ~50 employee company (UK), where all the technical people do a bit of everything. Specialising in anything for very long (6 months) is discouraged. For example, last week, I built a new Debian webserver, refactored some Perl, sat on a sales phone call, did a tape backup, reviewed code, built and deployed an RPM, gave opinions about x, y, z... With such a work scheme, I have gained a general knowledge how many things work, and pretty specific knowledge. I maybe program for 5 hours a week, despite officially being a developer. Does anyone else work like this, (or is this company unique)? Is it a problem to have skills developed in this way? (i.e. know a bit about everything in a certain domain, rather than know everything about say, one programming language?) Is it okay to be a generalist?

    Read the article

  • GDC 2012: From Console to Chrome

    GDC 2012: From Console to Chrome (Pre-recorded GDC content) Cutting-edge HTML5 brings high performance console-style 3d games to the browser, but developing a modern HTML5 game engine can be a challenge. Adapting to HTML5 and Javascript can be bewildering to game programmers coming from C / C++. This talk is an overview of the tools, techniques, and topics you need to be familiar with to adapt to programming high performance 3D games for the web. Topics will include cutting edge HTML5 APIs, writing high performance Javascript, and profiling / debugging tools. Speaker: Lilli Thompson From: GoogleDevelopers Views: 3845 80 ratings Time: 01:02:14 More in Science & Technology

    Read the article

  • Recommendation for a platform to teach game development to kids [closed]

    - by Moshe Kravchik
    My 11 years old son decided he want to create a Web game. He does not know much about programming and I never did any game development so I'm not the best teacher of the topic. On one hand I really want him to get into building things and doing his own game sounds perfect. So I'd like to find a way to keep him interested and progressing by himself. This means that I'm looking for a platform that is: 1. Simple for understanding and use, intuitive interface 2. Powerful 3. Good tools, preferrably free 4. Significant community for questions and tips 5. Localization - my son's English is quite poor (native Hebrew). We looked at Alice, but it was too limited in its abilities and isn't really a Web game building platform. HTML/CSS and Javascript - too low level for a kid to keep the interest. What would you recommend?

    Read the article

  • WebForms vs MVC (again)

    There's a new video up on www.asp.net which aims to help developers pick between ASP.NET WebForms and ASP.NET MVC. The video boils down to 5 benefits per technology which Microsoft thinks you should consider. Let's go over the points, shall we? First, ASP.NET WebForms: 1 - Familiar control and event base programming model The claim here is that the ASP.NET model is comfortable for WinForm programmers (thankfully this unbiased analysis left out who it's more familiar for). This is largely...Did you know that DotNetSlackers also publishes .net articles written by top known .net Authors? We already have over 80 articles in several categories including Silverlight. Take a look: here.

    Read the article

  • Why is String Templating Better Than String Concatenation from an Engineering Perspective?

    - by stephen
    I once read (I think it was in "Programming Pearls") that one should use templates instead of building the string through the use of concatenation. For example, consider the template below (using C# razor library) <in a properties file> Browser Capabilities Type = @Model.Type Name = @Model.Browser Version = @Model.Version Supports Frames = @Model.Frames Supports Tables = @Model.Tables Supports Cookies = @Model.Cookies Supports VBScript = @Model.VBScript Supports Java Applets = @Model.JavaApplets Supports ActiveX Controls = @Model.ActiveXControls and later, in a separate code file private void Button1_Click(object sender, System.EventArgs e) { BrowserInfoTemplate = Properties.Resources.browserInfoTemplate; // see above string browserInfo = RazorEngine.Razor.Parse(BrowserInfoTemplate, browser); ... } From a software engineering perspective, how is this better than an equivalent string concatentation, like below: private void Button1_Click(object sender, System.EventArgs e) { System.Web.HttpBrowserCapabilities browser = Request.Browser; string s = "Browser Capabilities\n" + "Type = " + browser.Type + "\n" + "Name = " + browser.Browser + "\n" + "Version = " + browser.Version + "\n" + "Supports Frames = " + browser.Frames + "\n" + "Supports Tables = " + browser.Tables + "\n" + "Supports Cookies = " + browser.Cookies + "\n" + "Supports VBScript = " + browser.VBScript + "\n" + "Supports JavaScript = " + browser.EcmaScriptVersion.ToString() + "\n" + "Supports Java Applets = " + browser.JavaApplets + "\n" + "Supports ActiveX Controls = " + browser.ActiveXControls + "\n" ... }

    Read the article

  • Python's Django or Delphi's IntraWeb?

