Search Results

Search found 25440 results on 1018 pages for 'agent based modeling'.

Page 654/1018 | < Previous Page | 650 651 652 653 654 655 656 657 658 659 660 661  | Next Page >

  • CodePlex Daily Summary for Tuesday, June 07, 2011

    CodePlex Daily Summary for Tuesday, June 07, 2011Popular ReleasesSCCM Client Actions Tool: SCCM Client Actions Tool v0.5: SCCM Client Actions Tool v0.5 is currently the most stable version and includes all of the functionality requested so far. It comes as a ZIP file that contains three files: ClientActionsTool.hta – The tool itself. Cmdkey.exe – command line tool for managing cached credentials. This is needed for alternate credentials feature when running the HTA on Windows XP. Cmdkey.exe is natively available starting from Windows Vista. Config.ini – A configuration file for default settings. This file is...AcDown????? - Anime&Comic Downloader: AcDown????? v3.0 Beta5: ??AcDown?????????????,??????????????,????、????。?????Acfun????? ????32??64? Windows XP/Vista/7 ????????????? ??:????????Windows XP???,?????????.NET Framework 2.0???(x86)?.NET Framework 2.0???(x64),?????"?????????"??? ??v3.0 Beta5 ?????????? ???? ?? ???????? ???"????????"?? ????????????? ????????/???? ?? ???"????"??? ?? ??????????? ?? ?? ??????????? ?? ?????????????????? ??????????????????? ???????????????? ????????????Discussions???????? ????AcDown??????????????VFPX: GoFish 4 Beta 1: Current beta is Build 144 (released 2011-06-07 ) See the GoFish4 info page for details and video link: http://vfpx.codeplex.com/wikipage?title=GoFishOnTopReplica: Release 3.3.2: Incremental update over 3.3 and 3.3.1. Added Polish language translation (thanks to Jan Romanczyk). Added German language translation (thanks to Eric Hoffmann). Fixed some localization issues.SQL Compact Query Analyzer: Build 0.3.0.0: Beta build of SQL Compact Query Analyzer Features: - Execute SQL Queries against a SQL Server Compact Edition database - Easily edit the contents of the database - Supports SQLCE 3.1, 3.5 and 4.0 Prerequisites: - .NET Framework 4.0ShowUI: Write-UI -in PowerShell: ShowUI: ShowUI is a PowerShell module to help you write rich user interfaces in script.SharePoint 2010 FBA Pack: SharePoint 2010 FBA Pack 1.0.3: Fixed User Management screen when "RequiresQuestionAndAnswer" set to true Reply to Email Address can now be customized User Management page now only displays users that reside in the membership database Web parts have been changed to inherit from System.Web.UI.WebControls.WebParts.WebPart, so that they will display on anonymous application pages For installation and configuration steps see here.Babylon Toolkit: Babylon.Toolkit v1.0.4: Note about samples: In order to run samples, you need to configure visual studio to run them as an "Out-of-browser application". in order to do that, go to the property page of a sample project, go to the Debug tab, and check the "Out-of-browser application" radio. New features : New Effects BasicEffect3Lights (3 dir lights instead of 1 position light) CartoonEffect (work in progress) SkinnedEffect (with normal and specular map support) SplattingEffect (for multi-texturing with smooth ...SizeOnDisk: 1.0.8.2: With installerTerrariViewer: TerrariViewer v2.5: Added new items associated with Terraria v1.0.3 to the character editor. Fixed multiple bugs with Piggy Bank EditorySterling NoSQL OODB for .NET 4.0, Silverlight 4 and 5, and Windows Phone 7: Sterling OODB v1.5: Welcome to the Sterling 1.5 RTM. This version is backwards compatible without modification to the 1.4 beta. For the 1.0, you will need to upgrade your database. Please see this discussion for details. You must modify your 1.0 code for persistence. The 1.5 version defaults to an in-memory driver. To save to isolated storage or use one of the new mechanisms, see the available drivers and pass an instance of the appropriate one to your database (different databases may use different drivers). ...EnhSim: EnhSim 2.4.6 BETA: 2.4.6 BETAThis release supports WoW patch 4.1 at level 85 To use this release, you must have the Microsoft Visual C++ 2010 Redistributable Package installed. This can be downloaded from http://www.microsoft.com/downloads/en/details.aspx?FamilyID=A7B7A05E-6DE6-4D3A-A423-37BF0912DB84 To use the GUI you must have the .NET 4.0 Framework installed. This can be downloaded from http://www.microsoft.com/downloads/en/details.aspx?FamilyID=9cfb2d51-5ff4-4491-b0e5-b386f32c0992 - Added in the proper...Grammar and Spell Checking Plugin for Windows Live Writer: Grammar Checker Plugin v1.0: First version of the grammar checker plugin for Windows Live Writer.patterns & practices: Project Silk: Project Silk Community Drop 10 - June 3, 2011: Changes from previous drop: Many code changes: please see the readme.mht for details. New "Application Notifications" chapter. Updated "Server-Side Implementation" chapter. Guidance Chapters Ready for Review The Word documents for the chapters are included with the source code in addition to the CHM to help you provide feedback. The PDF is provided as a separate download for your convenience. Installation Overview To install and run the reference implementation, you must perform the fol...Claims Based Identity & Access Control Guide: Release Candidate: Highlights of this release This is the release candidate drop of the new "Claims Identity Guide" edition. In this release you will find: All code samples, including all ACS v2: ACS as a Federation Provider - Showing authentication with LiveID, Google, etc. ACS as a FP with Multiple Business Partners. ACS and REST endpoints. Using a WP7 client with REST endpoints. All ACS specific chapters. Two new chapters on SharePoint (SSO and Federation) All revised v1 chapters We are now ...Terraria Map Generator: TerrariaMapTool 1.0.0.4 Beta: 1) Fixed the generated map.html file so that the file:/// is included in the base path. 2) Added the ability to use parallelization during generation. This will cause the program to use as many threads as there are physical cores. 