Search Results

Search found 30819 results on 1233 pages for 'software security'.

Page 296/1233 | < Previous Page | 292 293 294 295 296 297 298 299 300 301 302 303  | Next Page >

• IIS reveals internal IP address in content-location field - fix

  - by saille

  Referring: http://support.microsoft.com/kb/q218180/, there is a known issue in IIS4/5/6 whereby it will reveal the internal IP of a web server in the content-location field of the HTTP header. We have IIS 6. I have tried the fix suggested, but it has not worked. The website is configured to send all requests to ASP.NET, and I am wondering if this is why the fix, which addresses IIS configuration, has not worked for us. If this is the case, how would we fix this in ASP.NET? We need to fix this issue in order to pass a security audit.

  Read the article

• How can I monitor if a cookie is being sent to a domain other than the one it originated from?

  - by Brendan Salt

  I am trying to write a program that will verify that all cookies sent out from the machine are in fact going to the domain they came from. This is part of a larger security project to detect cookie based malicious attacks (such as XSS). The main snag for this project is actually detecting the out-going cookies. Can someone point me in the right direction for monitoring out-going HTTP traffic for cookie information? Other information about the project: This is a windows application written in C and numerous scripting languages. Thanks so much for the help.

  Read the article

• Is there any benefit to encrypting twice using pgp?

  - by ojblass

  I am asking from a "more secure" perspective. I can imagine a scenario with two required private keys needed for decryption scenarios that may make this an attractive model. This is to settle an argument. My vote is that it is not adding any additional security other than having to compromise two different private keys. I think that if it was any more secure than encrypting it one million times would be the best way to secure informaiton and I don't buy it. So I guess my question becomes is a two locking mechanism equivalent to another one locking mechanism with a single key? Update: Forgive me if the answer is obvious but my bread goes dead as I read books on the topic.

  Read the article

• Why Shouldn't I Programmatically Submit Username/Password to Facebook/Twitter/Amazon/etc?

  - by viatropos

  I wish there was a central, fully customizable, open source, universal login system that allowed you to login and manage all of your online accounts (maybe there is?)... I just found RPXNow today after starting to build a Sinatra app to login to Google, Facebook, Twitter, Amazon, OpenID, and EventBrite, and it looks like it might save some time. But I keep wondering, not being an authentication guru, why couldn't I just have a sleek login page saying "Enter username and password, and check your login service", and then in the background either scrape the login page from say EventBrite and programmatically submit the form with Mechanize, or use an API if there was one? It would be so much cleaner and such a better user experience if they didn't have to go through popups and redirects and they could use any previously existing accounts. My question is: What are the reasons why I shouldn't do something like that? I don't know much about the serious details of cookies/sessions/security, so if you could be descriptive or point me to some helpful links that would be awesome. Thanks!

  Read the article

• What is the difference between these senior software engineer titles?

  - by stackoverflowuser2010

  I'm currently a senior research software engineer at a large company and am being offered a "senior staff engineer" position somewhere else. I am not sure if the new position's title conveys a sideways move or an advancement. So, all other things being roughly equal (salary, domain of expertise, etc.), what is the external difference between these software engineer titles (in general and regardless of any particular company, if possible): senior engineer senior research engineer senior staff engineer member of technical staff principal engineer Edit: Let me elaborate on "member of technical staff" since it's kind of uncommon. I think it's a high title, commonly associated with research. I know that Oracle, VMWare, and the old Bell Labs have these titles. See: Member of Technical Staff . I know what it means, but I don't know how it stacks up against the other titles, which is why I asked.

  Read the article

• Are there cross-platform tools to write XSS attacks directly to the database?

  - by Joachim Sauer

  I've recently found this blog entry on a tool that writes XSS attacks directly to the database. It looks like a terribly good way to scan an application for weaknesses in my applications. I've tried to run it on Mono, since my development platform is Linux. Unfortunately it crashes with a System.ArgumentNullException deep inside Microsoft.Practices.EnterpriseLibrary and I seem to be unable to find sufficient information about the software (it seems to be a single-shot project, with no homepage and no further development). Is anyone aware of a similar tool? Preferably it should be: cross-platform (Java, Python, .NET/Mono, even cross-platform C is ok) open source (I really like being able to audit my security tools) able to talk to a wide range of DB products (the big ones are most important: MySQL, Oracle, SQL Server, ...)

