Search Results

Search found 13059 results on 523 pages for 'security hole'.

Page 310/523 | < Previous Page | 306 307 308 309 310 311 312 313 314 315 316 317  | Next Page >

  • The architecture and technologies to use for a secure, fast, reliable and easily scalable web application

    - by DSoul
    ^ For actual questions, skip to the lists down below I understand, that his is a vague topic, but please, before you turn the other way and disregard me, hear me out. I am currently doing research for a web application(I don't know if application is the correct word for it, but I will proceed w/ that for now), that one day might need to be everything mentioned in the title. I am bound by nothing. That means that every language, OS and framework is acceptable, but only if it proves it's usefulness. And if you are going to say, that scalability and speed depend on the code I write for this application, then I agree, but I am just trying to find something, that wouldn't stand in my way later on. I have done quite a bit reading on this subject, but I still don't have a clear picture, to what suits my needs, so I come to you, StackOverflow, to give me directions. I know you all must be wondering what I'm building, but I assure you, that it doesn't matter. I have heard of 12 factor app though, if you have any similar guidelines or what is, to suggest the please, go ahead. For the sake of keeping your answers as open as possible, I'm not gonna provide you my experience regarding anything written in this question. ^ Skippers, start here First off - the weights of the requirements are probably something like that (on a scale of 10): Security - 10 Speed - 5 Reliability (concurrency) - 7.5 Scalability - 10 Speed and concurrency are not a top priority, in the sense, that the program can be CPU intensive, and therefore slow, and only accept a not-that-high number of concurrent users, but both of these factors must be improvable by scaling the system Anyway, here are my questions: How many layers should the application have, so it would be future-proof and could best fulfill the aforementioned requirements? For now, what I have in mind is the most common version: Completely separated front end, that might be a web page or an MMI application or even both. Some middle-ware handling communication between the front and the back end. This is probably a server that communicates w/ the front end via HTTP. How the communication w/ the back end should be handled is probably dependent on the back end. The back end. Something that handles data through resources like DB and etc. and does various computations w/ the data. This, as the highest priority part of the software, must be easily spread to multiple computers later on and have no known security holes. I think ideally the middle-ware should send a request to a queue from where one of the back end processes takes this request, chops it up to smaller parts and buts these parts of the request back onto the same queue as the initial request, after what these parts will be then handled by other back end processes. Something *map-reduce*y, so to say. What frameworks, languages and etc. should these layers use? The technologies used here are not that important at this moment, you can ignore this part for now I've been pointed to node.js for this part. Do you guys know any better alternatives, or have any reasons why I should (not) use node.js for this particular job. I actually have no good idea, what to use for this job, there are too many options out there, so please direct me. This part (and the 2. one also, I think) depend a lot on the OS, so suggest any OSs alongside w/ the technologies/frameworks. Initially, all computers (or 1 for starters) hosting the back end are going to be virtual machines. Please do give suggestions to any part of the question, that you feel you have comprehensive knowledge and/or experience of. And also, point out if you feel that any part of the current set-up means an instant (or even distant) failure or if I missed a very important aspect to consider. I'm not looking for a definitive answer for how to achieve my goals, because there certainly isn't one, for I haven't provided you w/ all the required information. I'm just looking for recommendations and directions on what to look into. Also, bare in mind, that this isn't something that I have to get done quickly, to sell and let it be re-written by the new owner (which, I've been told for multiple times, is what I should aim for). I have all the time in the world and I really just want to learn doing something really high-end. Also, excuse me if my language isn't the best, I'm not a native. Anyway. Thanks in advance to anyone, who takes the time to help me out here. PS. When I do seem to come up w/ a good architecture/design for this project, I will certainly make it an open project and keep you guys up to date w/ it's development. As in what you could have told me earlier and etc. For obvious reasons the very same question got closed on SO, but could you guys still help me?.