3) Fixed some background overdraw.DotRas: DotRas v1.2 (Version 1.2.4168): This release includes compiled (and signed) versions of the binaries, PDBs, CHM help documentation, along with both C# and VB.NET examples. Please don't forget to rate the release! If you find a bug, please open a work item and give as much description as possible. Stack traces, which operating system(s) you're targeting, and build type is also very helpful for bug hunting. If you find something you believe to be a bug but are not sure, create a new discussion on the discussions board. Thank...BIDS Helper: BIDS Helper 1.5: New Features Duplicate Role feature for SSAS Biml Package Generator feature for SSIS Fixes and Updates Fixes issue with Printer Friendly Dimension Usage not working from the cube right-click menu Integrated new SSIS Expression Editor Control (http://expressioneditor.codeplex.com - v1.0.3.0) SSIS variable move dialog includes improved validation as well as UI enhancements SSIS Expression List now supports variables, constraints and nested objects, as well as UI enhancements New Enab...Caliburn Micro: WPF, Silverlight and WP7 made easy.: Caliburn.Micro v1.1 RTW: Download ContentsDebug and Release Assemblies Samples Changes.txt License.txt Release Highlights For WP7A new Tombstoning API based on ideas from Fluent NHibernate A new Launcher/Chooser API Strongly typed Navigation SimpleContainer included The full phone lifecycle is made easy to work with ie. we figure out whether your app is actually Resurrecting or just Continuing for you For WPFSupport for the Client Profile Better support for WinForms integration All PlatformsA power...VidCoder: 0.9.1: Added color coding to the Log window. Errors are highlighted in red, HandBrake logs are in black and VidCoder logs are in dark blue. Moved enqueue button to the right with the other control buttons. Added logic to report failures when errors are logged during the encode or when the encode finishes prematurely. Added Copy button to Log window. Adjusted audio track selection box to always show the full track name. Changed encode job progress bar to also be colored yellow when the enco...New ProjectsALogger: Alogger is a simple logger for time execution of methods. Uses Postsharp and SQL Server Compact. How to use?? Add Attribute to your method to check their speed of execution and its ready Sample: [AspectLogTime("Category")] private void SpeedMethod(string name) { //do something.. } Is it too simple? Azure WCF with WAS Portsharing: Sample WCF project with an Azure Webrole that supports TCP endpoints on the same port as Web (port 80). This is accomplished with the TCPPortSharing service. This project is a starter project to enable WAS (Windows Activation Service) with Windows Azure.DotNetToscana: DotNetToscana è lo User Group Toscano su .NET, un gruppo senza fini di lucro formato da persone con una forte passione per l’informatica e in particolare per prodotti e tecnologie legate al Microsoft .NET Framework.Email: Email providereriser: sandboxFacturación CFDI para Microempresas: Proyecto que pretende ayudar a la microempresa a realizar su transición de usar factura en papel a formato electrónicoFolder To SharePoint Metadata Migrator (Folders2SP): PowerShell 2.0 script to facilitate migration of SharePoint/Folder structure to a SPS2010 document library using words in the folders to set taxonomy field values, and web services to lookup source metadata and retrieve versions. Use Case: Migrate MOSS library to SPS library.Gestor de tikets de soporte técnico: Una aplicacion basada en ASP.NET que permite gestionar tikets de soporte técnicoGoogle Doc Uploader: Very simple application that allows you to upload documents to your own google document area with the right click of a mouse button.HTML App Host Framework for Phone 7: This is an HTML Application Host framework for building HTML/JavaScript for Windows Phone 7 with mango this will be for HTML5. The framework consists of controls needed to support embed html apps in a standard xap format used by the market place for deploying to phone 7.MOBZKeys: Press a hotkey to expand text fragments in any application. Unobtrusive, fully configurable from the task bar.MVC_imovies: Proyecto de tesis.RandomRat: RandomRat is a program for generating random sets that meet specific criteriaScenario Testing: Scenario Testing is an interactive tool to define your test scenarios by dragging and dropping methods to be tested. It is build using Workflow Foundation 4 (WF 4). The test scenarios can be saved and loaded again for testing.SEProject: SEProject Sharepoint 2010 Diagnostic Log Compression: This sharepoint extention helps you to compress,copy or move sharepoint uls log files to another location with a scheduled time for backup purpose.Snowball: Snowball is an in progress 2D Game Engine written in C#. It uses SlimDX under the covers but the underlying technology is abstracted away from the end user.T24 Project: T24 ProjectTaller Monitor: Taller MonitorTeam Build Deployer: Team Build Deployer makes it easy to deploy web application projects using Team Build 2010. The solution is written in C#, and enhanced build scripts, and enables Team build to use the built in web application deployment packaging configured found in Visual Studio 2010. This solution is intended to make continuous deployment easy and secure and reusable for any Visual Studio 2010 web application.Test SiteDataQuery SharePoint 2010: Software to testing SiteDataQuery Sharepoint 2010TextWrapper: A IIS managed module that enables word wrap of plain text content. Supports GZip and Deflate encoding. This module increases readability of text files that contain long lines.UMC Information System Alumni Center Website: This project is our final task for course Internet Programming II at Study Program of Information System, Faculty of Technology and Science at University of Ma Chung (UMC). UMC is private educational institution, first university in Indonesia applying Microsoft technology thoroughly called the total solution, which established in Malang, East Java, Indonesia. We named our project 'UMC Information System Alumni Center'. It doesn't mean this project is really used to be official website for ...WeatherDotCom Module for Orchard CMS: Using the Weather Channel feeds, you can connect to weather.com and pull in weather conditions for a particular search term. A live working demonstration of this module can be found on my website at jasongaylord.comWindows Phone Essentials: This library is focused on making the common things you have to do in every windows phone application, like persist application settings, use tasks/choosers, log/trace, threading/asynchronous development etc. testable.Wpf .Net Profiler: A .net profiler with wpf and sqlite