    - by Azad Salahli
    Well, forgive me if it is an off-topic question. I have no knowledge about web programming, so I apologize in advance, if it is a stupid question. I will start to build a web based application. To be more specific, I will make a webpage which will have components like buttons, textboxes and etc. It will use a database to store information. My question is, which one is better to learn for that purpose? Python's Django or Delphi's IntraWeb? I know both Delphi and Python(although I know Delphi better).

    Read the article

  • Getting started as a programmer -- school or self-study?

    - by Cyberherbalist
    My son who has is married with two small children has decided that he needs a change of career, and is considering getting into programming. He would do well in the field, I am certain, but I am uncertain how to advise him with regards to a lengthy course of schooling, or just try to learn 'on the job", so to speak. I suspect that if he doesn't ultimately get at least an associate degree in program (like his old man), that his job possibilities are going to be very constrained. This isn't the Dot-Com Bubble, after all, when they'd hire you if you could spell c-o-m-p-u-t-e-r because they needed bodies and the ability to fog a mirror wasn't quite enough. Should he go for a full program at the university, a two-year program (he already has a 2-year degree in video production, so he's got the general ed requirements whipped), or does anyone think self-study alone might be enough? To get started, anyway. I started back in 1987 with COBOL and a 2-year degree, which seemed the minimum at the time, but perhaps things are different now?

    Read the article

  • Are technical books easy to read on the Kindle (or other small screens) [closed]

    - by Peter Recore
    Possible Duplicate: eBook editions of programming books I am considering getting a kindle or other e reader. (Kindle is my top choice for the eink vs lcd factor) I have been able to try reading fiction on a Kindle, and it seemed pretty nice, even with the small screen. However, most books I buy are actually technical books, which tend to have figures, code samples, and other odd things. How well do the various ereaders handle books like this? In particular, does the kindle render code samples or figures in an easy to read way?

    Read the article

  • How to program for constraints/rules

    - by Gaurav
    First the background, during interviews in the past, many times I have been asked to design some or other variation of card game as programming puzzle, and I have tried to design it in OO way, but I have never been satisfied with my solutions. However it was not until recently that I realized that I had been approaching the problem from the wrong direction. Specifically I was trying to solve the problem by modeling individual card as an object. Problem with this is individual cards don't have any non-trivial intrinsic behavior and therefore are not suitable (or primary) candidate as objects. What is interesting and important about cards are rules and constraints, such as there could be only four suits, or only thirteen cards in each suit. Of course, then there are any number of rules for games. So my questions are Are there any idioms/constructs/patterns to program for rules & constraints. How many in 1 can be applied in conjunction with OO paradigm.

    Read the article

  • Upgrading in java web development

    - by Vladimir Ivanov
    I'm a java web developer for nearly 3 years. Always trying to learn more and be better but still I feel that the amount of knowledge is not that good as I want. The knowledge in some places still seems to be non-systematic and don't provide a very strong base to solve the problems as good as I want to do it. The example I have is my senior developer, whose solutions are always more efficient and beautiful. So, the question is rather simple and hard the same time. What is the right way to get my knowlege be more systematic and therefore improve it's quality. I understand that there is no practically good answer for the all java programming, so let's focus on the modern java web or nearly web technologies: JSF 2.0 JPA2 and Hibernate as persistence provider Web services and Java SE as a core. What methodologies or books or learning technics lead to the strong knowledge base within the given knowledge area?

    Read the article

  • Win a free pass for Silverlight Tour in Vancouver, D-10!!

    - by pluginbaby
    As you may know, the Silverlight Tour Training is coming to Vancouver in may. If you plan to attend, this might be interesting: you can win one free pass to this Vancouver Silverlight 4 workshop in May 3-6, 2010 ($1,995 CAD value) by visiting the SilverlightShow.net community website and participate in the draw! (the pass does not include travel and hotel, only the course). Take the chance to get an intensive course on Silverlight 4 in this four-day training! Learn the ins and outs of design, development and server-side programming with Silverlight in an exciting way, through a mix of lessons, demonstrations and hands-on labs. Enter the draw before April 1st, 2010! The winner will be announced on April 2nd, 2010 in www.silverlightshow.net. Good Luck! Technorati Tags: Silverlight training,Silverlight Tour

    Read the article

  • Drawing territories border in 2d map

    - by Gabriel A. Zorrilla
    I'm programming a little web strategy game. In the country map I pretend to display each country with a national color. The issue is how to render the borders in a simple and efficient way. Right now I'm planning to set a field to each tile called "border" with values from 0 to 8. The algorithm would check for EVERY tile is its adjacent has a different "owner". If the tile is inside the territory, the border value would be 0, because would not have adjacent any tile with different owner, if not, would vary between 1 (north) clockwise to 9 (north-west) and then draw the border. I find this simple but too processor-intensive. Are there any other "pro" choices to render territories borders?