  Read the article

• Prevent Method call without Exception using @PreAuthorize Annotation

  - by Chepech

  Hi all. We are using Spring Security 3. We have a custom implementation of PermissionEvaluator that has this complex algorithm to grant or deny access at method level on the application. To do that we add a @PreAuthorize annotation to the method we want to protect (obviously). Everything is fine on that. However the behavior that we are looking for is that if a hasPermission call is denied, the protected method call only needs to be skipped, instead we are getting a 403 error each time that happens. Any ideas how to prevent that? You can find a different explanation of the problem here; AccessDeniedException handling during methodSecurityInterception

  Read the article

• Detecting if a browser is using Private Browsing mode

  - by Steve

  I'm building an extranet for a company paranoid about security. They want to make sure that (among other things) their users are browsing the site with the Private Browsing mode switched on in their web browser so that no cookies or history is kept. I found only this http://jeremiahgrossman.blogspot.com/2009/03/detecting-private-browsing-mode.html and http://serverfault.com/questions/18966/force-safari-to-operate-in-private-mode-and-detect-that-state-from-a-webserver The ideal solution would use no or minimal javascript. Would attempting to set a unique cookie work for all browsers and platforms? Anyone done this before? thanks!

  Read the article

• Use Tomcat with Java SecurityManager?

  - by pauline

  I'm writing a web application that is supposed to run on Tomcat on Ubuntu. On Ubuntu, Tomcat is per default configured to run with the Java SecurityManager. Besides my own web application, there will only be some well known third party web applications related to my own, like the BIRT report engine. If one of the web applications fails or gets compromised, it may take down all the others without harm, because they all belong together. What I don't wont to happen is that a compromised web app compromises the system itself, like calling rm -r / Do I need to use the java security manager to achieve this? Or is it only necessary to protect one web app from the other? I'd really like to prevent the effort to create .policy files for all the 3rd party web applications I intend to use.

  Read the article

• What are my options for selling software independently on Windows?

  - by technomalogical

  I am looking to port a tool from the Mac app store over to Windows, the platform where I spend most of my time these days. I've spoken with the author of the original app and we've begun talking about licensing options should I decide to sell the application, and it seems like it would be feasible. I've never sold software independently, let alone on Windows. That I know of, there is not (yet) an equivalent app store for Windows (maybe one coming with Windows 8). Assuming my product was done today and I was ready to go to market, what options do I have for selling software for Windows as an independent developer or Micro-ISV? I know can sell it through my own website and accept PayPal, but are there options that will offer more visibility, similar to that of the Apple app stores? Any options to avoid?

  Read the article

• What is the sense of permiting the user to use no passwords longer than xx chars?

  - by reox

  Its more like a usability question or maybe database, or even maybe security (consider injection attacks) but what is the sense of permiting the user's password to a be not longer than xx chars? It does not make any sense to me, because longer passwords are mostly considered better and even harder to crack, and some users use password safes, so the password length should not matter. I understand that passwords with more than 20 chars are hardly to remember, but if you use diceware or password safe you dont have any problem with that. I really cant understand why there are sites that say "your password need to be between 5 and 8 chars"... also should the password saved as hash, so the length of the field in the database is fixed, so where is the problem? i think that most of the sites where the password is has to be a fixed length are not even using any hashing method...

  Read the article

• When do you trust the data / variables

  - by Wizzard

  We all know that all user data, GET/POST/Cookie etc etc needs to be validated for security. But when do you stop, once it's converted into a local variable? eg if (isValidxxx($_GET['foo']) == false) { throw InvalidArgumentException('Please enter a valid foo!'); } $foo = $_GET['foo']; fooProcessor($foo); function fooProcessor($foo) { if (isValidxxx($foo) == false) { throw Invalid...... } //other stuff } To me thats over the top. But what if you load the value from the database... I hope I make sense :)

  Read the article

• How to make an Asp.net MVC 2 website have a Private Beta Mode.

