Search Results

Search found 32953 results on 1319 pages for 'access secret'.

Page 307/1319 | < Previous Page | 303 304 305 306 307 308 309 310 311 312 313 314  | Next Page >

  • parameter error in my Facebook app

    - by Robert
    I have written a small app and put it on facebook. I got an application ID and secret. Then I wrote the following script to access my app (just as told on the facebook page). <?php require './src/facebook.php'; $facebook = new Facebook(array( 'appId' => 'xxxx', 'secret' => 'xxxx', 'cookie' => true, // enable optional cookie support )); try { $me = $facebook->api('/me'); } catch (FacebookApiException $e) { error_log($e); } if ($facebook->getSession()) { echo '<a href="' . $facebook->getLogoutUrl() . '">Logout</a>'; } else { echo '<a href="' . $facebook->getLoginUrl() . '">Login</a>'; } ?> Then I started running this script. It prompted me with the login link, then took me to the facebook login page. However, after I enter my facebook login details, I get this error page: Error. API Error Code: 100 API Error Description: Invalid parameter Error Message: next is not owned by the application. Could anyone help me a little bit please, I am really confused here about what's going on.

    Read the article

  • Debugging PHP Mail() and/or PHPMailer

    - by Agos
    Hi, I'm quite stuck with a problem sending mail from a PHP script. Some data: Shared hosting, no SSH access, only hosting provider panel PHP version 5.2.5 Last year I built a site which had no problems sending mail with the same hosting Let's say the domain is “domain.com” and my private address is “[email protected]” for anonimity's sake in the following code. Here's the code: <?php error_reporting(E_ALL); ini_set("display_errors", 1); $to = "[email protected]"; $subject = "Hi"; $body = "Test 1\nTest 2\nTest 3"; $headers = 'From: [email protected]' . "\r\n" . 'errors-to: [email protected]' . "\r\n" . 'X-Mailer: PHP/' . phpversion(); if (mail($to, $subject, $body, $headers)) { echo("Message successfully sent"); } else { echo("Message sending failed"); } require('class.phpmailer.php'); $message = "Hello world"; $mail = new PHPMailer(); $mail->CharSet = "UTF-8"; $mail->AddAddress("[email protected]", "Agos"); $mail->SetFrom("[email protected]","My Site"); $mail->Subject = "Test Message"; $mail->Body = $message; $mail->Send(); ?> And here is what I get: Message sending failed 'ai' = 'application/postscript', 'eps' = 'application/postscript', 'ps' = 'application/postscript', 'smi' = 'application/smil', 'smil' = 'application/smil', 'mif' = 'application/vnd.mif', 'xls' = 'application/vnd.ms-excel', 'ppt' = 'application/vnd.ms-powerpoint', 'wbxml' = 'application/vnd.wap.wbxml', 'wmlc' = 'application/vnd.wap.wmlc', 'dcr' = 'application/x-director', 'dir' = 'application/x-director', 'dxr' = 'application/x-director', 'dvi' = 'application/x-dvi', 'gtar' = 'application/x-gtar', 'php' = 'application/x-httpd-php', 'php4' = 'application/x-httpd-php', 'php3' = 'application/x-httpd-php', 'phtml' = 'application/x-httpd-php', 'phps' = 'application/x-httpd-php-source', 'js' = 'application/x-javascript', 'swf' = 'application/x-shockwave-flash', 'sit' = 'application/x-stuffit', 'tar' = 'application/x-tar', 'tgz' = 'application/x-tar', 'xhtml' = 'application/xhtml+xml', 'xht' = 'application/xhtml+xml', 'zip' = 'application/zip', 'mid' = 'audio/midi', 'midi' = 'audio/midi', 'mpga' = 'audio/mpeg', 'mp2' = 'audio/mpeg', 'mp3' = 'audio/mpeg', 'aif' = 'audio/x-aiff', 'aiff' = 'audio/x-aiff', 'aifc' = 'audio/x-aiff', 'ram' = 'audio/x-pn-realaudio', 'rm' = 'audio/x-pn-realaudio', 'rpm' = 'audio/x-pn-realaudio-plugin', 'ra' = 'audio/x-realaudio', 'rv' = 'video/vnd.rn-realvideo', 'wav' = 'audio/x-wav', 'bmp' = 'image/bmp', 'gif' = 'image/gif', 'jpeg' = 'image/jpeg', 'jpg' = 'image/jpeg', 'jpe' = 'image/jpeg', 'png' = 'image/png', 'tiff' = 'image/tiff', 'tif' = 'image/tiff', 'css' = 'text/css', 'html' = 'text/html', 'htm' = 'text/html', 'shtml' = 'text/html', 'txt' = 'text/plain', 'text' = 'text/plain', 'log' = 'text/plain', 'rtx' = 'text/richtext', 'rtf' = 'text/rtf', 'xml' = 'text/xml', 'xsl' = 'text/xml', 'mpeg' = 'video/mpeg', 'mpg' = 'video/mpeg', 'mpe' = 'video/mpeg', 'qt' = 'video/quicktime', 'mov' = 'video/quicktime', 'avi' = 'video/x-msvideo', 'movie' = 'video/x-sgi-movie', 'doc' = 'application/msword', 'word' = 'application/msword', 'xl' = 'application/excel', 'eml' = 'message/rfc822' ); return (!isset($mimes[strtolower($ext)])) ? 'application/octet-stream' : $mimes[strtolower($ext)]; } /** * Set (or reset) Class Objects (variables) * * Usage Example: * $page-set('X-Priority', '3'); * * @access public * @param string $name Parameter Name * @param mixed $value Parameter Value * NOTE: will not work with arrays, there are no arrays to set/reset * @todo Should this not be using __set() magic function? */ public function set($name, $value = '') { try { if (isset($this-$name) ) { $this-$name = $value; } else { throw new phpmailerException($this-Lang('variable_set') . $name, self::STOP_CRITICAL); } } catch (Exception $e) { $this-SetError($e-getMessage()); if ($e-getCode() == self::STOP_CRITICAL) { return false; } } return true; } /** * Strips newlines to prevent header injection. * @access public * @param string $str String * @return string */ public function SecureHeader($str) { $str = str_replace("\r", '', $str); $str = str_replace("\n", '', $str); return trim($str); } /** * Set the private key file and password to sign the message. * * @access public * @param string $key_filename Parameter File Name * @param string $key_pass Password for private key */ public function Sign($cert_filename, $key_filename, $key_pass) { $this-sign_cert_file = $cert_filename; $this-sign_key_file = $key_filename; $this-sign_key_pass = $key_pass; } /** * Set the private key file and password to sign the message. * * @access public * @param string $key_filename Parameter File Name * @param string $key_pass Password for private key */ public function DKIM_QP($txt) { $tmp=""; $line=""; for ($i=0;$i<= $ord) && ($ord <= 0x3A)) || $ord == 0x3C || ((0x3E <= $ord) && ($ord <= 0x7E)) ) { $line.=$txt[$i]; } else { $line.="=".sprintf("%02X",$ord); } } return $line; } /** * Generate DKIM signature * * @access public * @param string $s Header */ public function DKIM_Sign($s) { $privKeyStr = file_get_contents($this-DKIM_private); if ($this-DKIM_passphrase!='') { $privKey = openssl_pkey_get_private($privKeyStr,$this-DKIM_passphrase); } else { $privKey = $privKeyStr; } if (openssl_sign($s, $signature, $privKey)) { return base64_encode($signature); } } /** * Generate DKIM Canonicalization Header * * @access public * @param string $s Header */ public function DKIM_HeaderC($s) { $s=preg_replace("/\r\n\s+/"," ",$s); $lines=explode("\r\n",$s); foreach ($lines as $key=$line) { list($heading,$value)=explode(":",$line,2); $heading=strtolower($heading); $value=preg_replace("/\s+/"," ",$value) ; // Compress useless spaces $lines[$key]=$heading.":".trim($value) ; // Don't forget to remove WSP around the value } $s=implode("\r\n",$lines); return $s; } /** * Generate DKIM Canonicalization Body * * @access public * @param string $body Message Body */ public function DKIM_BodyC($body) { if ($body == '') return "\r\n"; // stabilize line endings $body=str_replace("\r\n","\n",$body); $body=str_replace("\n","\r\n",$body); // END stabilize line endings while (substr($body,strlen($body)-4,4) == "\r\n\r\n") { $body=substr($body,0,strlen($body)-2); } return $body; } /** * Create the DKIM header, body, as new header * * @access public * @param string $headers_line Header lines * @param string $subject Subject * @param string $body Body */ public function DKIM_Add($headers_line,$subject,$body) { $DKIMsignatureType = 'rsa-sha1'; // Signature & hash algorithms $DKIMcanonicalization = 'relaxed/simple'; // Canonicalization of header/body $DKIMquery = 'dns/txt'; // Query method $DKIMtime = time() ; // Signature Timestamp = seconds since 00:00:00 - Jan 1, 1970 (UTC time zone) $subject_header = "Subject: $subject"; $headers = explode("\r\n",$headers_line); foreach($headers as $header) { if (strpos($header,'From:') === 0) { $from_header=$header; } elseif (strpos($header,'To:') === 0) { $to_header=$header; } } $from = str_replace('|','=7C',$this-DKIM_QP($from_header)); $to = str_replace('|','=7C',$this-DKIM_QP($to_header)); $subject = str_replace('|','=7C',$this-DKIM_QP($subject_header)) ; // Copied header fields (dkim-quoted-printable $body = $this-DKIM_BodyC($body); $DKIMlen = strlen($body) ; // Length of body $DKIMb64 = base64_encode(pack("H*", sha1($body))) ; // Base64 of packed binary SHA-1 hash of body $ident = ($this-DKIM_identity == '')? '' : " i=" . $this-DKIM_identity . ";"; $dkimhdrs = "DKIM-Signature: v=1; a=" . $DKIMsignatureType . "; q=" . $DKIMquery . "; l=" . $DKIMlen . "; s=" . $this-DKIM_selector . ";\r\n". "\tt=" . $DKIMtime . "; c=" . $DKIMcanonicalization . ";\r\n". "\th=From:To:Subject;\r\n". "\td=" . $this-DKIM_domain . ";" . $ident . "\r\n". "\tz=$from\r\n". "\t|$to\r\n". "\t|$subject;\r\n". "\tbh=" . $DKIMb64 . ";\r\n". "\tb="; $toSign = $this-DKIM_HeaderC($from_header . "\r\n" . $to_header . "\r\n" . $subject_header . "\r\n" . $dkimhdrs); $signed = $this-DKIM_Sign($toSign); return "X-PHPMAILER-DKIM: phpmailer.worxware.com\r\n".$dkimhdrs.$signed."\r\n"; } protected function doCallback($isSent,$to,$cc,$bcc,$subject,$body) { if (!empty($this-action_function) && function_exists($this-action_function)) { $params = array($isSent,$to,$cc,$bcc,$subject,$body); call_user_func_array($this-action_function,$params); } } } class phpmailerException extends Exception { public function errorMessage() { $errorMsg = '' . $this-getMessage() . " \n"; return $errorMsg; } } ? Fatal error: Class 'PHPMailer' not found in /mailtest.php on line 20 Which is baffling to say the least. Is there anything I can do to get at least some more meaningful errors? Why is code from the class showing up in my file?

