Ruby on Rails is an open source programming language that provides a code stage to quickly build database-driven web applications.
It includes five standard packages:
ActiveRecord, ActiveResource, ActionPack, ActiveSupport and ActionMailer that can be extended. The Rails framework, which provides the structure for the models and views needed for a basic website, is developed employing the Model-View-Controller (MVC) architecture.
There are two concepts in Ruby on Rails--Convention over Configuration (CoC) and Don't Repeat Yourself (DRY).
The principle behind COC is that only strange aspects of the application need to be specified; otherwise, they follow the established standard.
DRY requires that information be placed in a single, unambiguous location to ensure a single point of reference and avoid hidden errors.
The principles behind Ruby on Rails allow for huge development speed while minimizing lines of code and errors. It has the advantage of including a lot of web development know how from its inception, which makes it simple to use, maintain, and extend.
Ruby on Rails is now widely embraced as a great tool to rapidly build scalable, database-driven web applications.
Friday, March 14, 2008
Saturday, March 08, 2008
DNS Security Issues (Misconfigurations)
DNS fall with security issues in a relation to:
Service/traffic redirection:
DNS requests(traffic) to any site, could be redirected to an IP address of a malicious attacker’s site using man in the middle attack or any other type of attacks.
As a user, you should verify the authenticity through cryptographic signature hashes even with trusted sites.
Similarly, name servers with MX records can be modified to redirect
e-mail from one domain to another.
Denial of service:
Instead of redirecting records elsewhere, they can be redirected to 10.1.1.12
or any another address range that does not exist which may deny legitimate target from being reached.
Zone transfers:
Domain record exchanges such as updating information across name servers can reconfigure packet routing across a network.
Past versions of name servers had no security, and anyone with access to programs like nslookup and dig were capable of issuing them.
DNS zone transfers should only be allowed between DNS servers and clients that actually need it.
DNS master is only transmitting zone information to (and only to) the IP addresses of slave-1/2..etc DNS servers, slave should not transmit to anyone in most configurations.
Also protection with zone transfers can be obtained by implementing DNS keys and even encrypted DNS payloads.
Else than that Instead of limiting transfers purely based on IP address, sites can maintain cryptographic signatures or relies on public key cryptography as in DNS security extensions (DNSSEC)
Predictable query IDs:
A query ID is included within a packet to uniquely identify sessions, such a query within a request is a security issue that allows an attacker to poison domain name server caches with forged address resolution information, a way to reduce the breadth of this attack random query IDs is used.
Secure How-To: Not only
-Using complete physical separation of internal recursive queries and external public name service to prevent DNS cache poisoning.
-Also securing dns could be by redundancy and load balancing which in turn requires that networks house more than one DNS server.
Service/traffic redirection:
DNS requests(traffic) to any site, could be redirected to an IP address of a malicious attacker’s site using man in the middle attack or any other type of attacks.
As a user, you should verify the authenticity through cryptographic signature hashes even with trusted sites.
Similarly, name servers with MX records can be modified to redirect
e-mail from one domain to another.
Denial of service:
Instead of redirecting records elsewhere, they can be redirected to 10.1.1.12
or any another address range that does not exist which may deny legitimate target from being reached.
Zone transfers:
Domain record exchanges such as updating information across name servers can reconfigure packet routing across a network.
Past versions of name servers had no security, and anyone with access to programs like nslookup and dig were capable of issuing them.
DNS zone transfers should only be allowed between DNS servers and clients that actually need it.
DNS master is only transmitting zone information to (and only to) the IP addresses of slave-1/2..etc DNS servers, slave should not transmit to anyone in most configurations.
Also protection with zone transfers can be obtained by implementing DNS keys and even encrypted DNS payloads.
Else than that Instead of limiting transfers purely based on IP address, sites can maintain cryptographic signatures or relies on public key cryptography as in DNS security extensions (DNSSEC)
Predictable query IDs:
A query ID is included within a packet to uniquely identify sessions, such a query within a request is a security issue that allows an attacker to poison domain name server caches with forged address resolution information, a way to reduce the breadth of this attack random query IDs is used.
Secure How-To: Not only
-Using complete physical separation of internal recursive queries and external public name service to prevent DNS cache poisoning.