    Read the article

  • Online Multiplayer Game Architecture [on hold]

    - by Eric
    I am just starting to research online multiplayer game development and I have a high-level architectural question regarding how online multiple games function. I have server-side and client-side programming experience, and I understand how AJAX-esque transfer protocol operates. What I don't understand yet is how online multiple fits into all of that. For example, an online Tetris multiplayer game. Would both players have the entire Tetris game built out on their client-side and then get pushed "moves" from the other player via some AJAX-esque mechanism, in which case each client would have to be constantly listening via JavaScript for inbound "moves" and update the client appropriately? Or would each client build out the aesthetics and run a virtual server per game to which each client connects and thus pull and push commands in real-time via something like web sockets? I apologize if this question is too high-level and general, but I couldn't find anything online that offered this high-level of a perspective on the topic.

    Read the article

  • Begining a simple game development. [closed]

    - by Vinod Maurya
    Hi, I have searched a lot about beginning the game development but I didn't found the appropriate answer which I am looking in fact I got more confused. What I want to know is which game engine, modeling programs (I know only 2, please tell me if there is some other) to use? For the beginning, I want to use some free game engines for learning purpose. I am an absolute beginner in game development. I have a good programming experience in C++, VB, Java, C#. Thanks.

    Read the article

  • What are the most important OO skills to show off in the job hunt?

    - by Kat
    I am in the market for new employment, and found a position were they asked me to create a programming sample based off an assignment. I blew the sample trying to get it done quickly one night, and got declined - only to be given a second chance recently. The concern was that I didn't really demonstrate object oriented knowledge. I've rethought my approach but I figure it's worth asking: if you were hiring someone for an OO position, what skills would you most want to see them demonstrate they had a firm grasp on? I want to be sure that I'm missing anything important this time around.

    Read the article

  • Choosing 3D modeling software Maya or 3D max?

    - by Kenneth J
    I've am a developer whose has spent most of my programming life developing web and business applications. I want to try my hand at something more challenging (but stay in the comfort of Visual Studio) ...perhaps XNA. Want 3D modeling software would be best for someone developing XNA? I have played with 3d MAX and Maya but never really did anything too involved. What are the pros and cons between them (in terms of game development)? Does one win out over the other for game development? Or is it pretty much just preference? I am new to game development and just trying to figure out the best tools to use before I really started. Any advice or other suggections would be greatly appreciated.

    Read the article

  • Compiling C++ Source code?iostream.h not found?

    - by gabriel
    I do not want to discuss about C++ or any programming language!I just want to know what am i doing wrong with linux ubuntu about compiling helloworld.cpp! I am learning C++ so my steps are: open hello.cpp in vim and write this #include <iostream.h> int main() { cout << "Hello World!\n";` return 0; } So, after that i tried in the terminal this g++ hello.cpp AND the output is hello.cpp:1:22: fatal error: iostream.h: No such file or directory compilation terminated. What do you suggest? Any useful step by step guide for me?Thanks!

    Read the article

  • Will taking two years off for school destroy my 4 year old development career?

    - by rsteckly
    Hi, I know some people have asked about getting back into programming after a break and this is a potential duplicate. I just am in a position where I can go back to school in Stat/Applied Math. But I'm very worried about the impact it will have on my career and ability to find a job afterwards. I have 3 years experience in .NET on top of a couple of years in PHP. Right now, I'm a senior software engineer. Do you think taking two years off to do math is going to dramatically hurt my marketability?

    Read the article

  • Professional iOS Development as a Backup Career [closed]

    - by New Coder
    I am a research chemist by day and I am a self-taught hobbyist iOS programmer by night. I am in the process of developing a moderately complex iOS app and hope to launch it within a month or two. I love everything about iOS development (and programming in general). I want to know if iOS development could become a backup career for me if I loose my job. My question: Let's say I had a couple of apps in the app store, a solid foundation in objective-C and the apple frameworks and basic knowledge on network integrated apps. Without a formal CS degree, what other experience/knowledge would I need to land a job as a professional iOS developer? Forgive me if this question is out of bounds for this forum. If it is, suggestions on where to post such a question would be appreciated.