    Read the article

  • PHP (CodeIgniter) Pass Object Through Session

    - by FranticPedantic
    I am using PHP5 and CodeIgniter and I am trying to implement a single-sign on feature with facebook (although I don't think that facebook is relevant to the question). I am somewhat of a novice with PHP and definitely one with CodeIgniter, so if you think my approach is just completely off telling me that would be helpful too. So here is in short what I am doing: //Controller 1 $this->load->plugin("facebook"); $facebook = new Facebook(array ( 'appId' => $fbconfig['appid'], 'secret' => $fbconfig['secret'], 'cookie' => true, ) ); $fbsession = $facebook->getSession(); //works fine $this->session->set_userdata('facebook', serialize($facebook); Now I would like to grab that facebook object in a different controller. //Controller 2 $facebook = unserialize($this->session->userdata('facebook')); $fbsession = $facebook->getSession(); Produces the error: Call to undefined method getSession. So I look up more about serialization and think that maybe it just doesn't know what the facebook object's attributes are. So I add in a $this->load->plugin('facebook'); To controller 2 as well and I get a "Cannot redeclare class facebook." I am strongly suspecting that I am misunderstanding sessions here. Do I have to somehow tell PHP what kind of object it is? Thanks for the help.

    Read the article

  • ZipArchive on the iPhone unzips files but they are empty

    - by user345131
    I'm trying to use ZipArchive on the iPhone to unzip a simple text file. It returns with no error but the file is empty. I would love to know why this doesn't work. I am using the following methods: -(void)alert:(NSString*)message { UIAlertView *myAlert = [[UIAlertView alloc] initWithTitle:@"" message:message delegate:self cancelButtonTitle:@"Ok" otherButtonTitles:nil, nil]; [myAlert show]; [myAlert release]; } -(void)unzip { NSString *sourcepath = [[NSBundle mainBundle] pathForResource:@"secret" ofType:@"zip"]; NSString*filename = @"secret.txt"; NSArray *docPaths =NSSearchPathForDirectoriesInDomains(NSDocumentDirectory,NSUserDomainMask, YES); NSString *destinationpath = [docPaths objectAtIndex: 0]; if (filename != nil ) destinationpath = [destinationpath stringByAppendingPathComponent: filename]; ZipArchive* za = [[ZipArchive alloc] init]; if( [za UnzipOpenFile:sourcepath Password:@""] ) { BOOL ret = [za UnzipFileTo:destinationpath overWrite:YES]; if( NO==ret ) [self alert:@"Problem"]; else [self alert:@"Success"]; [za UnzipCloseFile]; } [za release]; NSString *test = [[NSString alloc] initWithContentsOfFile:destinationpath encoding:NSASCIIStringEncoding error:nil]; [self alert:test]; }

    Read the article

  • Password hashing, salt and storage of hashed values

    - by Jonathan Leffler
    Suppose you were at liberty to decide how hashed passwords were to be stored in a DBMS. Are there obvious weaknesses in a scheme like this one? To create the hash value stored in the DBMS, take: A value that is unique to the DBMS server instance as part of the salt, And the username as a second part of the salt, And create the concatenation of the salt with the actual password, And hash the whole string using the SHA-256 algorithm, And store the result in the DBMS. This would mean that anyone wanting to come up with a collision should have to do the work separately for each user name and each DBMS server instance separately. I'd plan to keep the actual hash mechanism somewhat flexible to allow for the use of the new NIST standard hash algorithm (SHA-3) that is still being worked on. The 'value that is unique to the DBMS server instance' need not be secret - though it wouldn't be divulged casually. The intention is to ensure that if someone uses the same password in different DBMS server instances, the recorded hashes would be different. Likewise, the user name would not be secret - just the password proper. Would there be any advantage to having the password first and the user name and 'unique value' second, or any other permutation of the three sources of data? Or what about interleaving the strings? Do I need to add (and record) a random salt value (per password) as well as the information above? (Advantage: the user can re-use a password and still, probably, get a different hash recorded in the database. Disadvantage: the salt has to be recorded. I suspect the advantage considerably outweighs the disadvantage.) There are quite a lot of related SO questions - this list is unlikely to be comprehensive: Encrypting/Hashing plain text passwords in database Secure hash and salt for PHP passwords The necessity of hiding the salt for a hash Clients-side MD5 hash with time salt Simple password encryption Salt generation and Open Source software I think that the answers to these questions support my algorithm (though if you simply use a random salt, then the 'unique value per server' and username components are less important).

    Read the article

  • Facebook graph API post to user's wall

    - by Lance
    I'm using the FB graph api to post content to the user's wall. I orginally tried using this method: $wall_post = array(array('message' => 'predicted the', 'name' => 'predicted the'), array('message' => $winning_team, 'name' => $winning_team, 'link' => 'http://www.sportannica.com/teams.php?team='.$winning_team.'&amp;year=2012'), array('message' => 'to beat the', 'name' => 'to beat the',), array('message' => $losing_team, 'name' => $losing_team, 'link' => 'http://www.sportannica.com/teams.php?team='.$losing_team.'&amp;year=2012'), array('message' => 'on '.$game_date.'', 'name' => 'on '.$game_date.''), array('picture' => 'http://www.sportannica.com/img/team_icons/current_season_logos/large/'.$winning_team.'.png')); $res = $facebook->api('/me/feed/', 'post', '$wall_post'); But, much to my surprise, you can't post multiple links to a users wall. So, now I'm using the graph api to post content to a user's wall much like the way spotify does. So, now I've figured out that I need to create custom actions and objects with the open graph dashboard. So, I've created the "predict" action and gave it permission to edit the object "game." So, now I have the code: $facebook = new Facebook(array( 'appId' => 'appID', 'secret' => 'SECRET', 'cookie' => true )); $access_token = $facebook->getAccessToken(); $user = $facebook->getUser(); if($user != 0) { curl -F 'access_token='$.access_token.'' \ -F 'away_team=New York Yankees' \ -F 'home_team=New York Mets' \ -F 'match=http://samples.ogp.me/413385652011237' \ 'https://graph.facebook.com/me/predict-edit-add:predict' } I keep getting an error reading: Parse error: syntax error, unexpected T_CONSTANT_ENCAPSED_STRING Any ideas?

    Read the article

  • oauth problem( app engine)

    - by portoalet
    hi i am trying to pull user's documents data from google docs using oauth, but i cannot understand how to do it - what's the purpose of oauth_verifier - how to get the access token secret? - if i try to use DocsService below, then i have a "server error" - is there a clear tutorial for this? i cannot find any atm.. String oauth_verifier = req.getParameter("oauth_verifier"); String oauth_token = req.getParameter("oauth_token"); String oauthtokensecret = req.getParameter("oauth_token_secret"); GoogleOAuthParameters oauthparam = new GoogleOAuthParameters(); oauthparam.setOAuthConsumerKey("consumer key"); oauthparam.setOAuthConsumerSecret("secret"); oauthparam.setOAuthToken(oauth_token); oauthparam.setOAuthTokenSecret(oauthtokensecret); oauthparam.setOAuthVerifier(oauth_verifier); OAuthHmacSha1Signer signer = new OAuthHmacSha1Signer(); GoogleOAuthHelper oauthhelper = new GoogleOAuthHelper(signer); String accesstoken = ""; String accesstokensecret = ""; try { oauthhelper.getUnauthorizedRequestToken(oauthparam); accesstoken = oauthhelper.getAccessToken(oauthparam); accesstokensecret = oauthparam.getOAuthTokenSecret(); // DocsService client = new DocsService("yourCompany-YourAppName-v1"); ...

    Read the article

  • How do you test a command object in a grails controller integration test?

    - by egervari
    I'm new to grails. How do I test a form command object to make sure that it's working? Here's some setup code in a test. When I try to do it, I get the following exceptions: Error occurred creating command object. org.codehaus.groovy.grails.web.servlet.mvc.exceptions.ControllerExecutionException: Error occurred creating command object. at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) .... Caused by: groovy.lang.MissingPropertyException: No such property: password for class: project.user.RegistrationForm Possible solutions: password Here is my test case. As you can see, I set "password" on the params map... void testSaveWhenDataIsCorrect() { controller.params.emailAddress = "[email protected]" controller.params.password = "secret" controller.params.confirmPassword = "secret" controller.save() assertEquals "success", redirectArgs.view ... } Here's the controller action, that adds the command object as a closure parameter: def save = { RegistrationForm form -> if(form.hasErrors()) { render view: "create", model: [form: form] } else { def user = new User(form.properties) user.password = form.encryptedPassword if(user.save()) { redirect(action: "success") } else { render view: "create", model: [form: form] } } } Here's the command object itself... and note that it DOES have a "password" field... class RegistrationForm { def springSecurityService String emailAddress String password String confirmPassword String getEncryptedPassword() { springSecurityService.encodePassword(password) } static constraints = { emailAddress(blank: false, email: true) password(blank: false, size:4..10) confirmPassword(blank: false, validator: { password != confirmPassword }) } } I'm totally lost in the non-intuitive way to do controllers... Please help.

    Read the article

  • All symbols after & stripped

    - by user300413
    My query: mysql::getInstance()->update('requests', array('response' => mysql_real_escape_string($_POST['status'])), array('secret' => $_POST['secret'])); ?> If i wand to add string with "&" symbol, all symbols after "&" stripped. Example: string: !"?;%:?*()_+!@#$%^&*()_+ in database i see only: !"?;%:?*()_+!@#$%^ How to fix this? update function, if anyone need: function update($table, $updateList, $whereConditions) { $updateQuery = ''; foreach ($updateList as $key => $newValue) { if (!is_numeric($newValue)) { $newValue = "'" . $newValue . "'"; } if (strlen($updateQuery) == 0) { $updateQuery .= '`' . $key . '` = ' . $newValue; } else { $updateQuery .= ', `' . $key . '` = ' . $newValue; } } return $this->query('UPDATE ' . $table . ' SET ' . $updateQuery . $this->buildWhereClause($whereConditions)); }

    Read the article

  • How do I get require_login()-like functionality using the new PHP Client Library for Facebook?