-Also securing dns could be by redundancy and load balancing which in turn requires that networks house more than one DNS server.
Thursday, March 06, 2008
E-mail Risk ( Data vulnerabilities )
As a universally implemented protocol, email should be a target
for attacks and risk ; due to the very sensitive nature of the data or information that is transmitted.
E-mail at its core is safe because it does not transmit directly executable(binary) code.
But an e-mail client starts adding features to be more of a collaboration tool, such as Outlook which embed malcode that has chances of being decoded and launched.
An e-mail protocol like Post Office Protocol (POP), was used in the clear,
which means when a mail was received, it was transmitted with the POP3 protocol.
In such case, the entire e-mail fit into one packet and opportunity to capture packets and read e-mail content isn't off-topic.
Capturing and modifying of e-mail can be done either as a man-in-the-middle attack (using ARP spoofing tool, such as ettercap) or as a replay attack.
Man-in-the-middle attacks are best avoided by using encryption and digital signing of messages.
On the other hand, Spam DoS attacks are a result of spammers using false domains in the e-mails they send.
The most danger type of these attacks is when a spammer forges an address.
Spam attacks avoided by referencing a blacklist which is a database of known internet addresses (by domain names or IP addresses) used by spammers.
Blacklisted addresses return invalid responses so the server rejects the e-mail.
Proper e-mail authentication is also a security concern.
-Login authentication : user name and password passed separately encoded with base64.
The user name and password are then used to authenticate to the mail server.
- onPOP before SMTP : preventing spammers from using a mail server relay.
SMTP relaying is permitted by an IP address if that IP address has participated in a valid POP session in the prior X minutes.
The POP protocol requires a valid password so spammers will not be able to use POP prior to using the mail server for relaying.
A mail relay sits in the DMZ outside the perimeter firewall with a benefit having all mail received first by this mail relay which can check for unwanted scripts, viruses, and questionable attachments and also a good place to put spam protection, such as blacklist monitoring and spam filtering.
Securing e-mail traffic: discussed previously
Creating a secure tunnel for using less secure e-mail protocols can be a strong method of protecting the privacy and integrity of the e-mail.
With an SSH tunnel, we can still have the protection of the SSH encryption, in SMTP/POPing.
Later talking about SPF, DomainKeys ...etc
for attacks and risk ; due to the very sensitive nature of the data or information that is transmitted.
E-mail at its core is safe because it does not transmit directly executable(binary) code.
But an e-mail client starts adding features to be more of a collaboration tool, such as Outlook which embed malcode that has chances of being decoded and launched.
An e-mail protocol like Post Office Protocol (POP), was used in the clear,
which means when a mail was received, it was transmitted with the POP3 protocol.
In such case, the entire e-mail fit into one packet and opportunity to capture packets and read e-mail content isn't off-topic.
Capturing and modifying of e-mail can be done either as a man-in-the-middle attack (using ARP spoofing tool, such as ettercap) or as a replay attack.
Man-in-the-middle attacks are best avoided by using encryption and digital signing of messages.
On the other hand, Spam DoS attacks are a result of spammers using false domains in the e-mails they send.
The most danger type of these attacks is when a spammer forges an address.
Spam attacks avoided by referencing a blacklist which is a database of known internet addresses (by domain names or IP addresses) used by spammers.
Blacklisted addresses return invalid responses so the server rejects the e-mail.
Proper e-mail authentication is also a security concern.
-Login authentication : user name and password passed separately encoded with base64.
The user name and password are then used to authenticate to the mail server.
- onPOP before SMTP : preventing spammers from using a mail server relay.
SMTP relaying is permitted by an IP address if that IP address has participated in a valid POP session in the prior X minutes.
The POP protocol requires a valid password so spammers will not be able to use POP prior to using the mail server for relaying.
A mail relay sits in the DMZ outside the perimeter firewall with a benefit having all mail received first by this mail relay which can check for unwanted scripts, viruses, and questionable attachments and also a good place to put spam protection, such as blacklist monitoring and spam filtering.
Securing e-mail traffic: discussed previously
Creating a secure tunnel for using less secure e-mail protocols can be a strong method of protecting the privacy and integrity of the e-mail.
With an SSH tunnel, we can still have the protection of the SSH encryption, in SMTP/POPing.
