Friday, April 08, 2005
The Code Project - SQL Tuning Tutorial - Understanding a Database Execution Plan (1) - C# Database by Gael Fraiteur, a Belgian Software Engineer in Prague, Czech Republic: "My everyday job is to develop back-office applications for a mobile telecom operator. When a customer orders a service through the web or voice front-end, our applications have to provide a very quick feedback. Although we are required to answer in less than one second, we have to perform complex SQL statements on databases large of douzens of gigabytes."
iFrames + JSP = Enhanced Web Content Retrieval: "Used with JavaScript and JSP code, iFrames elegantly resolve the 'hang' issue that occurs when a Web application fetches values from the server."
Community Server: "is a rich knowledge management and collaboration platform designed to meet the demands of the most rigorous collaborative needs. It is used by fortune 100 companies, small start-up businesses, schools, and individuals to better connect, share, and collaborate. Community Server is perfect for setting up a support system for products, reporting, and general information management by organizations or individuals."
Thursday, April 07, 2005
Using LDAP for Web Page Authentication: "This document describes how to set up secured web pages such that only people with accounts can gain access."
Guide: "The original OWASP Guide to Building Secure Web Applications has become a staple diet for many web security professionals. Over the last 24 months the initial version has now been downloaded over 2 million times."
ONLamp.com: Google Your Site For Security Vulnerabilities: "If Google stumbles across data that may expose sensitive information about your organization, Google will not hesitate to index it. The search engine does not discriminate against data it indexes. How can you tell if your secrets have gone public? You can use Google to your advantage with some specific search queries. The inspiration for the examples presented in this article come from Johnny Long. This article will also show you how to use the Google API to automate the process of searching Google for vulnerabilities... To run this script:
Lessons Learned: The google_vulns.php script exposes vulnerabilities that are, in most cases, results of ignorance and negligence of the most basic best practices. Some of the example queries presented in this section rely on un-hardened web servers. The Apache web site contains links to numerous resources that can help administrators harden their web servers, including Apache
- Go to Google Web APIs and sign up for an account. They will mail you a license key.
- Download the google_vulns.php PHP script.
- Edit the script and change the value of
$keyto reflect your Google license key. - Download signatures.txt and place it in the same directory as google_vulns.php.
- Download GoogleSearch.wsdl and place it in the same directory as google_vulns.php.
- Download nusoap.php from NuSOAP.
Lessons Learned: The google_vulns.php script exposes vulnerabilities that are, in most cases, results of ignorance and negligence of the most basic best practices. Some of the example queries presented in this section rely on un-hardened web servers. The Apache web site contains links to numerous resources that can help administrators harden their web servers, including Apache
httpd security tips and Apache httpd tutorials. In addition, administrators should routinely audit directories that serve as web roots to ensure the absence of sensitive content. Web applications should also undergo hardening to not provide sensitive information to users. Many web-application vulnerabilities happen due to insecure coding practices. Here are some resources that can help developers understand how to secure their applications:- "PHP Security" (Part 1, Part 2, and Part 3).
- "Secure Programming for Linux and Unix HOWTO"
- "Perl Security"
- "How to Remove Meta-characters From User-Supplied Data in CGI Scripts"
- "Building Secure ASP.NET Applications: Authentication, Authorization, and Secure Communication"
Infosecwriters.com: "A major objective of the Info Security Writers is seeking the security enthusiasts who write" > The Hitchhiker's World: "Welcome to ISW's e-zine that features network-security articles & programs spiced with some personal expression... Issue #9 is released." > Thick Client Application Security by Arindam Mandal on 16/01/05 [PDF]
Using JAAS for Authorization and Authentication: "This paper explains how to use the Java Authentication and Authorization API (JAAS). It plugs JAAS into the Struts framework. Though this paper focuses on Struts, and in particular the example application distributed with Struts, the lessons learned should be applicable to any MVC web framework." - COOL
Extend JAAS for class instance-level authorization: "The Java Authentication and Authorization Service (JAAS) is an extension to the Java 2 SDK. Under JAAS, a user or service may be given specific permissions to execute code in a Java class. In this article, software engineer Carlos Fonseca shows you how to extend the JAAS framework for the enterprise. Adding class instance-level authorization and special relationships to the JAAS framework lets you build more dynamic, flexible, and scalable enterprise applications."
J2EE security: When to use the container versus custom security: "J2EE offers a standard security mechanism, we also have other standards such as JAAS. Every time you start a new J2EE project, you make a choice on how you want to handle security. This article goes through the choices, asks for some new features, and tries to help you decide what to do."
J2EE security: Container versus custom: "This article covers the factors to consider when choosing between custom security and J2EE standard security, also known as container security. It briefly covers how each type of security works and then illustrates their differences, strengths, and weaknesses. Although J2EE security itself applies to all components of an enterprise application, this discussion's main focus is Web application security or, more specifically, authentication."