  - by Mark Kitz

  I am creating an ASP.Net MVC website that I am launching soon in private beta. What I am using. ASP.NET MVC 2 ASP.NET Sql Membership Provider Authorization Attributes on ActionMethods. ex. [EditorsOnly] What I am trying to accomplish: During the private Beta period of my website, I want no anonymous users to access my site. Only Beta Testers of my site should be able to login and use my site as normal. After the private beta period people can access it using the security structure I already have set up. I am hoping I do not have to recompile but can have a setting in the webconfig to switch between Private Beta mode to Normal mode. Thanks for your suggestions.

  Read the article

• Is php fileinfo sufficient to prevent upload of malicious files?

  - by Scarface

  Hey guys, I have searched around a bit, and have not really found a professional type response to how to have secure fileupload capability so I wanted to get the opinion of some of the experts on this site. I am currently allowing upload of mp3s and images, and while I am pretty confident in preventing xss and injection attacks on my site, I am not really familiar with fileupload security. I basically just use php fileinfo and check an array of accepted filetypes against the filetype. For images, there is the getimagesize function and some additional checks. As far as storing them, I just have a folder within my directory, because I want the users to be able to use the files. If anyone could give me some tips I would really appreciate it.

  Read the article

• Websphere exception handling

  - by Benjamin

  Hi all, From a security standpoint, what is the best solution to handle application errors with Websphere? I've been thinking of creating a class that is called every time an application error is generated, log the error and display a generic error message to the users. In PHP this can be achieved using the set_exception_handler() function. Is there something similar for websphere that could be configured in the web.xml? I've found codes like this on the internet: <error-page> <error-code>500</error-code> <location>/servlet/ExceptionHandlerServlet</location> </error-page> But that would only work with "500" HTTP error codes. I really want something generic that catches everything. Something like a class that implements a certain interface which can have access to all information about the error. Thanks for your time.

  Read the article

• How to keep a big and complex software product maintainable over the years?

  - by chrmue

  I have been working as a software developer for many years now. It has been my experience that projects get more complex and unmaintainable as more developers get involved in the development of the product. It seems that software at a certain stage of development has the tendency to get "hackier" and "hackier" especially when none of the team members that defined the architecture work at the company any more. I find it frustrating that a developer who has to change something has a hard time getting the big picture of the architecture. Therefore, there is a tendency to fix problems or make changes in a way that works against the original architecture. The result is code that gets more and more complex and even harder to understand. Is there any helpful advice on how to keep source code really maintainable over the years?

  Read the article

• Secure database connection. DAL .net architecture best practice

  - by Andrew Florko

  We have several applications that are installed in several departments that interact with database via Intranet. Users tend to use weak passwords or store login/password written on a shits of paper where everybody can see them. I'm worried about login/password leakage & want to minimize consequences. Minimizing database-server attack surface by hiding database-server from Intranet access would be a great idea also. I'm thinking about intermediary data access service method-based security. It seems more flexible than table-based or connection-based database-server one. This approach also allows to hide database-server from public Intranet. What kind of .net technologies and best practices would you suggest? Thank in you in advance!

  Read the article

• Listing technologies on a resume for a software position when your background is game programming?

  - by Ford

  So I'm thinking about applying for a entry level position in the software industry but my limited experience working and all my notable experience in college is with game technologies. Sure, the languages transfer over well but most of the technologies I have experience with are all related to graphics programming, engines of various types, and such, and do not transfer over at all. I feel like it would be inappropriate to just take my game programming resume and basically replace the word game with software for the reasons mentioned but on the other hand if I take them out I will only have languages and some technologies that I have some small passing experience with- which will obviously not reflect well on me. Should I leave them out or put them in, and if so how can I spin them to be appropriate?

  Read the article

• What is the difference between these senior software engineer titles?