Later talking about SPF, DomainKeys ...etc
Wednesday, March 05, 2008
UNIX/Linux as a poor vulnerability target
UNIX has some characteristics that make it less attractive for security attacks
Unix is still primarily used on different platforms.
This use, make the average UNIX user more knowledgeable about the operating system and security.
There are many scripting techniques in UNIX.
Unlike Windows, the scripting is not integrated into applications (such as Outlook and Word).
In UNIX, scripts can be integrated into applications such as mail and word processing, but not to be _the default configuration_.
This makes UNIX much less vulnerable than a Windows system that is running Outlook and allows users to commonly run Visual Basic scripts.
Also the inability of a common user to alter an executable is a severe restriction on viruses and worms that depend on users to propagate their malware.
On the other hand in Unix, Physical Security is somehow perfectly controlled:
(monitoring hardware changes)
A software tool library like kudzu, detects and configures new and/or changed hardware on a RedHat Linux system and currently ported to different other distros.
What's notable that it detects the current hardware and checks it against a database stored in /etc/sysconfig/hwconf, which mean it can be an eye on system hardware monitoring any changes.
Another piece in Unix is its partitioning of disks and file systems which can be a physical security issue.
File systems, such as ext3 in Linux, use journaling to make the recovery of damaged file systems more reliable.
Journaling provides for a fast file system restart in the event of a system crash, using database techniques, journaling can restore a file system in a matter of minutes, or even seconds.
Not finished yet....
Unix is still primarily used on different platforms.
This use, make the average UNIX user more knowledgeable about the operating system and security.
There are many scripting techniques in UNIX.
Unlike Windows, the scripting is not integrated into applications (such as Outlook and Word).
In UNIX, scripts can be integrated into applications such as mail and word processing, but not to be _the default configuration_.
This makes UNIX much less vulnerable than a Windows system that is running Outlook and allows users to commonly run Visual Basic scripts.
Also the inability of a common user to alter an executable is a severe restriction on viruses and worms that depend on users to propagate their malware.
On the other hand in Unix, Physical Security is somehow perfectly controlled:
(monitoring hardware changes)
A software tool library like kudzu, detects and configures new and/or changed hardware on a RedHat Linux system and currently ported to different other distros.
What's notable that it detects the current hardware and checks it against a database stored in /etc/sysconfig/hwconf, which mean it can be an eye on system hardware monitoring any changes.
Another piece in Unix is its partitioning of disks and file systems which can be a physical security issue.
File systems, such as ext3 in Linux, use journaling to make the recovery of damaged file systems more reliable.
Journaling provides for a fast file system restart in the event of a system crash, using database techniques, journaling can restore a file system in a matter of minutes, or even seconds.
Not finished yet....
Friday, December 28, 2007
Securing communication protocol traffic (SSH tunneling).
A useful option for secure communication between client/server is to tunnel the communication inside the Secure Shell protocol (SSH).
It can be used to tunnel POP3 and SMTP traffic using ssh.
-Sure u must have both ssh client and ssh server installed on the two ends.
-Create a local ssh tunnel on local machine (ex.port 5110) to the POP3 server's port 110 or SMTP 25
# ssh -f -N -L 5110:localhost:110 user@POP3_server
Or even simply binding to a privileged port (110, the POP port)
# ssh -L 110:mailhost:110 -l user -N mailhost
Same, you can also forward SMTP for outgoing mail (port 25), single ssh line can have multiple -L entries, like this:
# ssh -L 110:mailhost:110 -L 25:mailhost:25 -l user -N mailhost
-U can still check for port forwarded :
Telnet localhost (forwarded port)/
You should see the POP3 server's banner information.
-Finally you have to configure your mail client to access your mail via POP3 using mail server localhost and desired forwarded port.
It can be used to tunnel POP3 and SMTP traffic using ssh.
-Sure u must have both ssh client and ssh server installed on the two ends.
-Create a local ssh tunnel on local machine (ex.port 5110) to the POP3 server's port 110 or SMTP 25
# ssh -f -N -L 5110:localhost:110 user@POP3_server
Or even simply binding to a privileged port (110, the POP port)
# ssh -L 110:mailhost:110 -l user -N mailhost
Same, you can also forward SMTP for outgoing mail (port 25), single ssh line can have multiple -L entries, like this:
# ssh -L 110:mailhost:110 -L 25:mailhost:25 -l user -N mailhost
-U can still check for port forwarded :
Telnet localhost (forwarded port)/
You should see the POP3 server's banner information.