    Read the article

  • Gilda Garretón, a Java Developer and Parallelism Computing Researcher

    - by Yolande
    In a new interview titled “Gilda Garretón, a Java Developer and Parallelism Computing Research,” Garretón shares her first-hand experience developing with Java and Java 7 for very large-scale integration (VLSI) of computer-aided design (CAD). Garretón gives an insightful overview of how Java is contributing to the parallelism development and to the Electric VLSI Design Systems, an open source VLSI CAD application used as a research platform for new CAD algorithms as well as the research flow for hardware test chips.  Garretón considers that parallelism programming is hard and complex, yet important developments are taking place.  "With the addition of the concurrent package in Java SE 6 and the Fork/Join feature in Java SE 7, developers have a chance to rely more on existing frameworks and dedicate more time to the essence of their parallel algorithms." Read the full article here  

    Read the article

  • How does whitespace affect Python code?

    - by Codereview
    I've started programming about a year ago, I've learned the C and C++ languages and bits of Java. Recently I've started to learn the Python language (Notable: I'm using the Eclipse IDE). I'm used to formatting my code with whitespace, placing statements a bit to the right of my code for easier readability. Since I started working with Python it seems whitespace is a problem, I get some unnecessary whitespace warnings, and my code gets underlined (In eclipse). After a while I figured Python is very restrictive about whitespace for some reason, so I've been looking for the effects of whitespace on Python code. How does it affect the code? Does the code work different with unnecessary whitespace?

    Read the article

  • Should I avoid SharePoint Development in Visual Studio?

    - by SaphuA
    Hello, Not long ago I started an internship at a company that supplies SharePoint consultancy, hosting and development. While their consultancy seems to be pretty good and solid, I feel their development department lacks direction. The reason for this, most likely, is that they stopped outsourcing not too long ago. One thing that I've frequently bumped my head into is the following: My supervisor strongly insists that everything that can be done natively in SharePoint (somehow this includes editing xslt files in Designer) should be done in SharePoint. Even if this results in longer development time (at least when they make me write XSLT) and reduced usability. Her main arguments for this are: Better maintainability Editing the functionality doesn't require programming knowledge I feel the company is a little biassed and I am unable to get a decent discussion going. This is why I am looking for other places to get some responses on the subject (and not only on the arguments of my supervisor, but more on the subject in general). Kind regards

    Read the article

  • Compiler Dependencies [closed]

    - by asghar ashgari
    I'm a newbie researcher who's passion is programming languages (Web era). I'm wondering why all the Web frameworks and Web-based general purposes languages, have a huge number of dependencies when you want to install and then use (e.g., extend, alternate, etc.) their compilers. For example, Ruby on Rails or Scala. If I want to download their source code, and try to build it again, to me at least, feels like a can of worms. I have a MAC, so I need to install MACports, then update my XCode, then get the compiler source code that has bunch of other dependencies, then its hard to set things up; just to see the installed open-source compiler works fine.

    Read the article

  • A New Threat To Web Applications: Connection String Parameter Pollution (CSPP)