Frank Nimphius' Blogbuster: J2EE Security Archives: "Today I googled about J2EE security, which is what we currently understand under container managed security, and the Java Authentication and Authorization Service (JAAS). Looking for a good topic for a whitepaper or conference submission, I was interested in seeing how well this topic is covered on the Internet..." - START!
Authentication Framework: "The central point for building a web application is authentication. The Cocoon authentication package is a flexible module for authentication and user management. A user can be legitimated using any information available via any source, e.g. a database or LDAP. With this mechanism it is very easy and fast to use an exisiting user management/authentication system."
User Handling Proj: "Design and implement a flexible framework for handling user authentication and authorization in Webware applications... Background Reading:
- http://cookies.lcs.mit.edu/pubs/webauth:tr.pdf -- a must read!
- http://www.wwnet.net/~janc/auth.html
- http://www.zope.org/Documentation/ZDG/Security.stx
- http://www.skyhunter.com/marcs/ewalnut.html#SEC41 -- E, a capabilities language: relates to capabilities as a permission system (something to implement in Python? Not according to E -- but maybe in a casual manner)
- http://www.eros-os.org/essays/00Essays.html -- EROS: The Extremely Reliable Operating System, also uses capabilities. What *is* a Capability, Anyway? and Comparing ACLs and Capabilities address the ACL vs. Capability question, with a decidedly mathemathical bend. Makes the argument that the two are not orthogonal (i.e., basically the same)."
Tutorial: Developing Your First Spring Web Application: "I downloaded the accompanying source code for this chapter from here http://www.sourcebeat.com/downloads/myusers-ch2.tar.gz and have had not a lot of fun trying to get it working in WSAD."
Wednesday, April 06, 2005
Interoperability Resources: "This article covers interoperability between the Microsoft.com Web service, built with Web Services Enhancements 1.0 SP1 for Microsoft .NET, and a Java client. See how the WS-Security specification and implementation can be used to validate a Web service call from Java to Microsoft .NET. GLUE 4.1.2 Professional from webMethods will be used to enable WS-Security functionality for the Java client."
SLAX Linux Live - webconfig page: "Everything you modify, create or download during a Live-CD session is kept in memory until the computer is rebooted; then it's all lost. More precisely, it WAS lost until SLAX came out and the new era of portability began... Don't carry your settings along with you anymore, just remember a secret pass phrase!"
Netscape 7.2: "built with Mozilla - is faster than previous versions, has new, enhanced security features and, most importantly, gives you a choice when it comes to browsers"
DeanSpace | providing tools, support, and advice to Howard Dean's grassroots supporters: "DeanSpace is a website content-management application based on the open-source Drupal community software... Group and access management serves two purposes. First, provide a way to create finer grained groups within one site which members join and create sub-communities. Second, provide a mechanism to control access to certain content. The core functionality is provided by the groupapi module." - COOL!
db2ssd - Welcome to the db2ssd Homepage!: "database-documentation tool that generates diagrams from databases" - COOL!
Quizzes | Webs4.com: "A quiz is a sequential list of questions. Answering one moves the user on to the next. There are two separate workflows pertaining to quizzes, configuring a quiz and taking a quiz." = The quiz.module, an experiment in pooling resources for Drupal
Google Directory: PHP > Scripts > Content Management: 1) Drupal - An engine suitable to setup or build a content driven or community driven website. Modular design allows flexibility in design. 2) eZ publish - A content management system and development framework. It include advanced workflow system, content versioning, multilanguage possibilities, collaboration, e-commerce functionality, content class system, role based access control, discussion forums. [Open source, GPL/other licences] 3) Spidean :: Pinnacle of Excellence - Free GPL and commercial themes and modules for the PostNuke, PHP-Nuke, MD-Pro and eNvolution CMSs. Home of the AutoTheme HTML Theme System
Tuesday, April 05, 2005
OurMediaCustomLogin - Bryght Public Repository - Trac: "This is a PHPTemplate snippet which you can use to add a custom login area to your template."
Ourmedia Homepage | Ourmedia: "We provide free storage and free bandwidth for your videos, audio files, photos, text or software. Forever. No catches."
igrep: "Igrep is the first (and only) vertical niche search engine specifically aimed at developers and other people deeply interested in technology. It is a search engine designed to help programmers be more productive by enabling them to quickly locate exactly the information they need." - COOL!