-Finally you have to configure your mail client to access your mail via POP3 using mail server localhost and desired forwarded port.
Thursday, December 27, 2007
Home network map modification ( somehow mobility)
I modified my home network somehow to give myself a way to have mobility around ;).
- Firing dhclient on Nixbox ==> IP obtainable automagically
- /etc/network/interfaces modifications
- Downing default gw
- Winbox --(Wlan/Wlan Ad-Hoc)--> NixBox ----> Router
- Firing ipmasq without firewall-configs (dpkg-reconfigure ipmasq)
- Winbox <--(Wlan(192.168.0.1)/Dns <> IPmasq)--> NixBox (Nix Connection masq)
- Noticed.., neither Bind(named) nor DNSmasq is needed, by default named installed.
- Apache/httpd port 80 --NAPT--> 192.168.0.1 <--(inside).
A long time i wondered to furnish this modification, finally ...
- Firing dhclient on Nixbox ==> IP obtainable automagically
- /etc/network/interfaces modifications
- Downing default gw
- Winbox --(Wlan/Wlan Ad-Hoc)--> NixBox ----> Router
- Firing ipmasq without firewall-configs (dpkg-reconfigure ipmasq)
- Winbox <--(Wlan(192.168.0.1)/Dns <> IPmasq)--> NixBox (Nix Connection masq)
- Noticed.., neither Bind(named) nor DNSmasq is needed, by default named installed.
- Apache/httpd port 80 --NAPT--> 192.168.0.1 <--(inside).
A long time i wondered to furnish this modification, finally ...
Friday, December 21, 2007
"_Someone i have lost long time ago_" Comment.
If you have lost someone close to you, how do you deal with the toughest moments
that hit you and don't always give you warning?
Sadness and suffering make people wiser -
Sadness and suffering will follow us as long as we live -
If you can no longer feel these emotions, it's a sign that you have
stopped growing as a person.
Sadness and suffering enable us to be strong enough to be kind to others.
When a loved one is gone, you'd look for his or her image in everything that you see,
and everything that's within you seek an exact image of how you'd like to see your loved one again, pay an attention when you love again to the one you are loving, as not being your loved one substitute.
Take a good look around you: paying too much attention to what you have lost, lets you neglect what you have/in now.
Look into the bottom of your soul and find what you really need.
Think of loving, and not of being loved.
If there is someone who is in more pain and sorrow than you are,
Give him or her your loving hand and warm support...
feel to be felt...
You have the ability to comfort others to become comforted
that hit you and don't always give you warning?
Sadness and suffering make people wiser -
Sadness and suffering will follow us as long as we live -
If you can no longer feel these emotions, it's a sign that you have
stopped growing as a person.
Sadness and suffering enable us to be strong enough to be kind to others.
When a loved one is gone, you'd look for his or her image in everything that you see,
and everything that's within you seek an exact image of how you'd like to see your loved one again, pay an attention when you love again to the one you are loving, as not being your loved one substitute.
Take a good look around you: paying too much attention to what you have lost, lets you neglect what you have/in now.
Look into the bottom of your soul and find what you really need.
Think of loving, and not of being loved.
If there is someone who is in more pain and sorrow than you are,
Give him or her your loving hand and warm support...
feel to be felt...
You have the ability to comfort others to become comforted
Thursday, December 20, 2007
A Long time away:
But there's something happening in me
Simple rules of cooperation with what's nearby lead to unexpected, even startling complexities that you could not have predicted from the rules (emergent phenomena). This is a neat parallel to the way that startling and unexpected phenomena like open-feeling emerge in me.
Simple rules of cooperation with what's nearby lead to unexpected, even startling complexities that you could not have predicted from the rules (emergent phenomena). This is a neat parallel to the way that startling and unexpected phenomena like open-feeling emerge in me.
Tuesday, September 11, 2007
Today's mood
Always _he_ insists and will insist on __it__ , "He's rude, impoliteness and indecency "
-I'm thinking ..., i have an educated mind to be able to entertain __this thought__ or this insistence without accepting it.