    - by cc
    Howdy. I've been tasked with making a Facebook game, but I'm new to Facebook development, so I'm just getting started. Apologies in advance if this is a no-brainer to people. I'm having trouble following all the examples I see on sites, and I keep running into missing pages in the Facebook documentation when I am trying to read up. I think it's because there's a new version of the PHP Client Library for Facebook, and everything I'm finding is referring to the old client. For instance, I see this code in a lot of examples: require 'facebook.php'; $facebook = new Facebook( array( 'appId' => '(id)', 'secret' => '(secret)' ) ); $facebook_account = $facebook->require_login(); ...but there's no "require_login()" in the client library provided in the facebook.php file. From what I can tell, it looks like Facebook has very recently rolled out some new system for development, but I don't see any sample code anywhere to deal with it. The new library comes with an "example.php" file, but it appears to be only for adding "Log in with Facebook" functionality to other sites (what I'm assuming is what they mean by "Facebook Connect" sites), not for just running apps in a Canvas page on Facebook itself. Specifically, what I need to do is let users visit an application page within Facebook, have it bring up the dialog box allowing them to authorize the app, have it show up in their "games" page, and then have it pass me the relevant info about the user so I can start creating the game. But I can't seem to find any tutorials or examples that show how to do this using the new library. Seems like this should be pretty straightforward, but I'm running into roadblocks. Or am I missing something about the PHP client library? Should require_login() be working for me, and there's something broken with my implementation, such as having the wrong client library or something? I downloaded from GitHub yesterday, so I'm pretty sure I have the most recent version of the code I have, but perhaps I'm downloading the wrong "facebook.php" file...?

    Read the article

  • HMAC URLs instead of login?

    - by Tres
    In implementing my site (a Rails site if it makes any difference), one of my design priorities is to relieve the user of the need to create yet another username and password while still providing useful per-user functionality. The way I am planning to do this is: User enters information on the site. Information is associated with the user via server-side session. User completes entering information, server sends an access URL via e-mail to the user roughly in the form of: http://siteurl/<user identifier>/<signature: HMAC(secret + salt + user identifier)> User clicks URL, site looks up user ID and salt and computes the HMAC with the server-stored secret and authenticates if the computed HMAC and signature match. My question is: is this a reasonably secure way to accomplish what I'm looking to do? Are there common attacks that would render it useless? Is there a compelling reason to abandon my desire to avoid a username/password? Is there a must-read book or article on the subject? Note that I'm not dealing with credit card numbers or anything exceedingly private, but I would still like to keep the information reasonably secure.

    Read the article

  • When is it safe to use a broken hash function?

    - by The Rook
    It is trivial to use a secure hash function like SHA256 and continuing to use md5 is reckless behavior. However, there are some complexities to hash function vulnerabilities that I would like to better understand. Collisions have been generated for md4 and md5. According to NIST md5() is not a secure hash function. It only takes 2^39th operations to generate a collision and should never be used for passwords. However SHA1 is vulnerable to a similar collision attack in which a collision can be found in 2^69 operations, where as brute force is 2^80th. No one has generated a sha1 collision and NIST still lists sha1 as a secure message digest function. So when is it safe to use a broken hash function? Even though a function is broken it can still be "big enough". According to Schneier a hash function vulnerable to a collsion attack can still be used as an HMAC. I believe this is because the security of an HMAC is Dependant on its secret key and a collision cannot be found until this key is obtained. Once you have the key used in a HMAC its already broken, so its a moot point. What hash function vulnerabilities would undermine the security of an HMAC? Lets take this property a bit further. Does it then become safe to use a very weak message digest like md4 for passwords if a salt is perpended to the password? Keep in mind the md4 and md5 attacks are prefixing attacks, and if a salt is perpended then an attacker cannot control the prefix of the message. If the salt is truly a secret, and isn't known to the attacker, then does it matter if its a appended to the end of the password? Is it safe to assume that an attacker cannot generate a collision until the entire message has been obtained? Do you know of other cases where a broken hash function can be used in a security context without introducing a vulnerability? (Please post supporting evidence because it is awesome!)

    Read the article

  • Why does PDO print my password when the connection fails?

    - by Joe Hopfgartner
    I have a simple website where I establish a connection to a Mysql server using PDO. $dbh = new PDO('mysql:host=localhost;dbname=DB;port=3306', 'USER', 'SECRET',array(PDO::MYSQL_ATTR_INIT_COMMAND => "SET NAMES utf8")); I had some traffic on my site and the servers connection limit was reached, and the website throw this error, with my PLAIN password in it! Fatal error: Uncaught exception 'PDOException' with message 'SQLSTATE[08004] [1040] Too many connections' in /home/premiumize-me/html/index.php:64 Stack trace: #0 /home/premiumize-me/html/index.php(64): PDO-__construct('mysql:host=loca...', 'USER', 'SECRET', Array) #1 {main} thrown in /home/premiumize-me/html/index.php on line 64 Ironically I switched to PDO for security reasons, this really shocked me. Because this exact error is something you can provoke very easily on most sites using simple http flooding. I now wrapped my conenction into a try/catch clause, but still. I think this is catastrophic! So I am new to PDO and my questino is: What do I have to consider to be safe! How to I establish a connection in a secure way? Are there other known security holes like this one that I have to be aware of?

    Read the article

  • Asynchronously get user data in facebook tab?

    - by Kristoffer Nolgren
    Using the php sdk, I check if a user inside a tab likes the corresponding page. If i put the following code inside index.php and use that page as my page-tab-url, <?php require_once("facebook/facebook.php"); // Create our application instance // (replace this with your appId and secret). $facebook = new Facebook(array( 'appId' => '1399475990283166', 'secret' => 'mysercret', 'cookie' => true )); $signed_request = $facebook->getSignedRequest(); echo $signed_request['page']['liked']; ?> it outputs '1'. I would like to achieve this asynchronously instead, so I put the php in a separate file and try to access it using ajax instead $http.post('/facebook/likes.php'). success(function(data){ console.log(data); }).error(function(data){ console.log(data); } ); This sample is using angular, but what javascript library i'm using probably doesn't matter. When I access the info with javascript Facebook doesn't seem to get the info that I liked the page. Adding a print_r($facebook); on the page I'm retreiving the same values as if i'm not in a facebook-tab: ( [sharedSessionID:protected] => [appId:protected] => 1399475990283166 [appSecret:protected] => 679fb0ab947c2b98e818f9240bc793da [user:protected] => [signedRequest:protected] => [state:protected] => [accessToken:protected] => [fileUploadSupport:protected] => [trustForwarded:protected] => ) Can I access theese values asynchronosly somehow?