  - by stackoverflowuser2010

  I'm currently a senior research software engineer at a large company and am being offered a "senior staff engineer" position somewhere else. I am not sure if the new position's title conveys a sideways move or an advancement. So, all other things being roughly equal (salary, domain of expertise, etc.), what is the external difference between these software engineer titles (in general and regardless of any particular company, if possible): senior engineer senior research engineer senior staff engineer member of technical staff principal engineer Edit: Let me elaborate on "member of technical staff" since it's kind of uncommon. I think it's a high title, commonly associated with research. I know that Oracle, VMWare, and the old Bell Labs have these titles. See: Member of Technical Staff . I know what it means, but I don't know how it stacks up against the other titles, which is why I asked.

  Read the article

• How can a new programmer impress the software engineer (boss)? [closed]

  - by Pablo

  Note 1/8/2011: As of this Monday, I'm the new software engineer. Turns out I did not impress the S.E., but ended impressing the CEO. See Joel, not everyone has to leave their Honda idling in front of the airport. =) Ashton, this one is for you buddy. Hi, I'm working at my first programming job. My boss is a very smart software engineer, and I feel like I have very little to offer compared to him. Problem is, he is always busy, and needs someone to help him out. I feel like I'm not good enough, but I still want to succeed. I want to be a great programmer. What can I do to impress him? Thank you.

  Read the article

• session is lost after successful login?

  - by sword101

  greetings all um using spring security 3.0.2,all the application pages are secured to see them you must be authenticated um using https protocol i have a strange problem that after successful login and got to the requested page when try to open any link to other pages in the application the session is invalidated or lost or what happened i don't know and the user become anonymous,and redirected to the login page and i got this from debugging: No HttpSession currently exists No SecurityContext was available from the HttpSession: null. A new one will be created. after reviewing the coe many times,nothing in the code is invalidating the session,any ideas why something like this might happen?

  Read the article

• Detect IE setting: check for newer versions of stored pages "never"

  - by xx

  I understand there isn't a way to interrogate a users IE settings directly due to security reasons, but is there a way to derive this answer with some other mechanism? I would like to stop a user from using my site if the setting "Check for newer versions of stored pages" is set to "Never". Any suggestions? Is there a way I could test for this using javascript? An example of what I am trying to accomplish is this: While it is not possible to check IE settings to see if you are running a popup blocker, that is a way to "test" for a popup blocker via javascript. I am looking for something similiar but for the cache setting, not the popup blocker.

  Read the article

• Copyrighting software, templates, etc. under real name or screen name?

  - by Abluescarab

  My question is hopefully simple--should I copyright my work (art, software, web design, etc.) under my real name or my screen name? My real name and screen name are also easily connected with a bit of searching, so does it really matter in the end? I'm not a professional (at this point). I read this article: Is it a bad idea to sell Android apps in the Android Market under your real name? and they recommended releasing on the app market under a company name. I also read this article: On what name should I claim copyright in open source software?, but that didn't answer my question. I know it probably matters for big projects, but for little projects, does it matter? Thanks ahead of time!

  Read the article

• How to deal with "software end-of-life" situations?

  - by rwong

  When a vendor declares that they no longer intend to provide any support or services to a piece of software (and stated the intent to exit the business - offering no upgrade paths), and stated that customers must pay a nominal fee in order to have the existing data exported, what kind of recourse do programmers/customers have? Things I can think of: Need to purchase spare hardware and set up a spare environment on which the software can continue to operate. Various data export methods which do not require vendor involvement. (For example, screen scraping, printing to image followed by re-scanning, etc) Parallel systems where staff will duplicate the old data into a new system manually or semi-automatically Legal means, in case the vendor is in financial trouble Any other ideas? Assuming that there is no "circumvention" involved (no DRM, no DMCA), is data recovery or reverse engineering legal/acceptable?

  Read the article

• Sanitizing CSS in Rails

  - by Erik

  Hello! I want to allow the users of a web app that I'm building to write their own CSS in order to customize their profile page. However I am aware of this opening up for many security risks, i e background: url('javascript:alert("Got your cookies! " + document.cookies'). Hence I am looking for a solution to sanitize the CSS while still allowing as much CSS functionality as possible for my users. So my questions if anyone anyone knows of a gem or a plugin to handles this? I've googled my brains out already so any tips would be really appreciated!

  Read the article

< Previous Page | 292 293 294 295 296 297 298 299 300 301 302 303  | Next Page >