-To conclude, strike or to reach an agreement concerning duties, isn't off-topic;
It's even a better way.
-Silly to put all that effort into something that's just going to die, but factual.
-Cases with similarities, but which one that really deserves ????
-For who knows what is good for mortals while they live the few days of their vain life?
-I'm thinking ..., i have an educated mind to be able to entertain __this thought__ or this insistence without accepting it.
-To conclude, strike or to reach an agreement concerning duties, isn't off-topic;
It's even a better way.
-Silly to put all that effort into something that's just going to die, but factual.
-Cases with similarities, but which one that really deserves ????
-For who knows what is good for mortals while they live the few days of their vain life?
Thursday, September 06, 2007
"Discordianism" believes or apophenia phobia ...?
-Is it a challenge of chance to correlate incidents to
"Law of Fives", "The Law of 23s" and "The 23 Enigma" ?
Why 23 is an enigma ?
- Cosmic number ?
- Applying the experience of seeing patterns or connections in random or meaningless data ?
- A suspense was in the Bible reads: "and be sure your sin will find you out", Numbers 32:23
- Also this number has some unique features : 2/3 = 0.666 & 2*3=6
- I don't care about Discordians and there believes maybe it's somehow interesting.
Anyhow :) i see it interesting for myself to use apophenia discovering the theory: Complete mathematical disorder in any physical system is an impossibility.
"Law of Fives", "The Law of 23s" and "The 23 Enigma" ?
Why 23 is an enigma ?
- Cosmic number ?
- Applying the experience of seeing patterns or connections in random or meaningless data ?
- A suspense was in the Bible reads: "and be sure your sin will find you out", Numbers 32:23
- Also this number has some unique features : 2/3 = 0.666 & 2*3=6
- I don't care about Discordians and there believes maybe it's somehow interesting.
Anyhow :) i see it interesting for myself to use apophenia discovering the theory: Complete mathematical disorder in any physical system is an impossibility.
Wednesday, September 05, 2007
Common experience along the nights
-Long nights with a compelling sense of familiarity, and also a sense of "eeriness", "strangeness", or "weirdness".
-Following the same path,
-Be far from the conscious mind.
-Déjà vu, Déjà senti et Déjà visité.
-Following the same path,
-Be far from the conscious mind.
-Déjà vu, Déjà senti et Déjà visité.
Friday, August 31, 2007
Thursday, August 30, 2007
Google Interview
-I never applied. Google contacted me, and asked me to interview. I agreed, only after explaining that I was very happy where I was and that I was very unlikely to move.
-Basically, Google does not care about your current skills, what you have done or even who you are. They have some sort of a glass shoe and try to see if your foot fit into it.
-Still i have to set the second interview.
-Basically, Google does not care about your current skills, what you have done or even who you are. They have some sort of a glass shoe and try to see if your foot fit into it.
-Still i have to set the second interview.
Monday, August 06, 2007
Strange Dream
I t was yesterday .
A strange dream , I'll post it in few points , but firstly i want to mention that it's a symbolism.
-Drunk friend by my wine bottle , faced a battery.
-A young girl fights to see a police major.
-Underground road event full of strange shape of drunk ppl and me inside it with noway out.
Comments .... ?
A strange dream , I'll post it in few points , but firstly i want to mention that it's a symbolism.
-Drunk friend by my wine bottle , faced a battery.
-A young girl fights to see a police major.
-Underground road event full of strange shape of drunk ppl and me inside it with noway out.
Comments .... ?
Wednesday, August 01, 2007
Vista Vs Linux
Something that always will never end :
Comparing Vista <> Linux ,
Some points and factors that i would like to log it , maybe it's a type of reference for 1D10T Microsoftians
Guy quotes => /*... */
me => Bold
/*
OK, let me ask you a simple question about Linux shell:
Can you explore object models in linux shell? (i.e. SQL Server, Oracle, etc)? So you can go to any object and type dir and you'll get all the relations, functions, properties, variables, etc?
*/
-Oracle doesn't use .net in linux so that's silly question
-There already is a object-based shell try to google "object+shell" Linux.
Personally, I'd map those things onto fs-level objects, fs-named.