    Read the article

  • New Development Snapshot

    A fairly massive set of changes this time, mostly around .NET 4.0 suport and IKVM.Reflection fixes. Targetting .NET 4.0 Please note that the work isn't done yet (in particular, I haven't checked in all the changes required for the .NET 4.0 security model), but it is now possible to build assemblies with ikvmc that target and reference .NET 4.0 while running ikvmc on the .NET 2.0 runtime. C:\jikvmc test.class -nostdlib -lib:\windows\microsoft.net\framework\v4.0.30319 ...Did you know that DotNetSlackers also publishes .net articles written by top known .net Authors? We already have over 80 articles in several categories including Silverlight. Take a look: here.

    Read the article

  • StreamInsight will not push feature releases through Microsoft Update going forward

    - by Roman Schindlauer
    Until now, we've released StreamInsight through the Microsoft Download Center, and also released it out through Microsoft Update. Going forward, we will only release new StreamInsight versions through the Microsoft Download Center and only use MU to release service packs and security fixes (should any be needed). As a result of this decision, we are pulling off the recent StreamInsight 2.1 release from MU; this release is still available in Download Center. Don’t worry: there’s nothing wrong with the versions we’ve shipped in MU, we’ve just adjusted how we use MU. There is no action necessary from our customers as a result of this change, and we are not rolling back any changes to your current installation, so if you have installed StreamInsight 2.1 recently through the Microsoft Update, they will still work fine. Regards, The StreamInsight Team

    Read the article

  • Multiple vulnerabilities fixed in Java 7U9

    - by RitwikGhoshal
    CVE DescriptionCVSSv2 Base ScoreComponentProduct and Resolution CVE-2012-5086 10.0 Java 7 Solaris 11.1 10/12 SRU 2.5 CVE-2012-5083 10.0 CVE-2012-5087 10.0 CVE-2012-1533 10.0 CVE-2012-1532 10.0 CVE-2012-1531 10.0 CVE-2012-5076 10.0 CVE-2012-3143 10.0 CVE-2012-5088 10.0 CVE-2012-5089 7.6 CVE-2012-5084 7.6 CVE-2012-3159 7.5 CVE-2012-5068 7.5 CVE-2012-4416 6.4 CVE-2012-5074 6.4 CVE-2012-5071 6.4 CVE-2012-5069 5.8 CVE-2012-5067 5.0 CVE-2012-5070 5.0 CVE-2012-5075 5.0 CVE-2012-5073 5.0 CVE-2012-5079 5.0 CVE-2012-5072 5.0 CVE-2012-5081 5.0 CVE-2012-3216 2.6 CVE-2012-5077 2.6 CVE-2012-5085 0.0 This notification describes vulnerabilities fixed in third-party components that are included in Oracle's product distributions. Information about each CVE can be found on Java SE Critical Patch Update - October 2012 Information about vulnerabilities affecting Oracle products can be found on Oracle Critical Patch Updates and Security Alerts page.

    Read the article

  • Programming Windows Identity Foundation - ISBN 978-0-7356-2718-5

    - by TATWORTH
    This book introduces a new technology that promises a considerable improvement on the ASP.NET membership system. If you ever had to write an extranet, system you should be aware of the problems in setting up membership for your site. The Windows Identity Foundation promises to be an excellent replacement. Therefore the book Programming Windows Identity Foundation - ISBN 978-0-7356-2718-5 at  http://oreilly.com/catalog/9780735627185, is breaking new ground. I recommend this book to all ASP.NET development teams. You should reckon on 3 to 5 man-days to study it and try out the sample programs and see if it can replace your bespoke solution. Rember this is version 1 of WIF and give yourself adequete time to read this book and familiarise yourself with the new software. Some URLs for more information: WIF home page at http://msdn.microsoft.com/en-us/security/aa570351.aspx The Identity Training Kit at http://www.microsoft.com/downloads/en/details.aspx?displaylang=en&FamilyID=c3e315fa-94e2-4028-99cb-904369f177c0 The author's blog at http://www.cloudidentity.net/

    Read the article

  • Alternatives to OAuth?