    Read the article

  • Host a streaming video in my client, from a streaming url that is behind a login session?

    - by Vin
    I am building a Silverlight 4 desktop client to show streaming video from a site that is login based. So that website has a Silverlight player that does streaming video, the player is behind a login sesion, so just by getting the url from fiddler and trying to play it in my Silverlight 4 desktop client won't work. Actually after that, I want to build a Windows Media Center plugin to build a Netflix-like client, that allows login through WMC and then allows you to watch streaming video. Any pointers on how to go about doing any of this?

    Read the article

  • Entity Framework and Sql Server view question

    - by Sergio Romero
    Hi to all, For several reasons that I don't have the liberty to talk about, we are defining a view on our Sql Server 2005 database like so: CREATE VIEW [dbo].[MeterProvingStatisticsPoint] AS SELECT CAST(0 AS BIGINT) AS 'RowNumber', CAST(0 AS BIGINT) AS 'ProverTicketId', CAST(0 AS INT) AS 'ReportNumber', GETDATE() AS 'CompletedDateTime', CAST(1.1 AS float) AS 'MeterFactor', CAST(1.1 AS float) AS 'Density', CAST(1.1 AS float) AS 'FlowRate', CAST(1.1 AS float) AS 'Average', CAST(1.1 AS float) AS 'StandardDeviation', CAST(1.1 AS float) AS 'MeanPlus2XStandardDeviation', CAST(1.1 AS float) AS 'MeanMinus2XStandardDeviation' WHERE 0 = 1 The idea is that the Entity Framework will create an entity based on this query, which it does, but it generates it with an error that states the following: "warning 6002: The table/view 'Keystone_Local.dbo.MeterProvingStatisticsPoint' does not have a primary key defined. The key has been inferred and the definition was created as a read-only table/view." And it decides that the CompletedDateTime field will be this entity primary key. We are using EdmGen to generate the model. Is there a way not to have the entity framework include any field of this view as a primary key? Thanks for help.

    Read the article

  • IDataServiceMetadataProvider / ResourceType.... what for dynamic types with no CLR type?

    - by TomTom
    Hello, I try to expose a database via ADO RIA for which we have only an ODBC based interface. The "database" is a server and new elements are developped all the time, so I would like the server to check metadata at start (using the odbc schema methods) and then expose what he finds via RIA services.... clients can the nregenerate when they need access to new elements. As such, I dont ahve any CLR types for all the tabled developped. ResourceType tableType = new ResourceType( typeof(object), ResourceTypeKind.EntityType, null, "Martini", table_name, false ); tableType.CanReflectOnInstanceType = false; I can somehow not put in NULl as CLR element type, and entering typeof(object) seems to result in reflection errors when trying to access the properties. Any documentation on how to do that? I dont really want to get into having types... though if I have to, I probably will dynamically generate some via bytecode emit.

    Read the article

  • Is preg_match safe enaught in input satinization?