    Read the article

  • IntellIJ editor doesn't appear

    - by neveu
    I updated my IntellIJ install to the latest version (11.1.4) and now the Editor window doesn't appear. Double-clicking on the file, jump-to-source, nothing happens. No error message, it just doesn't appear. If I double-click on an xml layout file the preview window works, but no Editor window. Have installed and reinstalled; went back to an earlier version and it doesn't work there either. I'm at a loss. Any ideas? Update: Editor works if I create a new project. Update 2: idea.log file includes this (I don't know what ins.android.sdk.AndroidSdkData is): 2012-11-04 20:40:52,481 [ 2677] INFO - s.impl.stores.FileBasedStorage - Document was not loaded for $APP_CONFIG$/macros.xml file is null 2012-11-04 20:40:52,481 [ 2677] INFO - .impl.stores.XmlElementStorage - Document was not loaded for $APP_CONFIG$/macros.xml 2012-11-04 20:40:52,482 [ 2678] INFO - s.impl.stores.FileBasedStorage - Document was not loaded for $APP_CONFIG$/quicklists.xml file is null 2012-11-04 20:40:52,482 [ 2678] INFO - .impl.stores.XmlElementStorage - Document was not loaded for $APP_CONFIG$/quicklists.xml 2012-11-04 20:40:52,564 [ 2760] INFO - pl.stores.ApplicationStoreImpl - 76 application components initialized in 1285 ms 2012-11-04 20:40:52,575 [ 2771] INFO - s.impl.stores.FileBasedStorage - Document was not loaded for $APP_CONFIG$/customization.xml file is null 2012-11-04 20:40:52,575 [ 2771] INFO - .impl.stores.XmlElementStorage - Document was not loaded for $APP_CONFIG$/customization.xml 2012-11-04 20:40:52,674 [ 2870] INFO - ij.openapi.wm.impl.IdeRootPane - App initialization took 3385 ms 2012-11-04 20:40:53,136 [ 3332] INFO - TestNG Runner - Create TestNG Template Configuration 2012-11-04 20:40:53,138 [ 3334] INFO - TestNG Runner - Create TestNG Template Configuration 2012-11-04 20:40:53,253 [ 3449] INFO - s.impl.stores.FileBasedStorage - Document was not loaded for $PROJECT_CONFIG_DIR$/dynamic.xml file is null 2012-11-04 20:40:53,253 [ 3449] INFO - .impl.stores.XmlElementStorage - Document was not loaded for $PROJECT_CONFIG_DIR$/dynamic.xml 2012-11-04 20:40:53,280 [ 3476] INFO - api.vfs.impl.local.FileWatcher - 1 paths checked, 0 mapped, 202 mks 2012-11-04 20:40:53,366 [ 3562] INFO - ellij.project.impl.ProjectImpl - 137 project components initialized in 403 ms 2012-11-04 20:40:53,563 [ 3759] INFO - .module.impl.ModuleManagerImpl - 4 modules loaded in 197 ms 2012-11-04 20:40:53,625 [ 3821] INFO - api.vfs.impl.local.FileWatcher - 6 paths checked, 0 mapped, 150 mks 2012-11-04 20:40:54,187 [ 4383] INFO - .roots.impl.DirectoryIndexImpl - Directory index initialized in 271 ms, indexed 1611 directories 2012-11-04 20:40:54,207 [ 4403] INFO - pl.PushedFilePropertiesUpdater - File properties pushed in 18 ms 2012-11-04 20:40:54,237 [ 4433] INFO - s.impl.stores.FileBasedStorage - Document was not loaded for $APP_CONFIG$/plainTextFiles.xml file is null 2012-11-04 20:40:54,237 [ 4433] INFO - .impl.stores.XmlElementStorage - Document was not loaded for $APP_CONFIG$/plainTextFiles.xml 2012-11-04 20:40:54,246 [ 4442] INFO - s.impl.stores.FileBasedStorage - Document was not loaded for $PROJECT_CONFIG_DIR$/gant_config.xml file is null 2012-11-04 20:40:54,246 [ 4442] INFO - .impl.stores.XmlElementStorage - Document was not loaded for $PROJECT_CONFIG_DIR$/gant_config.xml 2012-11-04 20:40:54,253 [ 4449] INFO - s.impl.stores.FileBasedStorage - Document was not loaded for $PROJECT_CONFIG_DIR$/gradle.xml file is null 2012-11-04 20:40:54,253 [ 4449] INFO - .impl.stores.XmlElementStorage - Document was not loaded for $PROJECT_CONFIG_DIR$/gradle.xml 2012-11-04 20:40:55,855 [ 6051] INFO - s.impl.stores.FileBasedStorage - Document was not loaded for $PROJECT_CONFIG_DIR$/IntelliLang.xml file is null 2012-11-04 20:40:55,855 [ 6051] INFO - .impl.stores.XmlElementStorage - Document was not loaded for $PROJECT_CONFIG_DIR$/IntelliLang.xml 2012-11-04 20:40:56,995 [ 7191] INFO - leEditor.impl.EditorsSplitters - splitter 2012-11-04 20:40:56,996 [ 7192] INFO - leEditor.impl.EditorsSplitters - splitter 2012-11-04 20:40:57,233 [ 7429] INFO - s.impl.stores.FileBasedStorage - Document was not loaded for $PROJECT_CONFIG_DIR$/codeStyleSettings.xml file is null 2012-11-04 20:40:57,233 [ 7429] INFO - .impl.stores.XmlElementStorage - Document was not loaded for $PROJECT_CONFIG_DIR$/codeStyleSettings.xml 2012-11-04 20:40:57,234 [ 7430] INFO - s.impl.stores.FileBasedStorage - Document was not loaded for $PROJECT_CONFIG_DIR$/projectCodeStyle.xml file is null 2012-11-04 20:40:57,234 [ 7430] INFO - .impl.stores.XmlElementStorage - Document was not loaded for $PROJECT_CONFIG_DIR$/projectCodeStyle.xml 2012-11-04 20:40:58,145 [ 8341] INFO - indexing.UnindexedFilesUpdater - Indexable files iterated in 3911 ms 2012-11-04 20:40:58,146 [ 8342] INFO - indexing.UnindexedFilesUpdater - Unindexed files update started: 0 files to update 2012-11-04 20:40:58,146 [ 8342] INFO - indexing.UnindexedFilesUpdater - Unindexed files update done in 0 ms 2012-11-04 20:40:58,362 [ 8558] INFO - s.impl.stores.FileBasedStorage - Document was not loaded for $PROJECT_CONFIG_DIR$/fileColors.xml file is null 2012-11-04 20:40:58,362 [ 8558] INFO - .impl.stores.XmlElementStorage - Document was not loaded for $PROJECT_CONFIG_DIR$/fileColors.xml 2012-11-04 20:41:00,420 [ 10616] INFO - ins.android.sdk.AndroidSdkData - For input string: "20.0.1" java.lang.NumberFormatException: For input string: "20.0.1" at java.lang.NumberFormatException.forInputString(NumberFormatException.java:48) at java.lang.Integer.parseInt(Integer.java:458) at java.lang.Integer.parseInt(Integer.java:499) at org.jetbrains.android.sdk.AndroidSdkData.parsePackageRevision(AndroidSdkData.java:86) at org.jetbrains.android.sdk.AndroidSdkData.