    - by sdolgy
    The Web industry is shifting / has shifted towards using OAuth when extending API services to external consumers & developers. There is some elegance in simple....and well, the 3-step OAuth process isn't too bad ... i just find it is the best of a bad bunch of options. Are there alternatives out there that could be better, and more secure? The security reference is derived from the following URLs: http://www.infoq.com/news/2010/09/oauth2-bad-for-web http://hueniverse.com/2010/09/oauth-2-0-without-signatures-is-bad-for-the-web/

    Read the article

  • How to access UbuntOne when it asks for default keyring which has never been set?

    - by obu-tim
    I am trying to set up UbuntuOne on a new computer and after I enter the email and password, it asks for the keyring 'default'. I don't know what it is and I never set it. Makes it difficult to enter so it seems to be a counterproductive security default. I understand that if autologin is set the keyring is called. I tried setting the main user to need a password but if I reboot it doesn't ask for the password so it sort of autoboots still. So How do I set the keyring default password? If I can't set it I can't install UbuntOne

    Read the article

  • How can I remove bluetooth-applet in 11.10?

    - by dunderhead
    I tried adding rfkill block bluetooth to /etc/rc.local. This did not work. I tried adding both blacklist bluetooth and blacklist btusb to etc/modprobe.d/blacklist.conf. This did not work. So I went to Synaptic to remove it altogether, but when I marked bluez for removal it said it was going to also remove gnome-shell as well! So naturally I didn't do that. (Is it sane to run a potential security problem like bluetooth by default? And why is something like that so tightly integrated into Gnome shell?) Can anyone tell me how to get rid of this annoying and unnecessary process?

    Read the article

  • FxCop ... Where have you been all my life?

    - by PhilSando
    I was recently introduced to microsoft's tool that analyzes managed code assemblies called FxCop. It points out possible design, localization, performance, and security improvements against a pre defined set of rules (and also accepts custom rules). At first I was unsure how to go about using it as it seems to be aimed at software developers (.exe and .dll) . Its easy to get around this with the following steps: 1)Create a new folder (i.e C:\Code Analysis) 2)Publish your web application into the new folder 3)Open FxCop and add all the dll files from the newly created bin folder  to be scrutinized. Lots more info / docs available here on msdn and you can also download fxcop free

    Read the article

  • Is there a way to sync my laptop's Ubuntu install with a jumpdrive Ubuntu install?

    - by trezy
    So I'm doing a fresh install of Ubuntu on my laptop right now. I also have a jumpdrive with Ubuntu installed on it with a persistent setup. What I would like is to be able to plug the jumpdrive into my laptop and have the installs sync certain data. I don't want docs and such to sync of course, but I would like some software to sync with installs and updates, mostly security and recovery stuff. Here's an example of what I would like to happen: I already have TestDisk installed on my jumpdrive but I haven't booted the drive in a while. I plug it in to my laptop where TestDisk has been updated and Wireshark has been installed. I would like the jumpdrive to check to see what has changed on the laptop install (in this case TestDisk has updated and Wireshark has been installed) and make those changes to the jumpdrive. Is there any kind of software to do that?

    Read the article

  • What framework for text rating site?

    - by problemofficer
    I want to start a "rate my"-style site. The rated objects are mostly texts. I want it to be rather simple. Features I need: object rating (thumb up, thumb down) object comments object tags related object presentation based on tags user authentication and management private message system sanity checks for text inputs (i.e. prevention of code injections) cache open source runs on GNU/Linux I would gladly take something that is tailored for my scenario but a generic framework would be fine too. I simply don't want to write stuff like user authentication that is been written a million times and risking security flaws. Programming language is irrelevant but python/php preferred.

    Read the article

  • How to select which account is logged in at system startup, or none?

    - by hippietrail
    I'm helping out some friends with a tiny hospitality business where one desktop computer has some files used by the business in one account "hotel" but it's mostly used by guests for browsing the web in another account "guest". It's low security, we're not worried about hacking or anything. But we don't want people accidentally moving our files or anything either. But the system always boots into the "hotel" account without asking for a password, even though the account has a password. We want it to boot into the "guest" account. I know a bit about computers generally and Linux but not much about Ubuntu and the ever-changing graphical environment the Linuxes are going through these days. We've looked through the obvious settings/preferences/options and I've done some Googling. I know this should be obvious easy stuff but I can't find it. (We're running 10.04 LTS on a generic aging Intel box.)