    - by DaNieL
    Im building a new web-app, LAMP environment... im wondering if preg_match can be trusted for user's input validation (+ prepared stmt, of course) for all the text-based fields (aka not html fields; phone, name, surname, etc..). For example, for a classic 'email field', if i check the input like: $email_pattern = "/^([a-zA-Z0-9_\-\.]+)@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.)" . "|(([a-zA-Z0-9\-]+\.)+))([a-zA-Z]{2,4}" . "|[0-9]{1,3})(\]?)$/"; $email = $_POST['email']; if(preg_match($email_pattern, $email)){ //go on, prepare stmt, execute, etc... }else{ //email not valid! do nothing except warn the user } can i sleep easy against the sql/xxs injection? I write the regexp to be the more restrictive as they can.

    Read the article

  • Pohlig–Hellman algorithm for computing discrete logarithms

    - by drelihan
    Hi Folks, I'm working on coding the Pohlig-Hellman Algorithm but I am having problem understand the steps in the algorithm based on the definition of the algorithm. Going by the Wiki of the algorithm: http://en.wikipedia.org/wiki/Pohlig%E2%80%93Hellman_algorithm I know the first part 1) is to calculate the prime factor of p-1 - which is fine. Howeever, I am not sure what I need to do in steps 2) and 3). Can someone help with explaining this in plain english (i) - or pseudocode. I want to code the solution myself obviously but I cannot make any more progress unless i understand the algorithm. Note: I have done a lot of searching for this and I read S. Pohlig and M. Hellman (1978). "An Improved Algorithm for Computing Logarithms over GF(p) and its Cryptographic Significance but its still not really making sense to me. Thanks in advance

    Read the article

  • ASP MVC Set RadioButton From Database

    - by Jacob Huggart
    Hello All, I have what should be an easy question for you today. I have two radio buttons in my view: Sex: <%=Html.RadioButton("Sex", "Male", true)% Male <%=Html.RadioButton("Sex", "Female", true)% Female I need to select one based on the value returned from my database. The way I am trying to do it now is: ViewData["Sex"] = data.Sex; //Set radio button But that is not working. I have tried every possible combination of isChecked properties. I know that data.Sex is returning either "Male" or "Female". What do I need to do to check the appropriate radio button?

    Read the article

  • JSF Custom EL function works only on the first load of the page.

    - by jsfQ
    I created a ( JSP-based) custom EL function to use in the rendered tag. The function will return a boolean to decide if a page component needs to be rendered on a page or not. I import it onto the jsp page using <%@ taglib uri = "/WEB-INF/mine.tld" prefix = "g" %. Everything works perfect on the first load of the jsp page. Once a button is clicked, the form submits and then I am getting errors like 'No ClassLoaders found for: the class which implements my EL function' and 'Function not found'. What is going on here? What will be a fix?

    Read the article

  • How can I install xpdf on a Godaddy Linux shared hosting server?

    - by Andrew
    I'm having trouble determining if it's possible, based on the amount of access I have to my Godaddy server, to install XPDF. Could someone shed some light on this? Here's the link to XPDF. And here is info about the GoDaddy server. My goal is to convert PDF's to Plain Text automatically using a PHP script on the server. So far, other solutions like code posted in the comments of the PHP website have been insufficient. All research seems to point to XPDF.

    Read the article

  • SVN Authentication and authorization

    - by vijay.shad
    Hi, I have created a multi module maven project. Now I have shared the project with a internal SVN repository. Now I want to give authorization to user based on the module user is owner of. So if a user does not have right to a project; he/she will not be able to checkout the project form svn repository. But he/she will get a source release(sources.jar file) form maven repository for that project; if wanted. What should i do go get this done? My svn reposiroty is created by TortoiseSVN 1.6.6.

    Read the article

  • telerik mvc grid access cell data to enable columns.Command

    - by AZee
    Hi! I can't seem to find a way to reference the value in a column in the grid, in my case it is the StatusId. Based on the cell value in this row, for the StatusId, I need to return a true or false to the method ".Visible(???)". It would be nice to find the answer in the documentation online but I haven't been able to. I find it hard to believe that I would be the first person who ever needed this functionality. I would be most appreciative of any assistance since no one in the telerik forums know. .Columns(columns => { columns.Command(commands => { commands.Edit().ButtonType(ButtonType); commands.Delete().ButtonType(ButtonType); }).Width(90).Visible(???); Thanks! AZee

    Read the article

  • How can I deploy my .NET app to Amazon EC2?

    - by Khash
    I have a .NET Windows service and a .NET Web Application that I would like to deploy to my Amazon EC2 Windows 2008 instances. At this point, all I need to do is to copy the zipped files across to the EC2 box and remote desktop to the EC2 instance and finish the deployment. In order to do this, I have tried LogMeIn Hamachi2 to create a P2P VPN and use RoboCopy to copy the files, however it seems Hamachi doesn't work on Windows EC2. What is your solution for deploying your .NET apps to Windows EC2 instances? I want to avoid running an FTP server on the box just to get my files up on the server and don't have a VPN server (like OpenVPN) running to run a cloud based VPN solution. Perhaps I can find a simple way of using Amazon S3 as a strategy? Any ideas? Suggestions?