<init>(AndroidSdkData.java:73) at org.jetbrains.android.sdk.AndroidSdkData.parse(AndroidSdkData.java:167) at org.jetbrains.android.sdk.AndroidPlatform.parse(AndroidPlatform.java:83) at org.jetbrains.android.sdk.AndroidSdkAdditionalData.getAndroidPlatform(AndroidSdkAdditionalData.java:119) at org.jetbrains.android.facet.AndroidFacet.addResourceFolderToSdkRootsIfNecessary(AndroidFacet.java:532) at org.jetbrains.android.facet.AndroidFacet.access$500(AndroidFacet.java:103) at org.jetbrains.android.facet.AndroidFacet$3.run(AndroidFacet.java:440) at com.intellij.ide.startup.impl.StartupManagerImpl$6.run(StartupManagerImpl.java:230) at com.intellij.ide.startup.impl.StartupManagerImpl.runActivities(StartupManagerImpl.java:203) at com.intellij.ide.startup.impl.StartupManagerImpl.access$100(StartupManagerImpl.java:41) at com.intellij.ide.startup.impl.StartupManagerImpl$4.run(StartupManagerImpl.java:170) at com.intellij.openapi.project.DumbServiceImpl.updateFinished(DumbServiceImpl.java:213) at com.intellij.openapi.project.DumbServiceImpl.access$1000(DumbServiceImpl.java:51) at com.intellij.openapi.project.DumbServiceImpl$IndexUpdateRunnable$1$3.run(DumbServiceImpl.java:363) at java.awt.event.InvocationEvent.dispatch(InvocationEvent.java:209) at java.awt.EventQueue.dispatchEventImpl(EventQueue.java:702) at java.awt.EventQueue.access$400(EventQueue.java:82) at java.awt.EventQueue$2.run(EventQueue.java:663) at java.awt.EventQueue$2.run(EventQueue.java:661) at java.security.AccessController.doPrivileged(Native Method) at java.security.AccessControlContext$1.doIntersectionPrivilege(AccessControlContext.java:87) at java.awt.EventQueue.dispatchEvent(EventQueue.java:672) at com.intellij.ide.IdeEventQueue.defaultDispatchEvent(IdeEventQueue.java:699) at com.intellij.ide.IdeEventQueue._dispatchEvent(IdeEventQueue.java:538) at com.intellij.ide.IdeEventQueue._dispatchEvent(IdeEventQueue.java:420) at com.intellij.ide.IdeEventQueue.dispatchEvent(IdeEventQueue.java:378) at java.awt.EventDispatchThread.pumpOneEventForFilters(EventDispatchThread.java:296) at java.awt.EventDispatchThread.pumpEventsForFilter(EventDispatchThread.java:211) at java.awt.EventDispatchThread.pumpEventsForHierarchy(EventDispatchThread.java:201) at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:196) at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:188) at java.awt.EventDispatchThread.run(EventDispatchThread.java:122) 2012-11-04 20:41:00,459 [ 10655] INFO - ins.android.sdk.AndroidSdkData - For input string: "20.0.1" java.lang.NumberFormatException: For input string: "20.0.1" at java.lang.NumberFormatException.forInputString(NumberFormatException.java:48) at java.lang.Integer.parseInt(Integer.java:458) at java.lang.Integer.parseInt(Integer.java:499) at org.jetbrains.android.sdk.AndroidSdkData.parsePackageRevision(AndroidSdkData.java:86) at org.jetbrains.android.sdk.AndroidSdkData.<init>(AndroidSdkData.java:73) at org.jetbrains.android.sdk.AndroidSdkData.parse(AndroidSdkData.java:167) at org.jetbrains.android.sdk.AndroidPlatform.parse(AndroidPlatform.java:83) at org.jetbrains.android.sdk.AndroidSdkAdditionalData.getAndroidPlatform(AndroidSdkAdditionalData.java:119) at org.jetbrains.android.facet.AndroidFacet.addResourceFolderToSdkRootsIfNecessary(AndroidFacet.java:532) at org.jetbrains.android.facet.AndroidFacet.access$500(AndroidFacet.java:103) at org.jetbrains.android.facet.AndroidFacet$3.run(AndroidFacet.java:440) at com.intellij.ide.startup.impl.StartupManagerImpl$6.run(StartupManagerImpl.java:230) at com.intellij.ide.startup.impl.StartupManagerImpl.runActivities(StartupManagerImpl.java:203) at com.intellij.ide.startup.impl.StartupManagerImpl.access$100(StartupManagerImpl.java:41) at com.intellij.ide.startup.impl.StartupManagerImpl$4.run(StartupManagerImpl.java:170) at com.intellij.openapi.project.DumbServiceImpl.updateFinished(DumbServiceImpl.java:213) at com.intellij.openapi.project.DumbServiceImpl.access$1000(DumbServiceImpl.java:51) at com.intellij.openapi.project.DumbServiceImpl$IndexUpdateRunnable$1$3.run(DumbServiceImpl.java:363) at java.awt.event.InvocationEvent.dispatch(InvocationEvent.java:209) at java.awt.EventQueue.dispatchEventImpl(EventQueue.java:702) at java.awt.EventQueue.access$400(EventQueue.java:82) at java.awt.EventQueue$2.run(EventQueue.java:663) at java.awt.EventQueue$2.run(EventQueue.java:661) at java.security.AccessController.doPrivileged(Native Method) at java.security.AccessControlContext$1.doIntersectionPrivilege(AccessControlContext.java:87) at java.awt.EventQueue.dispatchEvent(EventQueue.java:672) at com.intellij.ide.IdeEventQueue.defaultDispatchEvent(IdeEventQueue.java:699) at com.intellij.ide.IdeEventQueue._dispatchEvent(IdeEventQueue.java:538) at com.intellij.ide.IdeEventQueue._dispatchEvent(IdeEventQueue.java:420) at com.intellij.ide.IdeEventQueue.dispatchEvent(IdeEventQueue.java:378) at java.awt.EventDispatchThread.pumpOneEventForFilters(EventDispatchThread.java:296) at java.awt.EventDispatchThread.pumpEventsForFilter(EventDispatchThread.java:211) at java.awt.EventDispatchThread.pumpEventsForHierarchy(EventDispatchThread.java:201) at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:196) at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:188) at java.awt.EventDispatchThread.run(EventDispatchThread.java:122) 2012-11-04 20:41:01,305 [ 11501] INFO - tor.impl.FileEditorManagerImpl - Project opening took 8374 ms 2012-11-04 20:41:01,719 [ 11915] INFO - dom.attrs.AttributeDefinitions - Found tag with unknown parent: AndroidManifest.AndroidManifestCompatibleScreens 2012-11-04 20:41:07,522 [ 17718] INFO - roid.compiler.tools.AndroidApt - [/Users/neveu/Dev/android-sdk-macosx/platform-tools/aapt] [package] [-m] [--non-constant-id] [-J] [/private/var/folders/xb/hg6cdxt51rs8lylmmjw0fk8m0000gp/T/android_apt_autogeneration6157451500950136901tmp] [-M] [/Users/neveu/Dev/magic_android/3rdParty/facebook/AndroidManifest.xml] [-S] [/Users/neveu/Dev/magic_android/3rdParty/facebook/res] [-I] [/Users/neveu/Dev/android-sdk-macosx/platforms/android-14/android.jar] 2012-11-04 20:41:08,706 [ 18902] INFO - roid.compiler.tools.AndroidApt - [/Users/neveu/Dev/android-sdk-macosx/platform-tools/aapt] [package] [-m] [-J] [/private/var/folders/xb/hg6cdxt51rs8lylmmjw0fk8m0000gp/T/android_apt_autogeneration3143184519400737414tmp] [-M] [/Users/neveu/Dev/magic_android/AndroidManifest.xml] [-S] [/Users/neveu/Dev/magic_android/res] [-I] [/Users/neveu/Dev/android-sdk-macosx/platforms/android-15/android.jar] 2012-11-04 20:41:08,763 [ 18959] INFO - roid.compiler.tools.AndroidIdl - [/Users/neveu/Dev/android-sdk-macosx/platform-tools/aidl] [-p/Users/neveu/Dev/android-sdk-macosx/platforms/android-15/framework.aidl] [-I/Users/neveu/Dev/magic_android/magic/src] [-I/Users/neveu/Dev/magic_android/src] [-I/Users/neveu/Dev/magic_android/3rdParty/Tapjoy] [-I/Users/neveu/Dev/magic_android/gen] [/Users/neveu/Dev/magic_android/src/com/android/vending/billing/IMarketBillingService.aidl] [/Users/neveu/Dev/magic_android/gen/com/android/vending/billing/IMarketBillingService.java] 2012-11-04 20:41:14,004 [ 24200] INFO - dom.attrs.AttributeDefinitions - Found tag with unknown parent: AndroidManifest.AndroidManifestCompatibleScreens 2012-11-04 20:41:18,781 [ 28977] INFO - s.impl.stores.FileBasedStorage - Document was not loaded for $APP_CONFIG$/cachedDictionary.xml file is null 2012-11-04 20:41:18,782 [ 28978] INFO - .impl.stores.XmlElementStorage - Document was not loaded for $APP_CONFIG$/cachedDictionary.xml