    Read the article

  • Multiple vulnerabilities in Pidgin

    - by RitwikGhoshal
    CVE DescriptionCVSSv2 Base ScoreComponentProduct and Resolution CVE-2010-4528 Improper Input Validation vulnerability 4.0 Pidgin Solaris 10 SPARC: 147992-02 X86: 147993-02 CVE-2011-1091 Denial of service(DOS) vulnerability 4.0 CVE-2011-2943 Denial of service(DOS) vulnerability 4.3 CVE-2011-3184 Resource Management Errors vulnerability 4.3 CVE-2011-3185 Improper Input Validation vulnerability 9.3 CVE-2011-4601 Improper Input Validation vulnerability 5.0 CVE-2011-4602 Improper Input Validation vulnerability 5.0 CVE-2011-4603 Improper Input Validation vulnerability 5.0 CVE-2011-4922 Information Exposure vulnerability 2.1 CVE-2011-4939 Permissions, Privileges, and Access Controls vulnerability 6.4 CVE-2012-1178 Resource Management Errors vulnerability 5.0 This notification describes vulnerabilities fixed in third-party components that are included in Oracle's product distributions.Information about vulnerabilities affecting Oracle products can be found on Oracle Critical Patch Updates and Security Alerts page.

    Read the article

  • Would it be practical/secure to import my GPG keys into (Open)SSH?

    - by InkBlend
    I know a bit about computer security, and well as about the concept of public and private keys. I also know that both GPG and (Open)SSH use the public/private key system. My question is, is there any reason that I would not want to use my GPG keys as authentication for SSH? Please note that, while a have a little bit more experience with Linux, GPG, and SSH than the average computer user, I am by no means an expert. Please be patient and point out any mistakes that you might see.

    Read the article

  • Multiple vulnerabilities in libexif

    - by Umang_D
    CVE DescriptionCVSSv2 Base ScoreComponentProduct and Resolution CVE-2012-2812 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability 6.4 libexif Solaris 11 11/11 SRU 12.4 CVE-2012-2813 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability 6.4 CVE-2012-2814 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability 7.5 CVE-2012-2836 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability 6.4 CVE-2012-2837 Numeric Errors vulnerability 5.0 CVE-2012-2840 Numeric Errors vulnerability 7.5 CVE-2012-2841 Numeric Errors vulnerability 7.5 CVE-2012-2845 Numeric Errors vulnerability 6.4 This notification describes vulnerabilities fixed in third-party components that are included in Oracle's product distributions.Information about vulnerabilities affecting Oracle products can be found on Oracle Critical Patch Updates and Security Alerts page.

    Read the article

  • Does anyone have thoughts/experiences on the IT division of Accenture? I just got a job offer from them.

    - by accenturejob
    Hi everyone, this is my first post here. As the title says, I just got a job offer for an entry level Technology Analyst role at Accenture, which is a very large consulting company. I'm a recent college graduate, and this would be my first "real" job out of school. I'm wondering if any of you guys have any experiences/insights/opinions on Accenture as a company, specifically, the Security or IT Strategy divisions of its Technology consulting branch. What do you think of the people there, the management, the clients, etc? Thanks a lot; hopefully this will help me make a decision.

    Read the article

  • If you had the power to remove one thing in your daily job, what would it be?

    - by Pierre 303
    With nearly 60 answers to this question it's highly likely that your answer has already been posted. Please don't post an answer unless you have something new to say This can be a particular task you find not very useful, a manager behavior, your canteen, some security rule you must comply to, tools they want you to use, commuting, schedules, a customer, a technical problem you encouter all the time, anything, ... please be creative ;) One answer per thing. Explain why. Please vote up on other answers if appropriate.