WindowsDevCenter.com: Create Podcasts Using Your PC: "In my previous article, I wrote about receiving podcasts. This time around, I'm walking through the steps required to record and post your own podcast using tools virtually everyone has or can easily acquire on a tiny budget. Ultimately, if you decide to podcast on a regular basis, some equipment upgrades such as the podcast recording kit I recently detailed at JakeLudington.com will drastically improve the sound quality. To learn the process, though, you don't need anything fancy."
drupal.org | Community plumbing: "an open source content management platform." - Javalobby Newsletter: "Is there any Java package that does what this PHP package does? We have a couple of new sites in development for the Javalobby network, and we have been facing the tough question of whether or not to use Java to build them? After long consideration we're close to deciding not to, at least not for the main core of the sites. Instead, we're thinking we may try out the powerful PHP content management system called Drupal. As far as we know there's nothing quite like this in the Java space, and the effort required to implement the features Drupal offers by default would take us a long time to develop in Java. It just doesn't make sense to start from scratch when there's an active community already growing around Drupal. We have looked at JetNuke, JBoss Portal, and several other Java-powered options, but as far as we can tell they are not superior for our purpose. Even if we do use Drupal, we'll still be able to use Java for back-end services and logic, and we feel the hybrid approach may allow us to get the job done faster and with less heavy lifting."
Caucho Technology: The Hessian binary web service protocol "makes web services usable without requiring a large framework, and without learning yet another alphabet soup of protocols. Because it is a binary protocol, it is well-suited to sending binary data without any need to extend the protocol with attachments... More details are at Hessian introduction and in the Hessian Service using Dependency Injection tutorial." - Java, PHP, C++, C# - COOL!
Javalobby - Java J2EE Programming Forums - JExamples.com: Java Examples in Open Source Code: "free website that helps Java developers find high quality example code for virtually any Java API. JExamples uses sophisticated source analysis and a powerful search engine to find examples in well known Java open source products (e.g. Ant, Tomcat). The search results help you pick the best example (ordered by user rating), and can show you entire source files, with examples highlighted. http://www.jexamples.com"
Windows Media: "The Windows Media Player has about one hundred properties and over 20 methods. The Media Player methods (Play, Pause, Stop, etc) will work with both the ActiveX control and the plug-in as they stand. Accessing and modifying the properties of the Media Player, however, requires somewhat different scripting syntax between the ActiveX control and the plug-in. For a given property, such as the read-write "FileName" property, plug-in code must access the property using the SetpropertyName and GetpropertyName methods." - TIPS!
How to embed Windows Media Player in HTML document | Resources | Mioplanet: "Most important parameters supported by Windows Media Player 7 and later:..."
White Paper: Developing Voice-Enabled Web Services by Hewlett-Packard Company: "Hewlett-Packard adds VoiceXML support to Eclipse, which is an open extensible platform that can provide a unified development environment for VoiceXML applications."
Enterprise Java Research Library: "Find the latest white papers, case studies, webcasts and product information to help you expand your knowledge of Java and other relevant technologies. Browse and search through this large repository of documents on the topics that are important to you, from J2EE to SOA to Web Services. View the Daily Top 50 Reports to see the most popular IT reports on Java and Java related topics."
MDA code generation framework AndroMDA 3 released: "It takes a UML model from a CASE-tool and generates classes and deployable components (J2EE or other) specific for your application architecture." - COOL!
Adding Windows Media to Web Pages: "This article shows how easy it is to add Windows Media to a Web page, and provides a glimpse at how far you can go in creating a total user experience."
Open Source Usability: The birth of a movement: "Civic Space Labs (one of the sprint project participants) redesigned their website. This is what the redesigned website looks like. Contrast this to the websites for other open source projects."
Streamalot: How to embed a Media Player: "Below, you will find the code needed to embed the Windows media and Real player."
Firefox and windows media player - video from an onclick: "I have embedded windows media player (10) in a web page and while it works fine in IE and Netscape 7.2, the video player doesn't appear at all in Opera, Mozilla or Firefox."
davidtemkin.com: Serverless Laszlo is here: "The big feature that's new in this beta is the ability to deploy Laszlo applications without the presentation server. That means that from this point forward, if your Laszlo app does not require a set of specific features (including SOAP, Java RPC, and some types of media transcoding), you can deploy it without installing Java or LPS on the server, and without the extra tier (proxy) in your deployment. This should open up Laszlo development to a lot of new developers." - CTO of Laszlo has started a blog of his own and talks alot about XML, Flash and how the components work together - Read more.
Flexible DTS Packages with Perl: "Microsoft DTS provides a powerful platform for data Extraction, Translation, and Loading (ETL). The DTS Object Model allows you to 'fine tune' particular aspects of DTS. The advantage of building DTS packages with a scripting language such as Perl is that you can quickly view properties, make changes, and execute the package without recompiling source code. ActiveState Perl provides additional features such as calling variables by reference so that certain OLE method calls can properly return values by changing these variables"
Subscribe to:
Posts (Atom)
Atom