    Read the article

  • Permissions denied on apache rewrite module virtual host configuration

    - by sina
    All of a sudden I keep getting "Permissions denied" on apache 2 virtualhost once we moved it to its own conf file. I have tried all the suggestions I have found here but none work. Please can someone tell me what I am doing wrong? Thanks! <VirtualHost *:80> DocumentRoot "/var/www/mm" <Directory "/var/www/mm"> Options +Indexes +MultiViews +FollowSymLinks AllowOverride all Order deny,allow Allow from all AddType text/vnd.sun.j2me.app-descriptor .jad AddType application/vnd.rim.cod .cod </Directory> Alias /holdspace "/var/www/mm/holdspace" RewriteLogLevel 9 RewriteLog "/var/log/httpd/rewrite.log" RewriteEngine on # 91xx RewriteCond %{HTTP_USER_AGENT} BlackBerry.9105 RewriteRule ^/download/(.*) /holdspace/bb6-360x480/$1 [L] # 92xx RewriteCond %{HTTP_USER_AGENT} BlackBerry.9220 RewriteRule ^/download/(.*) /holdspace/bb5-320x240/$1 [L] Errors in error.log: [Wed May 28 12:44:58 2014] [error] [client 197.255.173.95] (13)Permission denied: access to /download/eazymoney.jad denied [Wed May 28 12:44:58 2014] [error] [client 197.255.173.95] (13)Permission denied: access to /error/HTTP_FORBIDDEN.html.var denied [Wed May 28 12:44:59 2014] [error] [client 197.255.173.95] (13)Permission denied: access to /favicon.ico denied [Wed May 28 12:44:59 2014] [error] [client 197.255.173.95] (13)Permission denied: access to /error/HTTP_FORBIDDEN.html.var denied [Wed May 28 12:44:59 2014] [error] [client 197.255.173.95] (13)Permission denied: access to /favicon.ico denied [Wed May 28 12:44:59 2014] [error] [client 197.255.173.95] (13)Permission denied: access to /error/HTTP_FORBIDDEN.html.var denied Errors in rewrite.log: 197.255.173.95 - - [28/May/2014:12:46:01 +0100] [41.203.113.103/sid#7fe41704ca28][rid#7fe417123378/initial/redir#1] (3) applying pattern '^/download/(.*)' to uri '/error/HTTP_FORBIDDEN.html.var' 197.255.173.95 - - [28/May/2014:12:46:01 +0100] [41.203.113.103/sid#7fe41704ca28][rid#7fe417123378/initial/redir#1] (3) applying pattern '^/download/(.*)' to uri '/error/HTTP_FORBIDDEN.html.var' Apache Configuration file: ServerTokens Prod ServerRoot "/etc/httpd" PidFile run/httpd.pid Timeout 60 KeepAlive Off MaxKeepAliveRequests 100 KeepAliveTimeout 15 <IfModule prefork.c> StartServers 8 MinSpareServers 5 MaxSpareServers 20 ServerLimit 256 MaxClients 256 MaxRequestsPerChild 4000 </IfModule> <IfModule worker.c> StartServers 4 MaxClients 300 MinSpareThreads 25 MaxSpareThreads 75 ThreadsPerChild 25 MaxRequestsPerChild 0 </IfModule> Listen 80 LoadModule auth_basic_module modules/mod_auth_basic.so LoadModule auth_digest_module modules/mod_auth_digest.so LoadModule authn_file_module modules/mod_authn_file.so LoadModule authn_alias_module modules/mod_authn_alias.so LoadModule authn_anon_module modules/mod_authn_anon.so LoadModule authn_dbm_module modules/mod_authn_dbm.so LoadModule authn_default_module modules/mod_authn_default.so LoadModule authz_host_module modules/mod_authz_host.so LoadModule authz_user_module modules/mod_authz_user.so LoadModule authz_owner_module modules/mod_authz_owner.so LoadModule authz_groupfile_module modules/mod_authz_groupfile.so LoadModule authz_dbm_module modules/mod_authz_dbm.so LoadModule authz_default_module modules/mod_authz_default.so LoadModule ldap_module modules/mod_ldap.so LoadModule authnz_ldap_module modules/mod_authnz_ldap.so LoadModule include_module modules/mod_include.so LoadModule log_config_module modules/mod_log_config.so LoadModule logio_module modules/mod_logio.so LoadModule env_module modules/mod_env.so LoadModule ext_filter_module modules/mod_ext_filter.so LoadModule mime_magic_module modules/mod_mime_magic.so LoadModule expires_module modules/mod_expires.so LoadModule deflate_module modules/mod_deflate.so LoadModule headers_module modules/mod_headers.so LoadModule usertrack_module modules/mod_usertrack.so LoadModule setenvif_module modules/mod_setenvif.so LoadModule mime_module modules/mod_mime.so LoadModule dav_module modules/mod_dav.so LoadModule status_module modules/mod_status.so LoadModule autoindex_module modules/mod_autoindex.so LoadModule info_module modules/mod_info.so LoadModule dav_fs_module modules/mod_dav_fs.so LoadModule vhost_alias_module modules/mod_vhost_alias.so LoadModule negotiation_module modules/mod_negotiation.so LoadModule dir_module modules/mod_dir.so LoadModule actions_module modules/mod_actions.so LoadModule speling_module modules/mod_speling.so LoadModule userdir_module modules/mod_userdir.so LoadModule alias_module modules/mod_alias.so LoadModule substitute_module modules/mod_substitute.so LoadModule rewrite_module modules/mod_rewrite.so LoadModule proxy_module modules/mod_proxy.so LoadModule proxy_ftp_module modules/mod_proxy_ftp.so LoadModule proxy_http_module modules/mod_proxy_http.so LoadModule proxy_ajp_module modules/mod_proxy_ajp.so LoadModule proxy_connect_module modules/mod_proxy_connect.so LoadModule cache_module modules/mod_cache.so LoadModule suexec_module modules/mod_suexec.so LoadModule disk_cache_module modules/mod_disk_cache.so LoadModule cgi_module modules/mod_cgi.so LoadModule version_module modules/mod_version.so Include conf.d/*.conf User apache Group apache ServerAdmin root@localhost ServerName sv001zma002.africa.int.myorg.com UseCanonicalName Off DocumentRoot "/var/www/html" <Directory /> Options FollowSymLinks AllowOverride None </Directory> <Directory "/var/www/html"> Options FollowSymLinks AllowOverride None Order allow,deny Allow from all </Directory> <IfModule mod_userdir.c> UserDir disabled </IfModule> DirectoryIndex index.html index.html.var AccessFileName .htaccess <Files ~ "^\.ht"> Order allow,deny Deny from all Satisfy All </Files> TypesConfig /etc/mime.types DefaultType text/plain <IfModule mod_mime_magic.c> MIMEMagicFile conf/magic </IfModule> HostnameLookups Off ErrorLog logs/error_log LogLevel warn LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined LogFormat "%h %l %u %t \"%r\" %>s %b" common LogFormat "%{Referer}i -> %U" referer LogFormat "%{User-agent}i" agent CustomLog logs/access_log combined ServerSignature Off TraceEnable Off Alias /icons/ "/var/www/icons/" <Directory "/var/www/icons"> Options MultiViews FollowSymLinks AllowOverride None Order allow,deny Allow from all </Directory> <IfModule mod_dav_fs.c> DAVLockDB /var/lib/dav/lockdb </IfModule> ScriptAlias /cgi-bin/ "/var/www/cgi-bin/" <Directory "/var/www/cgi-bin"> AllowOverride None Options None Order allow,deny Allow from all </Directory> IndexOptions FancyIndexing VersionSort NameWidth=* HTMLTable Charset=UTF-8 AddIconByEncoding (CMP,/icons/compressed.gif) x-compress x-gzip AddIconByType (TXT,/icons/text.gif) text/* AddIconByType (IMG,/icons/image2.gif) image/* AddIconByType (SND,/icons/sound2.gif) audio/* AddIconByType (VID,/icons/movie.gif) video/* AddIcon /icons/binary.gif .bin .exe AddIcon /icons/binhex.gif .hqx AddIcon /icons/tar.gif .tar AddIcon /icons/world2.gif .wrl .wrl.gz .vrml .vrm .iv AddIcon /icons/compressed.gif .Z .z .tgz .gz .zip AddIcon /icons/a.gif .ps .ai .eps AddIcon /icons/layout.gif .html .shtml .htm .pdf AddIcon /icons/text.gif .txt AddIcon /icons/c.gif .c AddIcon /icons/p.gif .pl .py AddIcon /icons/f.gif .for AddIcon /icons/dvi.gif .dvi AddIcon /icons/uuencoded.gif .uu AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl AddIcon /icons/tex.gif .tex AddIcon /icons/bomb.gif core AddIcon /icons/back.gif .. AddIcon /icons/hand.right.gif README AddIcon /icons/folder.gif ^^DIRECTORY^^ AddIcon /icons/blank.gif ^^BLANKICON^^ DefaultIcon /icons/unknown.gif ReadmeName README.html HeaderName HEADER.html IndexIgnore .??* *~ *# HEADER* README* RCS CVS *,v *,t AddLanguage ca .ca AddLanguage cs .cz .cs AddLanguage da .dk AddLanguage de .de AddLanguage el .el AddLanguage en .en AddLanguage eo .eo AddLanguage es .es AddLanguage et .et AddLanguage fr .fr AddLanguage he .he AddLanguage hr .hr AddLanguage it .it AddLanguage ja .ja AddLanguage ko .ko AddLanguage ltz .ltz AddLanguage nl .nl AddLanguage nn .nn AddLanguage no .no AddLanguage pl .po AddLanguage pt .pt AddLanguage pt-BR .pt-br AddLanguage ru .ru AddLanguage sv .sv AddLanguage zh-CN .zh-cn AddLanguage zh-TW .zh-tw LanguagePriority en ca cs da de el eo es et fr he hr it ja ko ltz nl nn no pl pt pt-BR ru sv zh-CN zh-TW ForceLanguagePriority Prefer Fallback AddDefaultCharset UTF-8 AddType application/x-compress .Z AddType application/x-gzip .gz .tgz AddType application/x-x509-ca-cert .crt AddType application/x-pkcs7-crl .crl AddHandler type-map var AddType text/html .shtml AddOutputFilter INCLUDES .shtml ProxyErrorOverride On Alias /error/ "/var/www/error/" <IfModule mod_negotiation.c> <IfModule mod_include.c> <Directory "/var/www/error"> AllowOverride None Options IncludesNoExec AddOutputFilter Includes html AddHandler type-map var Order allow,deny Allow from all LanguagePriority en es de fr ForceLanguagePriority Prefer Fallback </Directory> ErrorDocument 400 /error/HTTP_BAD_REQUEST.html.var ErrorDocument 401 /error/HTTP_UNAUTHORIZED.html.var ErrorDocument 403 /error/HTTP_FORBIDDEN.html.var ErrorDocument 404 /error/HTTP_NOT_FOUND.html.var </IfModule> </IfModule> BrowserMatch "Mozilla/2" nokeepalive BrowserMatch "MSIE 4\.0b2;" nokeepalive downgrade-1.0 force-response-1.0 BrowserMatch "RealPlayer 4\.0" force-response-1.0 BrowserMatch "Java/1\.0" force-response-1.0 BrowserMatch "JDK/1\.0" force-response-1.0 BrowserMatch "Microsoft Data Access Internet Publishing Provider" redirect-carefully BrowserMatch "MS FrontPage" redirect-carefully BrowserMatch "^WebDrive" redirect-carefully BrowserMatch "^WebDAVFS/1.[0123]" redirect-carefully BrowserMatch "^gnome-vfs/1.0" redirect-carefully BrowserMatch "^XML Spy" redirect-carefully BrowserMatch "^Dreamweaver-WebDAV-SCM1" redirect-carefully ErrorDocument 400 "Bad Request"