/*
And about viruses, please don't ever mix viruses with vulnerabilities, if a virus is working on your system due to a vulnerability, then it's a security issue, otherwise it's not related to security at all, it's just another program!
*/
You should realize looking at that list that it's mostly third party software
1)There are TONS of applications available for linux that are all free. A lot are on this list
2) Security in open source projects tends to be more proactive and open- so more vulnerabilities are reported , at the time windows is a closed source and facing always vulnerabilities even at the system level.
3) if you want to compare the security as it relates to YOUR system, look at remotely exploitable vulnerabilities in the services you are running not a random list of programs from 2 years ago
/*
Enterprise Linux is not for free (its price is more than windows server)
i.e.:
The most expensive edition of Windows Server is Windows Server 2003 R2 Enterprise Edition, it costs $3,999 for 25 CALs, and it comes in 32bit and 64 bits.
While redhat Red Hat Application Stack premium costs $8,499
*/
The application stack is a marketing term and it's not more than a bunch of applications,
You have to know what you want to do before thinking in what you want to use.
You don't need "integrated applications and solutions", you need a system that does something.
And Linux provide a bunch of applications in different distros for this purpose and you can make your own application stack for free.
/*
1- When I referred to Oracle I was giving an example (by the way google is supporting .Net since version 10).
*/
Even if Oracle 10 is supporting .Net but not under Linux.
/*
2- I don't think that "vulnerabilities" in kernel fall under "3rd party tools"
*/
Kernel is always as i said an "open source project tends to be more proactive and open- so more vulnerabilities are reported" in a comparison to win kernel.
/*
3- Refer back to my last post about the term "free", nothing free in this world
*/
All the bunch of available open source softwares aren't free ?!! with an already applications integrations and inter managed dependencies all in one distro available for download and with available support from its communities from all over the world.
Comparing Vista <> Linux ,
Some points and factors that i would like to log it , maybe it's a type of reference for 1D10T Microsoftians
Guy quotes => /*... */
me => Bold
/*
OK, let me ask you a simple question about Linux shell:
Can you explore object models in linux shell? (i.e. SQL Server, Oracle, etc)? So you can go to any object and type dir and you'll get all the relations, functions, properties, variables, etc?
*/
-Oracle doesn't use .net in linux so that's silly question
-There already is a object-based shell try to google "object+shell" Linux.
Personally, I'd map those things onto fs-level objects, fs-named.
/*
And about viruses, please don't ever mix viruses with vulnerabilities, if a virus is working on your system due to a vulnerability, then it's a security issue, otherwise it's not related to security at all, it's just another program!
*/
You should realize looking at that list that it's mostly third party software
1)There are TONS of applications available for linux that are all free. A lot are on this list
2) Security in open source projects tends to be more proactive and open- so more vulnerabilities are reported , at the time windows is a closed source and facing always vulnerabilities even at the system level.
3) if you want to compare the security as it relates to YOUR system, look at remotely exploitable vulnerabilities in the services you are running not a random list of programs from 2 years ago
/*
Enterprise Linux is not for free (its price is more than windows server)
i.e.:
The most expensive edition of Windows Server is Windows Server 2003 R2 Enterprise Edition, it costs $3,999 for 25 CALs, and it comes in 32bit and 64 bits.
While redhat Red Hat Application Stack premium costs $8,499
*/
The application stack is a marketing term and it's not more than a bunch of applications,
You have to know what you want to do before thinking in what you want to use.
You don't need "integrated applications and solutions", you need a system that does something.
And Linux provide a bunch of applications in different distros for this purpose and you can make your own application stack for free.
/*
1- When I referred to Oracle I was giving an example (by the way google is supporting .Net since version 10).
*/
Even if Oracle 10 is supporting .Net but not under Linux.
/*
2- I don't think that "vulnerabilities" in kernel fall under "3rd party tools"
*/
Kernel is always as i said an "open source project tends to be more proactive and open- so more vulnerabilities are reported" in a comparison to win kernel.
/*
3- Refer back to my last post about the term "free", nothing free in this world
*/
All the bunch of available open source softwares aren't free ?!! with an already applications integrations and inter managed dependencies all in one distro available for download and with available support from its communities from all over the world.