    Read the article

  • La France peu exposée à la cyber-criminalité d'après un rapport de Microsoft qui pousse à migrer ver

    La France est peu exposée à la cybercriminalité Et Windows 7 serait beaucoup moins perméable aux attaques, selon Microsoft Microsoft vient de publier la 8ème édition de son rapport semestriel sur la sécurité : le SIR (pour Security Intelligence Report). D'après ce rapport, les pirates ont adapté leurs techniques pour être plus efficaces sur différents types de cibles. Par exemple, les réseaux d'entreprise sont davantage sensibles aux vers alors que les « systèmes à domicile » sont plus soumis à des attaques sous forme de fausses loteries (9% des spams filtrés contre 4 % sur le premier semestre) ou par des logiciels malveillants comme les faux anti-virus, les Botnets ou les manipula...

    Read the article

  • Running an Application on a Different Domain

    - by Mark Flory
    Were I am contracting at right now has a new development domain.  Because of IT security rules it is fairly isolated from the domain my computer normally logs into (for e-mail and such).  I do use a VM to log directly into the domain but one of my co-workers found this command to run things on your box but in the other domain.  Pretty cool. For example this runs SQL Server Management Tool for SQL Server 2008: runas /netonly /user:{domain}\{username} "C:\Program Files\Microsoft SQL Server\100\Tools\Binn\VSShell\Common7\IDE\ssms.exe" And this runs visual studios: runas /netonly /user:{domain}\{username} "C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\devenv.exe" It does not solve the problem I wanted to solve which would be to be able to assign Users/Groups in Team Explorer.  It instead still uses the domain I am logged into's groups.

    Read the article

  • What's New in SGD 5.1?

    - by Fat Bloke
    Oracle announced the latest version of Secure Global Desktop (SGD) this week with 3 major themes: Support for Android devices; Support for Desktop Chrome clients;  Support for Oracle Unified Directory. I'll talk about the new features in a moment, but a bit of context first: Oracle SGD - what, how and why?  Oracle Secure Global Desktop is Oracle's secure remote access product which allows users on almost any device, to access almost any type application which  is hosted in the data center, from almost any location. And it does this by sitting on the edge of the datacenter, between the user and the applications: This is actually a really smart environment for an increasing number of use cases where: Users need mobility of location AND device (i.e. work from anywhere); IT needs to ensure security of applications and data (of course!) The application requires an end-user environment which can't be guaranteed and IT may not own the client platform (e.g. BYOD, working from home, partners or contractors). Oracle has a a specific interest in this of course. As the leading supplier of enterprise applications, many of Oracle's customers, and indeed Oracle itself, fit these criteria. So, as an IT guy rolling out an application to your employees, if one of your apps absolutely needs, say,  IE10 with Java 6 update 32, how can you be sure that the user population has this, especially when they're using their own devices? In the SGD model you, the IT guy, can set up, say, a Windows Server running the exact environment required, and then use SGD to publish this app, without needing to worry any further about the device the end user is using. What's new?  So back to SGD 5.1 and what is new there: Android devices Since we introduced our support for iPad tablets in SGD 5.0 we've had a big demand from customers to extend this to Android tablets too, and so we're pleased to announce that 5.1 supports Android 4.x tablets such as Nexus 7 and 10, and the Galaxy Tab. Here's how it works, with screenshots from my Nexus 7: Simply point your browser to the SGD server URL and login; The workspace is the list of apps that the admin has deemed ok for you to run. You click on an application to run it (here's Excel and Oracle E-Business Suite): There's an extended on-screen keyboard (extended because desktop apps need keys that don't appear on a tablet keyboard such as ctrl, WIndow key, etc) and touch gestures can be mapped to desktop events (such as tap and hold to right click) All in all a pretty nice implementation for Android tablet users. Desktop Chrome Browsers SGD has always been designed around using a browser to access your applications. But traditionally, this has involved using Java to deliver the SGD client component. With HTML5 and Javascript engines becoming so powerful, we thought we'd see how well a pure web client could perform with desktop apps. And the answer was, surprisingly well. So with this release we now offer this additional way of working, which can be enabled by a simple bit of configuration. Here's a Linux desktop running in a tab in Chrome. And if you resize the browser window, the Linux desktop is resized by SGD too. Very cool! Oracle Unified Directory As I mentioned above, a lot of Oracle users already benefit from SGD. And a lot of Oracle customers use Oracle Unified Directory as their Enterprise and Carrier grade user directory. So it makes a lot of sense that SGD now supports this LDAP directory for both Authentication and as a means to determine which users get which applications, e.g. publish the engineering app to the guys in the Development group, but give everyone E-Business Suite to let them do their expenses. Summary With new devices, and faster 4G networking becoming more prevalent, the pressure for businesses to move to a increasingly mobile enterprise is stronger than ever. SGD is good for users, and even better for IT. By offering the user the ability to work from anywhere, and IT the control and security they need, everyone wins with SGD. To try this for yourself, download SGD 5.1 (look under Desktop Virtualization Products) from the Oracle Software Delivery Cloud or if you're an existing customer, get it from My Oracle Support.  -FB 