    Read the article

  • Exporting tasks to 'C using DPI

    - by Alphaneo
    I have an verilog based test-bench, interfaced to 'C source using DPI. Now using DPI I am planning to write my whole firmware. To do this I need 3 things Register Read Register Write Interrupt handler As I understand, register reads and writes are tasks that I need to export from the RTL test-bench. And Interrupt handler (I implemented by importing a function from 'C). I checked most the cadence documentation and found no useful hints. I have also registered with cadence users community but it seems that I cannot ask question till they approve my registration. Just in case someone is aware of this, would appreciate their help.

    Read the article

  • how to preload more than one but not all images of a slideshow with jquery

    - by wtip
    I'd like to create a web based stop motion video player. Basically a slideshow that shows 2-4 images per second. Each image might be a maximum of 20KB. I don't want to preload all images in the slideshow as there might be thousands, however I need to preload more than just the next image in the show as this will not playback fast enough (because of the playback speed the browser needs to be loading more than one image at a time). I've been looking at using the jQuery Cycle Plugin (http://malsup.com/jquery/cycle/) with a addSlide type function but don't know how to make it work. Would something like this might work? -Slideshow starts -image is played back -preloader will attempt to load up to the next 60 images -playback will wait for the next image in line to completely load, but will not wait for all 59 others. The playback / preloading order is important for this application.