SOME FACTS
-USer-mode((glibc=linux/unix style) || (win32=c runtime)) both refere to standard C style lib
-Win32 has huge dependecies on the NT kernel
-Win32 API the that manipulate the kernel vista
Linux vulnerabilities:
-Most linux vulnerabilities are found and fixed by the kernel developers before they are at all popular for exploits
-If we want to make a comparison, look at the TIME ( the time the exploit was in wild , with exploit code available and used, until the time a patch was released, sum that up for all remote exploits on both kernels ) that vulnerabilities had exploit code in the wild not the number of them.
-Also , we should consider whether we will be depending on the distro to manage our security updates , or get them directly from kernel source update, the former will increase the time an exploit is available .
-Number of _public_ vulnerabilities = number of vulnerabilities reported by people.
That has precious little to do with the number of vulnerabilities present and undiscovered
that said , linux is a changing target ; it gets more new code in than closed systems(or more slowly developing software in general).
-There are many reasons people normally know these reasons, and saying "foo X is more secure than Y, because it has less _public_ vulnerabilities" is pretty moot
Kernel comparison :
-Vista kernel can not be compared to linux one cause nt kernels do not provide unix semantics to programs
-The NT kernel doesn't natively support *any* devices except the serial port , which is used to dump memory when you get a BSOD ;)
-Windows drivers are supplied by the vendors.
-Apart from proprietary drivers, like ATI NVIDIA etc, the Linux kernel contains all the drivers, in windows , when you buy a new card/whatever the vendor supplies a driver the majority included with wondows are made by the vendor and certified by M$ (and the vendor got it from the guys who made the chip)
Linux shell / PowerShell :
As a test for shell performance,
-I'd toss in a command line like
"time for file in *.jpg;do convert "$file{file%.jpg}.png";done > convert.log"
measure time of the following for every file with extension .jpg, call the convert command with as first parameter the filename, as second parameter the filename with the trailing '.jpg' replaced with '.gif,' end of loop write all output generated by the loop to convert.log.
-I do not know how this would be done in PowerShell, but i expect it to be rather painful
-I assume any shell worth the name has some mechanism like pipes, but i doubt they would come close to the flexibility you have with line-based data and tools like tr, grep and sed
-Questions regarding Power shell :
Is there anything resembling ‘which’?
Is there anything like history expansions (!$, !*, !!)?
What about command substitution (ls -l `which ls`)?
What about background jobs ?
Object model :
-Personally, I'd map those things onto fs-level objects, fs-named.
-We would produce a text representation of the object, which would then be manipulated through the usual tools and converted back into an object by a program if it so desires , there is nothing preventing us from writing a program (which you could call from bash) which parses such expressions and does things accordingly , though command-line-interfaces to dbus work this way.
Finally what about the /Proc in Vista , is there something could be the same and with the exact possibilities ?
Vista or any Window$ is available for how many Archs ?
-Win32 has huge dependecies on the NT kernel
-Win32 API the that manipulate the kernel vista
Linux vulnerabilities:
-Most linux vulnerabilities are found and fixed by the kernel developers before they are at all popular for exploits
-If we want to make a comparison, look at the TIME ( the time the exploit was in wild , with exploit code available and used, until the time a patch was released, sum that up for all remote exploits on both kernels ) that vulnerabilities had exploit code in the wild not the number of them.
-Also , we should consider whether we will be depending on the distro to manage our security updates , or get them directly from kernel source update, the former will increase the time an exploit is available .
-Number of _public_ vulnerabilities = number of vulnerabilities reported by people.
That has precious little to do with the number of vulnerabilities present and undiscovered
that said , linux is a changing target ; it gets more new code in than closed systems(or more slowly developing software in general).
-There are many reasons people normally know these reasons, and saying "foo X is more secure than Y, because it has less _public_ vulnerabilities" is pretty moot
Kernel comparison :
-Vista kernel can not be compared to linux one cause nt kernels do not provide unix semantics to programs
-The NT kernel doesn't natively support *any* devices except the serial port , which is used to dump memory when you get a BSOD ;)
-Windows drivers are supplied by the vendors.