    Read the article

  • Mozilla étend son programme de recherche de failles à ses applications web, 3000 $ offerts pour un bogue "extraordinaire"

    Le programme de Mozilla récompensant les découvertes de failles de sécurité étendu aux applications web, 3000$ offerts pour un bug "extraordinaire" Maj du 16/12/10 C'est une nouvelle qui va faire plaisir aux petits génies de la sécurité informatique : Mozilla vient d'agrandir son programme Security Bug Bounty. Jusqu'à maintenant, 3000 dollars étaient promis à quiconque dénicherait et rapporterait des failles critiques dans Firefox. Mais la Fondation va plus loin : ses applications web sont désormais concernées par cette mesure : "Nous voulons encourager la découverte de problèmes de sécurité au sein de nos web applications, dans le but de pr...

    Read the article

  • Generating SQL Server Test Data with Visual Studio 2010

    As a database developer or tester sometimes you need to have production like data in your environment for your development or testing, but you cannot have the production data because of security and privacy issues. So how you can generate test data or replicate similar data as in production for your development or test environment? Join SQL Backup’s 35,000+ customers to compress and strengthen your backups "SQL Backup will be a REAL boost to any DBA lucky enough to use it." Jonathan Allen. Download a free trial now.

    Read the article

  • Development methodology for single web developer?

    - by CaseTA
    I'm a web developer who mostly works with the LAMP stack when it comes to my own projects. Most of the time I just start coding on a project and fixing bugs and adding features as I go along. Often I'll try to use an existing solution such as Wordpress or Drupal. Now that I'm thinking of creating my own web application with businesses as the target group, I feel there's a need for proper analysis and design. Something lightweight for a one person project and still solid enough to handle requirements, user interfaces, security, etc. If you could recommend methodologies and literature I would be grateful.

    Read the article

  • SQL Injection: How it Works and How to Thwart it

    This is an extract from the book Tribal SQL. In this article, Kevin Feasel explains SQL injection attacks, how to defend against them, and how to keep your Chief Information Security Officer from appearing on the nightly news. NEW! The DBA Team in The Girl with the Backup TattooPina colada in the disk drives! How could any DBA do such a thing? And can the DBA Team undo the damage? Find out in Part 2 of their new series, 5 Worst Days in a DBA’s Life. Read the new article now.

    Read the article

  • Is there a ppa or repository where we can update LibreOffice to version 3.6?

    - by josircg
    On http://www.libreoffice.org/download/ there is only RPM version - when great majority of Desktop Linux users are using systems based on APT... ppa:libreoffice/ppa seems to be very outdated with version 3.5 It's frustating to see several fixes on Windows version and Ubuntu versions so outdated... People generally reply as: we don't update due to security/stability reasons, etc example 1 example 2 why don't you compile yourself ? For those easy answers, I generally reply: let me decide which version to use at my own risk. I just want to try a newer version and I trust on LibreOffice devs. I understand that update a core lib is very dangerous but Libreoffice is an user application and it don't just break the whole system. Why don't I compile ? Because I am a regular user and don't have time to learn it. I would love to have this time but unfortunately, I don't have. Red Hat/Fedora guys have the same concerns but they update their LibreOffices...

    Read the article

< Previous Page | 306 307 308 309 310 311 312 313 314 315 316 317  | Next Page >