    Read the article

  • Pain Comes Instantly

    - by user701213
    When I look back at recent blog entries – many of which are not all that current (more on where my available writing time is going later) – I am struck by how many of them focus on public policy or legislative issues instead of, say, the latest nefarious cyberattack or exploit (or everyone’s favorite new pastime: coining terms for the Coming Cyberpocalypse: “digital Pearl Harbor” is so 1941). Speaking of which, I personally hope evil hackers from Malefactoria will someday hack into my bathroom scale – which in a future time will be connected to the Internet because, gosh, wouldn’t it be great to have absolutely everything in your life Internet-enabled? – and recalibrate it so I’m 10 pounds thinner. The horror. In part, my focus on public policy is due to an admitted limitation of my skill set. I enjoy reading technical articles about exploits and cybersecurity trends, but writing a blog entry on those topics would take more research than I have time for and, quite honestly, doesn’t play to my strengths. The first rule of writing is “write what you know.” The bigger contributing factor to my recent paucity of blog entries is that more and more of my waking hours are spent engaging in “thrust and parry” activity involving emerging regulations of some sort or other. I’ve opined in earlier blogs about what constitutes good and reasonable public policy so nobody can accuse me of being reflexively anti-regulation. That said, you have so many cycles in the day, and most of us would rather spend it slaying actual dragons than participating in focus groups on whether dragons are really a problem, whether lassoing them (with organic, sustainable and recyclable lassos) is preferable to slaying them – after all, dragons are people, too - and whether we need lasso compliance auditors to make sure lassos are being used correctly and humanely. (A point that seems to evade many rule makers: slaying dragons actually accomplishes something, whereas talking about “approved dragon slaying procedures and requirements” wastes the time of those who are competent to dispatch actual dragons and who were doing so very well without the input of “dragon-slaying theorists.”) Unfortunately for so many of us who would just get on with doing our day jobs, cybersecurity is rapidly devolving into the “focus groups on dragon dispatching” realm, which actual dragons slayers have little choice but to participate in. The general trend in cybersecurity is that powers-that-be – which encompasses groups other than just legislators – are often increasingly concerned and therefore feel they need to Do Something About Cybersecurity. Many seem to believe that if only we had the right amount of regulation and oversight, there would be no data breaches: a breach simply must mean Someone Is At Fault and Needs Supervision. (Leaving aside the fact that we have lots of home invasions despite a) guard dogs b) liberal carry permits c) alarm systems d) etc.) Also note that many well-managed and security-aware organizations, like the US Department of Defense, still get hacked. More specifically, many powers-that-be feel they must direct industry in a multiplicity of ways, up to and including how we actually build and deploy information technology systems. The more prescriptive the requirement, the more regulators or overseers a) can be seen to be doing something b) feel as if they are doing something regardless of whether they are actually doing something useful or cost effective. Note: an unfortunate concomitant of Doing Something is that often the cure is worse than the ailment. That is, doing what overseers want creates unfortunate byproducts that they either didn’t foresee or worse, don’t care about. After all, the logic goes, we Did Something. Prescriptive practice in the IT industry is problematic for a number of reasons. For a start, prescriptive guidance is really only appropriate if: • It is cost effective• It is “current” (meaning, the guidance doesn’t require the use of the technical equivalent of buggy whips long after horse-drawn transportation has become passé)*• It is practical (that is, pragmatic, proven and effective in the real world, not theoretical and unproven)• It solves the right problem With the above in mind, heading up the list of “you must be joking” regulations are recent disturbing developments in the Payment Card Industry (PCI) world. I’d like to give PCI kahunas the benefit of the doubt about their intentions, except that efforts by Oracle among others to make them aware of “unfortunate side effects of your requirements” – which is as tactful I can be for reasons that I believe will become obvious below - have gone, to-date, unanswered and more importantly, unchanged. A little background on PCI before I get too wound up. In 2008, the Payment Card Industry (PCI) Security Standards Council (SSC) introduced the Payment Application Data Security Standard (PA-DSS). That standard requires vendors of payment applications to ensure that their products implement specific requirements and undergo security assessment procedures. In order to have an application listed as a Validated Payment Application (VPA) and available for use by merchants, software vendors are required to execute the PCI Payment Application Vendor Release Agreement (VRA). (Are you still with me through all the acronyms?) Beginning in August 2010, the VRA imposed new obligations on vendors that are extraordinary and extraordinarily bad, short-sighted and unworkable. Specifically, PCI requires vendors to disclose (dare we say “tell all?”) to PCI any known security vulnerabilities and associated security breaches involving VPAs. ASAP. Think about the impact of that. PCI is asking a vendor to disclose to them: • Specific details of security vulnerabilities • Including exploit information or technical details of the vulnerability • Whether or not there is any mitigation available (as in a patch) PCI, in turn, has the right to blab about any and all of the above – specifically, to distribute all the gory details of what is disclosed - to the PCI SSC, qualified security assessors (QSAs), and any affiliate or agent or adviser of those entities, who are in turn permitted to share it with their respective affiliates, agents, employees, contractors, merchants, processors, service providers and other business partners. This assorted crew can’t be more than, oh, hundreds of thousands of entities. Does anybody believe that several hundred thousand people can keep a secret? Or that several hundred thousand people are all equally trustworthy? Or that not one of the people getting all that information would blab vulnerability details to a bad guy, even by accident? Or be a bad guy who uses the information to break into systems? (Wait, was that the Easter Bunny that just hopped by? Bringing world peace, no doubt.) Sarcasm aside, common sense tells us that telling lots of people a secret is guaranteed to “unsecret” the secret. Notably, being provided details of a vulnerability (without a patch) is of little or no use to companies running the affected application. Few users have the technological sophistication to create a workaround, and even if they do, most workarounds break some other functionality in the application or surrounding environment. Also, given the differences among corporate implementations of any application, it is highly unlikely that a single workaround is going to work for all corporate users. So until a patch is developed by the vendor, users remain at risk of exploit: even more so if the details of vulnerability have been widely shared. Sharing that information widely before a patch is available therefore does not help users, and instead helps only those wanting to exploit known security bugs. There’s a shocker for you. Furthermore, we already know that insider information about security vulnerabilities inevitably