    - by eric.maurice
    Hi, this is Shaomin Wang. I am a security analyst in Oracle's Security Alerts Group. My primary responsibility is to evaluate the security vulnerabilities reported externally by security researchers on Oracle Fusion Middleware and to ensure timely resolution through the Critical Patch Update. Today, I am going to talk about a serious type of attack: Connection String Parameter Pollution (CSPP). Earlier this year, at the Black Hat DC 2010 Conference, two Spanish security researchers, Jose Palazon and Chema Alonso, unveiled a new class of security vulnerabilities, which target insecure dynamic connections between web applications and databases. The attack called Connection String Parameter Pollution (CSPP) exploits specifically the semicolon delimited database connection strings that are constructed dynamically based on the user inputs from web applications. CSPP, if carried out successfully, can be used to steal user identities and hijack web credentials. CSPP is a high risk attack because of the relative ease with which it can be carried out (low access complexity) and the potential results it can have (high impact). In today's blog, we are going to first look at what connection strings are and then review the different ways connection string injections can be leveraged by malicious hackers. We will then discuss how CSPP differs from traditional connection string injection, and the measures organizations can take to prevent this kind of attacks. In web applications, a connection string is a set of values that specifies information to connect to backend data repositories, in most cases, databases. The connection string is passed to a provider or driver to initiate a connection. Vendors or manufacturers write their own providers for different databases. Since there are many different providers and each provider has multiple ways to make a connection, there are many different ways to write a connection string. Here are some examples of connection strings from Oracle Data Provider for .Net/ODP.Net: Oracle Data Provider for .Net / ODP.Net; Manufacturer: Oracle; Type: .NET Framework Class Library: - Using TNS Data Source = orcl; User ID = myUsername; Password = myPassword; - Using integrated security Data Source = orcl; Integrated Security = SSPI; - Using the Easy Connect Naming Method Data Source = username/password@//myserver:1521/my.server.com - Specifying Pooling parameters Data Source=myOracleDB; User Id=myUsername; Password=myPassword; Min Pool Size=10; Connection Lifetime=120; Connection Timeout=60; Incr Pool Size=5; Decr Pool Size=2; There are many variations of the connection strings, but the majority of connection strings are key value pairs delimited by semicolons. Attacks on connection strings are not new (see for example, this SANS White Paper on Securing SQL Connection String). Connection strings are vulnerable to injection attacks when dynamic string concatenation is used to build connection strings based on user input. When the user input is not validated or filtered, and malicious text or characters are not properly escaped, an attacker can potentially access sensitive data or resources. For a number of years now, vendors, including Oracle, have created connection string builder class tools to help developers generate valid connection strings and potentially prevent this kind of vulnerability. Unfortunately, not all application developers use these utilities because they are not aware of the danger posed by this kind of attacks. So how are Connection String parameter Pollution (CSPP) attacks different from traditional Connection String Injection attacks? First, let's look at what parameter pollution attacks are. Parameter pollution is a technique, which typically involves appending repeating parameters to the request strings to attack the receiving end. Much of the public attention around parameter pollution was initiated as a result of a presentation on HTTP Parameter Pollution attacks by Stefano Di Paola and Luca Carettoni delivered at the 2009 Appsec OWASP Conference in Poland. In HTTP Parameter Pollution attacks, an attacker submits additional parameters in HTTP GET/POST to a web application, and if these parameters have the same name as an existing parameter, the web application may react in different ways depends on how the web application and web server deal with multiple parameters with the same name. When applied to connections strings, the rule for the majority of database providers is the "last one wins" algorithm. If a KEYWORD=VALUE pair occurs more than once in the connection string, the value associated with the LAST occurrence is used. This opens the door to some serious attacks. By way of example, in a web application, a user enters username and password; a subsequent connection string is generated to connect to the back end database. Data Source = myDataSource; Initial Catalog = db; Integrated Security = no; User ID = myUsername; Password = XXX; In the password field, if the attacker enters "xxx; Integrated Security = true", the connection string becomes, Data Source = myDataSource; Initial Catalog = db; Integrated Security = no; User ID = myUsername; Password = XXX; Intergrated Security = true; Under the "last one wins" principle, the web application will then try to connect to the database using the operating system account under which the application is running to bypass normal authentication. CSPP poses serious risks for unprepared organizations. It can be particularly dangerous if an Enterprise Systems Management web front-end is compromised, because attackers can then gain access to control panels to configure databases, systems accounts, etc. Fortunately, organizations can take steps to prevent this kind of attacks. CSPP falls into the Injection category of attacks like Cross Site Scripting or SQL Injection, which are made possible when inputs from users are not properly escaped or sanitized. Escaping is a technique used to ensure that characters (mostly from user inputs) are treated as data, not as characters, that is relevant to the interpreter's parser. Software developers need to become aware of the danger of these attacks and learn about the defenses mechanism they need to introduce in their code. As well, software vendors need to provide templates or classes to facilitate coding and eliminate developers' guesswork for protecting against such vulnerabilities. Oracle has introduced the OracleConnectionStringBuilder class in Oracle Data Provider for .NET. Using this class, developers can employ a configuration file to provide the connection string and/or dynamically set the values through key/value pairs. It makes creating connection strings less error-prone and easier to manager, and ultimately using the OracleConnectionStringBuilder class provides better security against injection into connection strings. For More Information: - The OracleConnectionStringBuilder is located at http://download.oracle.com/docs/cd/B28359_01/win.111/b28375/OracleConnectionStringBuilderClass.htm - Oracle has developed a publicly available course on preventing SQL Injections. The Server Technologies Curriculum course "Defending Against SQL Injection Attacks!" is located at http://st-curriculum.oracle.com/tutorial/SQLInjection/index.htm - The OWASP web site also provides a number of useful resources. It is located at http://www.owasp.org/index.php/Main_Page

    Read the article

< Previous Page | 432 433 434 435 436 437 438 439 440 441 442 443  | Next Page >