    Read the article

  • OpenVPN not connecting

    - by LandArch
    There have been a number of post similar to this, but none seem to satisfy my need. Plus I am a Ubuntu newbie. I followed this tutorial to completely set up OpenVPN on Ubuntu 12.04 server. Here is my server.conf file ################################################# # Sample OpenVPN 2.0 config file for # # multi-client server. # # # # This file is for the server side # # of a many-clients <-> one-server # # OpenVPN configuration. # # # # OpenVPN also supports # # single-machine <-> single-machine # # configurations (See the Examples page # # on the web site for more info). # # # # This config should work on Windows # # or Linux/BSD systems. Remember on # # Windows to quote pathnames and use # # double backslashes, e.g.: # # "C:\\Program Files\\OpenVPN\\config\\foo.key" # # # # Comments are preceded with '#' or ';' # ################################################# # Which local IP address should OpenVPN # listen on? (optional) local 192.168.13.8 # Which TCP/UDP port should OpenVPN listen on? # If you want to run multiple OpenVPN instances # on the same machine, use a different port # number for each one. You will need to # open up this port on your firewall. port 1194 # TCP or UDP server? proto tcp ;proto udp # "dev tun" will create a routed IP tunnel, # "dev tap" will create an ethernet tunnel. # Use "dev tap0" if you are ethernet bridging # and have precreated a tap0 virtual interface # and bridged it with your ethernet interface. # If you want to control access policies # over the VPN, you must create firewall # rules for the the TUN/TAP interface. # On non-Windows systems, you can give # an explicit unit number, such as tun0. # On Windows, use "dev-node" for this. # On most systems, the VPN will not function # unless you partially or fully disable # the firewall for the TUN/TAP interface. dev tap0 up "/etc/openvpn/up.sh br0" down "/etc/openvpn/down.sh br0" ;dev tun # Windows needs the TAP-Win32 adapter name # from the Network Connections panel if you # have more than one. On XP SP2 or higher, # you may need to selectively disable the # Windows firewall for the TAP adapter. # Non-Windows systems usually don't need this. ;dev-node MyTap # SSL/TLS root certificate (ca), certificate # (cert), and private key (key). Each client # and the server must have their own cert and # key file. The server and all clients will # use the same ca file. # # See the "easy-rsa" directory for a series # of scripts for generating RSA certificates # and private keys. Remember to use # a unique Common Name for the server # and each of the client certificates. # # Any X509 key management system can be used. # OpenVPN can also use a PKCS #12 formatted key file # (see "pkcs12" directive in man page). ca "/etc/openvpn/ca.crt" cert "/etc/openvpn/server.crt" key "/etc/openvpn/server.key" # This file should be kept secret # Diffie hellman parameters. # Generate your own with: # openssl dhparam -out dh1024.pem 1024 # Substitute 2048 for 1024 if you are using # 2048 bit keys. dh dh1024.pem # Configure server mode and supply a VPN subnet # for OpenVPN to draw client addresses from. # The server will take 10.8.0.1 for itself, # the rest will be made available to clients. # Each client will be able to reach the server # on 10.8.0.1. Comment this line out if you are # ethernet bridging. See the man page for more info. ;server 10.8.0.0 255.255.255.0 # Maintain a record of client <-> virtual IP address # associations in this file. If OpenVPN goes down or # is restarted, reconnecting clients can be assigned # the same virtual IP address from the pool that was # previously assigned. ifconfig-pool-persist ipp.txt # Configure server mode for ethernet bridging. # You must first use your OS's bridging capability # to bridge the TAP interface with the ethernet # NIC interface. Then you must manually set the # IP/netmask on the bridge interface, here we # assume 10.8.0.4/255.255.255.0. Finally we # must set aside an IP range in this subnet # (start=10.8.0.50 end=10.8.0.100) to allocate # to connecting clients. Leave this line commented # out unless you are ethernet bridging. server-bridge 192.168.13.101 255.255.255.0 192.168.13.105 192.168.13.200 # Configure server mode for ethernet bridging # using a DHCP-proxy, where clients talk # to the OpenVPN server-side DHCP server # to receive their IP address allocation # and DNS server addresses. You must first use # your OS's bridging capability to bridge the TAP # interface with the ethernet NIC interface. # Note: this mode only works on clients (such as # Windows), where the client-side TAP adapter is # bound to a DHCP client. ;server-bridge # Push routes to the client to allow it # to reach other private subnets behind # the server. Remember that these # private subnets will also need # to know to route the OpenVPN client # address pool (10.8.0.0/255.255.255.0) # back to the OpenVPN server. push "route 192.168.13.1 255.255.255.0" push "dhcp-option DNS 192.168.13.201" push "dhcp-option DOMAIN blahblah.dyndns-wiki.com" ;push "route 192.168.20.0 255.255.255.0" # To assign specific IP addresses to specific # clients or if a connecting client has a private # subnet behind it that should also have VPN access, # use the subdirectory "ccd" for client-specific # configuration files (see man page for more info). # EXAMPLE: Suppose the client # having the certificate common name "Thelonious" # also has a small subnet behind his connecting # machine, such as 192.168.40.128/255.255.255.248. # First, uncomment out these lines: ;client-config-dir ccd ;route 192.168.40.128 255.255.255.248 # Then create a file ccd/Thelonious with this line: # iroute 192.168.40.128 255.255.255.248 # This will allow Thelonious' private subnet to # access the VPN. This example will only work # if you are routing, not bridging, i.e. you are # using "dev tun" and "server" directives. # EXAMPLE: Suppose you want to give # Thelonious a fixed VPN IP address of 10.9.0.1. # First uncomment out these lines: ;client-config-dir ccd ;route 10.9.0.0 255.255.255.252 # Then add this line to ccd/Thelonious: # ifconfig-push 10.9.0.1 10.9.0.2 # Suppose that you want to enable different # firewall access policies for different groups # of clients. There are two methods: # (1) Run multiple OpenVPN daemons, one for each # group, and firewall the TUN/TAP interface # for each group/daemon appropriately. # (2) (Advanced) Create a script to dynamically # modify the firewall in response to access # from different clients. See man # page for more info on learn-address script. ;learn-address ./script # If enabled, this directive will configure # all clients to redirect their default # network gateway through the VPN, causing # all IP traffic such as web browsing and # and DNS lookups to go through the VPN # (The OpenVPN server machine may need to NAT # or bridge the TUN/TAP interface to the internet # in order for this to work properly). ;push "redirect-gateway def1 bypass-dhcp" # Certain Windows-specific network settings # can be pushed to clients, such as DNS # or WINS server addresses. CAVEAT: # http://openvpn.net/faq.html#dhcpcaveats # The addresses below refer to the public # DNS servers provided by opendns.com. ;push "dhcp-option DNS 208.67.222.222" ;push "dhcp-option DNS 208.67.220.220" # Uncomment this directive to allow different # clients to be able to "see" each other. # By default, clients will only see the server. # To force clients to only see the server, you # will also need to appropriately firewall the # server's TUN/TAP interface. ;client-to-client # Uncomment this directive if multiple clients # might connect with the same certificate/key # files or common names. This is recommended # only for testing purposes. For production use, # each client should have its own certificate/key # pair. # # IF YOU HAVE NOT GENERATED INDIVIDUAL # CERTIFICATE/KEY PAIRS FOR EACH CLIENT, # EACH HAVING ITS OWN UNIQUE "COMMON NAME", # UNCOMMENT THIS LINE OUT. ;duplicate-cn # The keepalive directive causes ping-like # messages to be sent back and forth over # the link so that each side knows when # the other side has gone down. # Ping every 10 seconds, assume that remote # peer is down if no ping received during # a 120 second time period. keepalive 10 120 # For extra security beyond that provided # by SSL/TLS, create an "HMAC firewall" # to help block DoS attacks and UDP port flooding. # # Generate with: # openvpn --genkey --secret ta.key # # The server and each client must have # a copy of this key. # The second parameter should be '0' # on the server and '1' on the clients. ;tls-auth ta.key 0 # This file is secret # Select a cryptographic cipher. # This config item must be copied to # the client config file as well. ;cipher BF-CBC # Blowfish (default) ;cipher AES-128-CBC # AES ;cipher DES-EDE3-CBC # Triple-DES # Enable compression on the VPN link. # If you enable it here, you must also # enable it in the client config file. comp-lzo # The maximum number of concurrently connected # clients we want to allow. ;max-clients 100 # It's a good idea to reduce the OpenVPN # daemon's privileges after initialization. # # You can uncomment this out on # non-Windows systems. user nobody group nogroup # The persist options will try to avoid # accessing certain resources on restart # that may no longer be accessible because # of the privilege downgrade. persist-key persist-tun # Output a short status file showing # current connections, truncated # and rewritten every minute. status openvpn-status.log # By default, log messages will go to the syslog (or # on Windows, if running as a service, they will go to # the "\Program Files\OpenVPN\log" directory). # Use log or log-append to override this default. # "log" will truncate the log file on OpenVPN startup, # while "log-append" will append to it. Use one # or the other (but not both). ;log openvpn.log ;log-append openvpn.log # Set the appropriate level of log # file verbosity. # # 0 is silent, except for fatal errors # 4 is reasonable for general usage # 5 and 6 can help to debug connection problems # 9 is extremely verbose verb 3 # Silence repeating messages. At most 20 # sequential messages of the same message # category will be output to the log. ;mute 20 I am using Windows 7 as the Client and set that up accordingly using the OpenVPN GUI. That conf file is as follows: ############################################## # Sample client-side OpenVPN 2.0 config file # # for connecting to multi-client server. # # # # This configuration can be used by multiple # # clients, however each client should have # # its own cert and key files. # # # # On Windows, you might want to rename this # # file so it has a .ovpn extension # ############################################## # Specify that we are a client and that we # will be pulling certain config file directives # from the server. client # Use the same setting as you are using on # the server. # On most systems, the VPN will not function # unless you partially or fully disable # the firewall for the TUN/TAP interface. dev tap0 up "/etc/openvpn/up.sh br0" down "/etc/openvpn/down.sh br0" ;dev tun # Windows needs the TAP-Win32 adapter name # from the Network Connections panel # if you have more than one. On XP SP2, # you may need to disable the firewall # for the TAP adapter. ;dev-node MyTap # Are we connecting to a TCP or # UDP server? Use the same setting as # on the server. proto tcp ;proto udp # The hostname/IP and port of the server. # You can have multiple remote entries # to load balance between the servers. blahblah.dyndns-wiki.com 1194 ;remote my-server-2 1194 # Choose a random host from the remote # list for load-balancing. Otherwise # try hosts in the order specified. ;remote-random # Keep trying indefinitely to resolve the # host name of the OpenVPN server. Very useful # on machines which are not permanently connected # to the internet such as laptops. resolv-retry infinite # Most clients don't need to bind to # a specific local port number. nobind # Downgrade privileges after initialization (non-Windows only) user nobody group nobody # Try to preserve some state across restarts. persist-key persist-tun # If you are connecting through an # HTTP proxy to reach the actual OpenVPN # server, put the proxy server/IP and # port number here. See the man page # if your proxy server requires # authentication. ;http-proxy-retry # retry on connection failures ;http-proxy [proxy server] [proxy port #] # Wireless networks often produce a lot # of duplicate packets. Set this flag # to silence duplicate packet warnings. ;mute-replay-warnings # SSL/TLS parms. # See the server config file for more # description. It's best to use # a separate .crt/.key file pair # for each client. A single ca # file can be used for all clients. ca "C:\\Program Files\OpenVPN\config\\ca.crt" cert "C:\\Program Files\OpenVPN\config\\ChadMWade-THINK.crt" key "C:\\Program Files\OpenVPN\config\\ChadMWade-THINK.key" # Verify server certificate by checking # that the certicate has the nsCertType # field set to "server". This is an # important precaution to protect against # a potential attack discussed here: # http://openvpn.net/howto.html#mitm # # To use this feature, you will need to generate # your server certificates with the nsCertType # field set to "server". The build-key-server # script in the easy-rsa folder will do this. ns-cert-type server # If a tls-auth key is used on the server # then every client must also have the key. ;tls-auth ta.key 1 # Select a cryptographic cipher. # If the cipher option is used on the server # then you must also specify it here. ;cipher x # Enable compression on the VPN link. # Don't enable this unless it is also # enabled in the server config file. comp-lzo # Set log file verbosity. verb 3 # Silence repeating messages ;mute 20 Not sure whats left to do.