leaks, which is why most vendors closely hold such information and limit dissemination until a patch is available (and frequently limit dissemination of technical details even with the release of a patch). That’s the industry norm, not that PCI seems to realize or acknowledge that. Why would anybody release a bunch of highly technical exploit information to a cast of thousands, whose only “vetting” is that they are members of a PCI consortium? Oracle has had personal experience with this problem, which is one reason why information on security vulnerabilities at Oracle is “need to know” (we use our own row level access control to limit access to security bugs in our bug database, and thus less than 1% of development has access to this information), and we don’t provide some customers with more information than others or with vulnerability information and/or patches earlier than others. Failure to remember “insider information always leaks” creates problems in the general case, and has created problems for us specifically. A number of years ago, one of the UK intelligence agencies had information about a non-public security vulnerability in an Oracle product that they circulated among other UK and Commonwealth defense and intelligence entities. Nobody, it should be pointed out, bothered to report the problem to Oracle, even though only Oracle could produce a patch. The vulnerability was finally reported to Oracle by (drum roll) a US-based commercial company, to whom the information had leaked. (Note: every time I tell this story, the MI-whatever agency that created the problem gets a bit shirty with us. I know they meant well and have improved their vulnerability handling/sharing processes but, dudes, next time you find an Oracle vulnerability, try reporting it to us first before blabbing to lots of people who can’t actually fix the problem. Thank you!) Getting back to PCI: clearly, these new disclosure obligations increase the risk of exploitation of a vulnerability in a VPA and thus, of misappropriation of payment card data and customer information that a VPA processes, stores or transmits. It stands to reason that VRA’s current requirement for the widespread distribution of security vulnerability exploit details -- at any time, but particularly before a vendor can issue a patch or a workaround -- is very poor public policy. It effectively publicizes information of great value to potential attackers while not providing compensating benefits - actually, any benefits - to payment card merchants or consumers. In fact, it magnifies the risk to payment card merchants and consumers. The risk is most prominent in the time before a patch has been released, since customers often have little option but to continue using an application or system despite the risks. However, the risk is not limited to the time before a patch is issued: customers often need days, or weeks, to apply patches to systems, based upon the complexity of the issue and dependence on surrounding programs. Rather than decreasing the available window of exploit, this requirement increases the available window of exploit, both as to time available to exploit a vulnerability and the ease with which it can be exploited. Also, why would hackers focus on finding new vulnerabilities to exploit if they can get “EZHack” handed to them in such a manner: a) a vulnerability b) in a payment application c) with exploit code: the “Hacking Trifecta!“ It’s fair to say that this is probably the exact opposite of what PCI – or any of us – would want. Established industry practice concerning vulnerability handling avoids the risks created by the VRA’s vulnerability disclosure requirements. Specifically, the norm is not to release information about a security bug until the associated patch (or a pretty darn good workaround) has been issued. Once a patch is available, the notice to the user community is a high-level communication discussing the product at issue, the level of risk associated with the vulnerability, and how to apply the patch. The notices do not include either the specific customers affected by the vulnerability or forensic reports with maps of the exploit (both of which are required by the current VRA). In this way, customers have the tools they need to prioritize patching and to help prevent an attack, and the information released does not increase the risk of exploit. Furthermore, many vendors already use industry standards for vulnerability description: Common Vulnerability Enumeration (CVE) and Common Vulnerability Scoring System (CVSS). CVE helps ensure that customers know which particular issues a patch addresses and CVSS helps customers determine how severe a vulnerability is on a relative scale. Industry already provides the tools customers need to know what the patch contains and how bad the problem is that the patch remediates. So, what’s a poor vendor to do? Oracle is reaching out to other vendors subject to PCI and attempting to enlist then in a broad effort to engage PCI in rethinking (that is, eradicating) these requirements. I would therefore urge all who care about this issue, but especially those in the vendor community whose applications are subject to PCI and who may not have know they were being asked to tell-all to PCI and put their customers at risk, to do one of the following: • Contact PCI with your concerns• Contact Oracle (we are looking for vendors to sign our statement of concern)• And make sure you tell your customers that you have to rat them out to PCI if there is a breach involving the payment application I like to be charitable and say “PCI meant well” but in as important a public policy issue as what you disclose about vulnerabilities, to whom and when, meaning well isn’t enough. We need to do well. PCI, as regards this particular issue, has not done well, and has compounded the error by thus far being nonresponsive to those of us who have labored mightily to try to explain why they might want to rethink telling the entire planet about security problems with no solutions. By Way of Explanation… Non-related to PCI whatsoever, and the explanation for why I have not been blogging a lot recently, I have been working on Other Writing Venues with my sister Diane (who has also worked in the tech sector, inflicting upgrades on unsuspecting and largely ungrateful end users). I am pleased to note that we have recently (self-)published the first in the Miss Information Technology Murder Mystery series, Outsourcing Murder. The genre might best be described as “chick lit meets geek scene.” Our sisterly nom de plume is Maddi Davidson and (shameless plug follows): you can order the paper version of the book on Amazon, or the Kindle or Nook versions on www.amazon.com or www.bn.com, respectively. From our book jacket: Emma Jones, a 20-something IT consultant, is working on an outsourcing project at Tahiti Tacos, a restaurant chain offering Polynexican cuisine: refried poi, anyone? Emma despises her boss Padmanabh, a brilliant but arrogant partner in GD Consulting. When Emma discovers His-Royal-Padness’s body (verdict: death by cricket bat), she becomes a suspect.With her overprotective family and her best friend Stacey providing endless support and advice, Emma stumbles her way through an investigation of Padmanabh’s murder, bolstered by fusion food feeding frenzies, endless cups of frou-frou coffee and serious surfing sessions. While Stacey knows a PI who owes her a favor, landlady Magda urges Emma to tart up her underwear drawer before the next cute cop with a search warrant arrives. Emma’s mother offers to fix her up with a PhD student at Berkeley and showers her with self-defense gizmos while her old lover Keoni beckons from Hawai’i. And everyone, even Shaun the barista, knows a good lawyer. Book 2, Denial of Service, is coming out this summer. * Given the rate of change in technology, today’s “thou shalts” are easily next year’s “buggy whip guidance.”