-Apart from proprietary drivers, like ATI NVIDIA etc, the Linux kernel contains all the drivers, in windows , when you buy a new card/whatever the vendor supplies a driver the majority included with wondows are made by the vendor and certified by M$ (and the vendor got it from the guys who made the chip)
Linux shell / PowerShell :
As a test for shell performance,
-I'd toss in a command line like
"time for file in *.jpg;do convert "$file{file%.jpg}.png";done > convert.log"
measure time of the following for every file with extension .jpg, call the convert command with as first parameter the filename, as second parameter the filename with the trailing '.jpg' replaced with '.gif,' end of loop write all output generated by the loop to convert.log.
-I do not know how this would be done in PowerShell, but i expect it to be rather painful
-I assume any shell worth the name has some mechanism like pipes, but i doubt they would come close to the flexibility you have with line-based data and tools like tr, grep and sed
-Questions regarding Power shell :
Is there anything resembling ‘which’?
Is there anything like history expansions (!$, !*, !!)?
What about command substitution (ls -l `which ls`)?
What about background jobs ?
Object model :
-Personally, I'd map those things onto fs-level objects, fs-named.
-We would produce a text representation of the object, which would then be manipulated through the usual tools and converted back into an object by a program if it so desires , there is nothing preventing us from writing a program (which you could call from bash) which parses such expressions and does things accordingly , though command-line-interfaces to dbus work this way.
Finally what about the /Proc in Vista , is there something could be the same and with the exact possibilities ?
Vista or any Window$ is available for how many Archs ?
Monday, January 22, 2007
CVS Reminder
-First Set the Env. Var. CVSROOT to the cvsrepo directory
-mk. dir. ( project ) wishing to add it to the repos. inside the repos.
-Checkout this directory
-Add files and commit.
-mk. dir. ( project ) wishing to add it to the repos. inside the repos.
-Checkout this directory
-Add files and commit.
Sunday, January 21, 2007
Google hacks security vulnerabilities
Default Resources:
Directory Listings :
return URLs that contain directory listings of /admin.
Directory Listings :
return URLs that contain directory listings of /admin.
more queries that take advantage of directory listings:
Error Messages:Remote Services:
GoogleAnalytics V.s AW
Google analytics as a __remote-hosting__ statistics analyzer tool;
useful features:
- Browser & Platform Combos versions
- Unique/returner Visitors
- Languages
- Referring Source Google, yahoo....
- Java Enabled
- Geo Location
- Geo Map Overlay
- Flash Version
- Connection Speed
- Network Location
- Top Content/Content by title.
- Depth/Length of Visit
- XML/excel/Tab-separated exportation for every single statistic.
What's in Aw. and not of Google A. :
-rush hours report
-Visits of robots checker
-Worms attacks checker
-Number of times your site is "added to favorites bookmarks".
-Whois links
-Static reports in one or framed HTML/XHTML pages, experimental PDF export.
Aw Requirements :
-Server must log web access in a log file you can read.
-Ability to run Perl scripts (.pl files) from command line and/or as CGI.
-Somehow Aw. can be used locally without server access by either SFTPing all logs but only if they are made accessible and work on them locally, or by using a _trick_ ,
Add a tag to call a CGI script like _pslogger_ into each of the web pages that acquiring analysis . This to have an artificial log file that can be analyzed by AW.
For dereferencing / presentation issues ;
useful features:
- Browser & Platform Combos versions
- Unique/returner Visitors
- Languages
- Referring Source Google, yahoo....
- Java Enabled
- Geo Location
- Geo Map Overlay
- Flash Version
- Connection Speed
- Network Location
- Top Content/Content by title.
- Depth/Length of Visit
- XML/excel/Tab-separated exportation for every single statistic.
What's in Aw. and not of Google A. :
-rush hours report
-Visits of robots checker
-Worms attacks checker
-Number of times your site is "added to favorites bookmarks".
-Whois links
-Static reports in one or framed HTML/XHTML pages, experimental PDF export.
Aw Requirements :
-Server must log web access in a log file you can read.
-Ability to run Perl scripts (.pl files) from command line and/or as CGI.
-Somehow Aw. can be used locally without server access by either SFTPing all logs but only if they are made accessible and work on them locally, or by using a _trick_ ,
Add a tag to call a CGI script like _pslogger_ into each of the web pages that acquiring analysis . This to have an artificial log file that can be analyzed by AW.
For dereferencing / presentation issues ;
Subscribe to:
Posts (Atom)