    Read the article

  • Problem with Regex in .NET (C#)

    - by Craig Bovis
    I'm trying to write a a regex to validate a string to match the following rules. Must start with a-z (case insensitive) Must only contain a-z A-Z 0-9 . - I've put something together based on my limited knowledge and ran it through an online testing tool for a whole bunch of situations and the results were as I had hoped however when I place the pattern into my .NET code it doesn't match correctly. The pattern I am using is, [a-zA-Z][a-zA-Z0-9.\-]* Is this the correct pattern or am I barking up the wrong tree? Some examples of what I'm expecting. craig.bovis - VALID 24craig - INVALID craig@bovis - INVALID craig24 - VALID -craig24 - INVALID craig24.bovis-test - VALID

    Read the article

  • Conditions on the DetailsView

    - by jpabluz
    What is the best way of implementing conditions (requiring fields based in other fields) in a DetailsView? I have this: protected override ICollection CreateFieldSet(object dataItem, bool useDataSource) { var country = new BoundField(); country.DataField = "Country"; country.ReadOnly = ViewState["DifferentAddress"] != null; } I set the ViewState["DifferentAddress"] later, but since the change happens after the controls are created I lost the current state and get the old state. Which is the desired way of doing this? I am in the right path - or should I use another class to do this?

    Read the article

  • Help with a simple switch statement

    - by revive
    I need to find the value of a variable and use it to add a class to a div, based on a switch statement. For example, my variable is $link and if $link has google.com IN IT at all, I need $class to equal 'google', if $link as yahoo.com IN IT at all, $class then needs to equal 'yahoo' So, I need something like this, but I'm not sure how/or if to use preg_match or something to check and see if the $link variable has the value we are looking for in it - see 'case' text below: switch ($link) { case 'IF link has Google.com in it': $class = 'google'; break; case 'IF link has Yahoo.com in it': $class = 'yahoo'; break; default: # code... break; } OR if there is a better way to do this, please let me know :D Thanks

    Read the article

  • Setting up nHibernate with an Oracle database and Visual Studio 2010

    - by Geoff
    I'm creating a .ASPNET project and I would like to setup nHibernate as my ORM tool. I will be using an existing oracle database and Visual Studio 2010. ORM tools are very new to me and really could use any advice to better understand the tool and the process required to implement them. I've been following an article at http://nhforge.org/wikis/howtonh/your-first-nhibernate-based-application.aspx to learn about it and am stuck where they say to create a local database as mine only give me the option to create a SQL server database (perhaps this a new for visual studio 2010?). Is the purpose of this database just to cache results from the live database? Thanks for your help! Geoff

    Read the article

  • Does ActiveRecord make Ruby on Rails code hard to test?

    - by Erik Öjebo
    I've spent most of my time in statically typed languages (primarily C#). I have some bad experiences with the Active Record pattern and unit testing, because of the static methods and the mix of entities and data access code. Since the Ruby community probably is the most test driven of the communities out there, and the Rails ActiveRecord seems popular, there must be some way of combining TDD and ActiveRecord based code in Ruby on Rails. I would guess that the problem goes away in dynamic languages, somehow, but I don't see how. So, what's the trick?

    Read the article

  • Why is thread local storage so slow?

    - by dsimcha
    I'm working on a custom mark-release style memory allocator for the D programming language that works by allocating from thread-local regions. It seems that the thread local storage bottleneck is causing a huge (~50%) slowdown in allocating memory from these regions compared to an otherwise identical single threaded version of the code, even after designing my code to have only one TLS lookup per allocation/deallocation. This is based on allocating/freeing memory a large number of times in a loop, and I'm trying to figure out if it's an artifact of my benchmarking method. My understanding is that thread local storage should basically just involve accessing something through an extra layer of indirection, similar to accessing a variable via a pointer. Is this incorrect? How much overhead does thread-local storage typically have? Note: Although I mention D, I'm also interested in general answers that aren't specific to D, since D's implementation of thread-local storage will likely improve if it is slower than the best implementations.

    Read the article

  • C# Monte Carlo Simulation Package Needed

    - by Yunzhou
    I'm relative new to C# and doing a project using Monte Carlo Simulation. Basically my question is the following. I have two uncertain variable inputs, A and B, and they will go through a model and give an output C. So C = f(A,B). I know A's probability distribution (Triangular) and B's probability distribution (Discrete). How can I get the probability distribution of C? What I have done now is that I can generate random numbers based on A's triangular distribution as well as B's discrete distribution. Each pair of randomly generated A and B gives a resultant C. I've run this model 1000 times thus I can get 1000 possible values of C. The difficulty is to get the corresponding probabilities of each value of C. Obviously it's not 1/1000 unless C is uniformly distributed. Is there any Monte Carlo Simulation package/library I can use?

    Read the article

  • CSS inheritance, aliases and other cool stuff

    - by emzero
    The other day I was randomly browsing the web and I found some program that lets you write CSS aliases and other cool stuff (which I can't remember right now). As an example, I remember you can do something like this: .myclass { background-color: red; greenfont } where greenfont was defined somewhere else as somekind of alias greenfont { color: green; } Then the program will generate the resulting CSS based on the alias and other stuff. Does anyone has used this? Or did I dreamed about it? I cannot find it now :P

    Read the article

  • How to mock a file with EasyMock?

    - by Todd
    Hello, I have recently been introduced to EasyMock and have been asked to develop some unit tests for a FileMonitor class using it. The FileMonitor class is based on a timed event that wakes up and checks for file modification(s) in a defined list of files and directories. I get how to do this using the actual file system, write a test that writes to a file and let the FileMonitor do its thing. So, how do I do this using EasyMock? I just don't get how to have EasyMock mock the file system. Thanks, Todd

    Read the article

  • Oracle .NET Provider DLL hell

    - by Pablo Santa Cruz
    I am currently developing on a Win7-32bits computer. Everything works fine. It's a ASP.NET application. I was able to use Microsoft's Oracle deprecated .NET provider to connect to Oracle (using 32 bit instant client) and also ODP.NET. No problems at all. Application runs fine. The problem comes when I deploy it to IIS7 on Windows 2008 Server 64bit computer. I can't get Microsoft's deprecated .NET provider or ODP.NET to work easily. Is there a straightforward way to use a 32bit based ODP.NET or Microsoft's Oracle deprecated .NET provider in Windows 2008 Server 64bits? DLL hell here! Thanks.

    Read the article

< Previous Page | 650 651 652 653 654 655 656 657 658 659 660 661  | Next Page >