    Read the article

  • Pain Comes Instantly

    - by user701213
    When I look back at recent blog entries – many of which are not all that current (more on where my available writing time is going later) – I am struck by how many of them focus on public policy or legislative issues instead of, say, the latest nefarious cyberattack or exploit (or everyone’s favorite new pastime: coining terms for the Coming Cyberpocalypse: “digital Pearl Harbor” is so 1941). Speaking of which, I personally hope evil hackers from Malefactoria will someday hack into my bathroom scale – which in a future time will be connected to the Internet because, gosh, wouldn’t it be great to have absolutely everything in your life Internet-enabled? – and recalibrate it so I’m 10 pounds thinner. The horror. In part, my focus on public policy is due to an admitted limitation of my skill set. I enjoy reading technical articles about exploits and cybersecurity trends, but writing a blog entry on those topics would take more research than I have time for and, quite honestly, doesn’t play to my strengths. The first rule of writing is “write what you know.” The bigger contributing factor to my recent paucity of blog entries is that more and more of my waking hours are spent engaging in “thrust and parry” activity involving emerging regulations of some sort or other. I’ve opined in earlier blogs about what constitutes good and reasonable public policy so nobody can accuse me of being reflexively anti-regulation. That said, you have so many cycles in the day, and most of us would rather spend it slaying actual dragons than participating in focus groups on whether dragons are really a problem, whether lassoing them (with organic, sustainable and recyclable lassos) is preferable to slaying them – after all, dragons are people, too - and whether we need lasso compliance auditors to make sure lassos are being used correctly and humanely. (A point that seems to evade many rule makers: slaying dragons actually accomplishes something, whereas talking about “approved dragon slaying procedures and requirements” wastes the time of those who are competent to dispatch actual dragons and who were doing so very well without the input of “dragon-slaying theorists.”) Unfortunately for so many of us who would just get on with doing our day jobs, cybersecurity is rapidly devolving into the “focus groups on dragon dispatching” realm, which actual dragons slayers have little choice but to participate in. The general trend in cybersecurity is that powers-that-be – which encompasses groups other than just legislators – are often increasingly concerned and therefore feel they need to Do Something About Cybersecurity. Many seem to believe that if only we had the right amount of regulation and oversight, there would be no data breaches: a breach simply must mean Someone Is At Fault and Needs Supervision. (Leaving aside the fact that we have lots of home invasions despite a) guard dogs b) liberal carry permits c) alarm systems d) etc.) Also note that many well-managed and security-aware organizations, like the US Department of Defense, still get hacked. More specifically, many powers-that-be feel they must direct industry in a multiplicity of ways, up to and including how we actually build and deploy information technology systems. The more prescriptive the requirement, the more regulators or overseers a) can be seen to be doing something b) feel as if they are doing something regardless of whether they are actually doing something useful or cost effective. Note: an unfortunate concomitant of Doing Something is that often the cure is worse than the ailment. That is, doing what overseers want creates unfortunate byproducts that they either didn’t foresee or worse, don’t care about. After all, the logic goes, we Did Something. Prescriptive practice in the IT industry is problematic for a number of reasons. For a start, prescriptive guidance is really only appropriate if: • It is cost effective• It is “current” (meaning, the guidance doesn’t require the use of the technical equivalent of buggy whips long after horse-drawn transportation has become passé)*• It is practical (that is, pragmatic, proven and effective in the real world, not theoretical and unproven)• It solves the right problem With the above in mind, heading up the list of “you must be joking” regulations are recent disturbing developments in the Payment Card Industry (PCI) world. I’d like to give PCI kahunas the benefit of the doubt about their intentions, except that efforts by Oracle among others to make them aware of “unfortunate side effects of your requirements” – which is as tactful I can be for reasons that I believe will become obvious below - have gone, to-date, unanswered and more importantly, unchanged. A little background on PCI before I get too wound up. In 2008, the Payment Card Industry (PCI) Security Standards Council (SSC) introduced the Payment Application Data Security Standard (PA-DSS). That standard requires vendors of payment applications to ensure that their products implement specific requirements and undergo security assessment procedures. In order to have an application listed as a Validated Payment Application (VPA) and available for use by merchants, software vendors are required to execute the PCI Payment Application Vendor Release Agreement (VRA). (Are you still with me through all the acronyms?) Beginning in August 2010, the VRA imposed new obligations on vendors that are extraordinary and extraordinarily bad, short-sighted and unworkable. Specifically, PCI requires vendors to disclose (dare we say “tell all?”) to PCI any known security vulnerabilities and associated security breaches involving VPAs. ASAP. Think about the impact of that. PCI is asking a vendor to disclose to them: • Specific details of security vulnerabilities • Including exploit information or technical details of the vulnerability • Whether or not there is any mitigation available (as in a patch) PCI, in turn, has the right to blab about any and all of the above – specifically, to distribute all the gory details of what is disclosed - to the PCI SSC, qualified security assessors (QSAs), and any affiliate or agent or adviser of those entities, who are in turn permitted to share it with their respective affiliates, agents, employees, contractors, merchants, processors, service providers and other business partners. This assorted crew can’t be more than, oh, hundreds of thousands of entities. Does anybody believe that several hundred thousand people can keep a secret? Or that several hundred thousand people are all equally trustworthy? Or that not one of the people getting all that information would blab vulnerability details to a bad guy, even by accident? Or be a bad guy who uses the information to break into systems? (Wait, was that the Easter Bunny that just hopped by? Bringing world peace, no doubt.) Sarcasm aside, common sense tells us that telling lots of people a secret is guaranteed to “unsecret” the secret. Notably, being provided details of a vulnerability (without a patch) is of little or no use to companies running the affected application. Few users have the technological sophistication to create a workaround, and even if they do, most workarounds break some other functionality in the application or surrounding environment. Also, given the differences among corporate implementations of any application, it is highly unlikely that a single workaround is going to work for all corporate users. So until a patch is developed by the vendor, users remain at risk of exploit: even more so if the details of vulnerability have been widely shared. Sharing that information widely before a patch is available therefore does not help users, and instead helps only those wanting to exploit known security bugs. There’s a shocker for you. Furthermore, we already know that insider information about security vulnerabilities inevitably leaks, which is why most vendors closely hold such information and limit dissemination until a patch is available (and frequently limit dissemination of technical details even with the release of a patch). That’s the industry norm, not that PCI seems to realize or acknowledge that. Why would anybody release a bunch of highly technical exploit information to a cast of thousands, whose only “vetting” is that they are members of a PCI consortium? Oracle has had personal experience with this problem, which is one reason why information on security vulnerabilities at Oracle is “need to know” (we use our own row level access control to limit access to security bugs in our bug database, and thus less than 1% of development has access to this information), and we don’t provide some customers with more information than others or with vulnerability information and/or patches earlier than others. Failure to remember “insider information always leaks” creates problems in the general case, and has created problems for us specifically. A number of years ago, one of the UK intelligence agencies had information about a non-public security vulnerability in an Oracle product that they circulated among other UK and Commonwealth defense and intelligence entities. Nobody, it should be pointed out, bothered to report the problem to Oracle, even though only Oracle could produce a patch. The vulnerability was finally reported to Oracle by (drum roll) a US-based commercial company, to whom the information had leaked. (Note: every time I tell this story, the MI-whatever agency that created the problem gets a bit shirty with us. I know they meant well and have improved their vulnerability handling/sharing processes but, dudes, next time you find an Oracle vulnerability, try reporting it to us first before blabbing to lots of people who can’t actually fix the problem. Thank you!) Getting back to PCI: clearly, these new disclosure obligations increase the risk of exploitation of a vulnerability in a VPA and thus, of misappropriation of payment card data and customer information that a VPA processes, stores or transmits. It stands to reason that VRA’s current requirement for the widespread distribution of security vulnerability exploit details -- at any time, but particularly before a vendor can issue a patch or a workaround -- is very poor public policy. It effectively publicizes information of great value to potential attackers while not providing compensating benefits - actually, any benefits - to payment card merchants or consumers. In fact, it magnifies the risk to payment card merchants and consumers. The risk is most prominent in the time before a patch has been released, since customers often have little option but to continue using an application or system despite the risks. However, the risk is not limited to the time before a patch is issued: customers often need days, or weeks, to apply patches to systems, based upon the complexity of the issue and dependence on surrounding programs. Rather than decreasing the available window of exploit, this requirement increases the available window of exploit, both as to time available to exploit a vulnerability and the ease with which it can be exploited. Also, why would hackers focus on finding new vulnerabilities to exploit if they can get “EZHack” handed to them in such a manner: a) a vulnerability b) in a payment application c) with exploit code: the “Hacking Trifecta!“ It’s fair to say that this is probably the exact opposite of what PCI – or any of us – would want. Established industry practice concerning vulnerability handling avoids the risks created by the VRA’s vulnerability disclosure requirements. Specifically, the norm is not to release information about a security bug until the associated patch (or a pretty darn good workaround) has been issued. Once a patch is available, the notice to the user community is a high-level communication discussing the product at issue, the level of risk associated with the vulnerability, and how to apply the patch. The notices do not include either the specific customers affected by the vulnerability or forensic reports with maps of the exploit (both of which are required by the current VRA). In this way, customers have the tools they need to prioritize patching and to help prevent an attack, and the information released does not increase the risk of exploit. Furthermore, many vendors already use industry standards for vulnerability description: Common Vulnerability Enumeration (CVE) and Common Vulnerability Scoring System (CVSS). CVE helps ensure that customers know which particular issues a patch addresses and CVSS helps customers determine how severe a vulnerability is on a relative scale. Industry already provides the tools customers need to know what the patch contains and how bad the problem is that the patch remediates. So, what’s a poor vendor to do? Oracle is reaching out to other vendors subject to PCI and attempting to enlist then in a broad effort to engage PCI in rethinking (that is, eradicating) these requirements. I would therefore urge all who care about this issue, but especially those in the vendor community whose applications are subject to PCI and who may not have know they were being asked to tell-all to PCI and put their customers at risk, to do one of the following: • Contact PCI with your concerns• Contact Oracle (we are looking for vendors to sign our statement of concern)• And make sure you tell your customers that you have to rat them out to PCI if there is a breach involving the payment application I like to be charitable and say “PCI meant well” but in as important a public policy issue as what you disclose about vulnerabilities, to whom and when, meaning well isn’t enough. We need to do well. PCI, as regards this particular issue, has not done well, and has compounded the error by thus far being nonresponsive to those of us who have labored mightily to try to explain why they might want to rethink telling the entire planet about security problems with no solutions. By Way of Explanation… Non-related to PCI whatsoever, and the explanation for why I have not been blogging a lot recently, I have been working on Other Writing Venues with my sister Diane (who has also worked in the tech sector, inflicting upgrades on unsuspecting and largely ungrateful end users). I am pleased to note that we have recently (self-)published the first in the Miss Information Technology Murder Mystery series, Outsourcing Murder. The genre might best be described as “chick lit meets geek scene.” Our sisterly nom de plume is Maddi Davidson and (shameless plug follows): you can order the paper version of the book on Amazon, or the Kindle or Nook versions on www.amazon.com or www.bn.com, respectively. From our book jacket: Emma Jones, a 20-something IT consultant, is working on an outsourcing project at Tahiti Tacos, a restaurant chain offering Polynexican cuisine: refried poi, anyone? Emma despises her boss Padmanabh, a brilliant but arrogant partner in GD Consulting. When Emma discovers His-Royal-Padness’s body (verdict: death by cricket bat), she becomes a suspect.With her overprotective family and her best friend Stacey providing endless support and advice, Emma stumbles her way through an investigation of Padmanabh’s murder, bolstered by fusion food feeding frenzies, endless cups of frou-frou coffee and serious surfing sessions. While Stacey knows a PI who owes her a favor, landlady Magda urges Emma to tart up her underwear drawer before the next cute cop with a search warrant arrives. Emma’s mother offers to fix her up with a PhD student at Berkeley and showers her with self-defense gizmos while her old lover Keoni beckons from Hawai’i. And everyone, even Shaun the barista, knows a good lawyer. Book 2, Denial of Service, is coming out this summer. * Given the rate of change in technology, today’s “thou shalts” are easily next year’s “buggy whip guidance.”

    Read the article

  • Why does OS X insist on spinning up all external drives when loading a file from the local drive?

    - by Phillip Oldham
    Why does OS X insist on spinning up all the attached external drives (firewire, usb) when loading a file from the local (internal) drive? It's driving me insane that I have to wait for 3 attached drives (1 back-up, 2 media) to spin up -- a total of 20s -- to access a file that is located only on my local/internal drive. There is no obvious need to access the other drives; nothing is being read from them and nothing need be written. Examples: Quicktime X opening a file from the local HDD. Starting Caffeine, an app which doesn't access any other files at all. Can I tell OS X to only spin those drives up when actually accessing them?

    Read the article

  • Mac Mini Wake on Lan

    - by ILMV
    My Mac Mini has a setting in the Energy Saver category called Wake for Ethernet network access. Now the way I read this option is that any network access to the Mac whilst it is asleep will wake it up, but it doesn't. I have read that I have to send it the magic packet to wake it up, but what I really want to do is be able to simply attempt to access the Mini over the network and it wake up on demand without sending a magic packet. Can this be done? If it helps I am using a Netgear router.

    Read the article

  • ERROR [01000] [Microsoft][ODBC SQL Server Driver][DBNETLIB]ConnectionOpen (Connect())

    - by Steven Morrison
    Our company had resently upgraded to a domain functionality from workgroup and now we get this error message shown below on the clients laptops. The software on the server is working as it was opening the SECWARE application and a successful login to the database is possible.But from our workstations we cannot access the database to get the login screen. error in DB_OpenDS: ERROR [08001] [Microsoft][ODBC SQL Server Driver][DBNETLIB]SQL Server does not exist or access denied. ERROR [01000] [Microsoft][ODBC SQL Server Driver][DBNETLIB]ConnectionOpen (Connect()). OpenFolder Error :ERROR [08001] [Microsoft][ODBC SQL Server Driver][DBNETLIB]SQL Server does not exist or access denied. ERROR [01000] [Microsoft][ODBC SQL Server Driver][DBNETLIB]ConnectionOpen (Connect()). exiting with error Cannot find table 0. exiting with error We have a network share that we used to get the login file from and that is accessible.

    Read the article

  • How do I set up a public server on a network?

    - by tyjkenn
    I am trying to set up a personal cloud server with OwnCloud on Ubuntu. LAMP is all set up. I was able to access it using the external IP address when I connected it directly to the modem, but what if I what if I want my server to share a LAN? I still want it accessible over the internet, but then if I go to the IP address from a web browser, it just tries to log into to router admin tools. The internal IP address works across the LAN, but I want to be able to access it from anywhere. This may be simple and I may be over-thinking it, but how do access my server? The router I am using is ASUS WL-520GU.

    Read the article

  • VPN for a small organization

    - by user24091
    I am in charge of a small office network that has < 10 users. I want to be able to offer them access to the network from their home internet connections. At the moment we have a regular ADSL-router-firewall to provide local network access and a fixed IP address. I know there are enterprise-level VPN solutions, but these obviously won't be available to us because of the cost and complexity. What small-scale solutions are around that you could recommend, what would we need to deploy on the client side, and what would the clients need to do to access the VPN? Simplicity and low cost need to be the keys here. Thanks

    Read the article

  • ReadyNAS Duo - FTP home network connectivity issue

    - by dwabyick
    I have a ReadyNas Duo that I recently purchased and configured on my local home network. I'm an AT&T DSL subscriber using their default 2701HG-B Gateway (2Wire) wireless router. Basically, I have managed to configure my ReadyNAS, and can access HTTP shares and WINS shares just fine, but cannot get access to it via FTP. I've enabled it in the 'Standard File Protocols' section in the UI, and made a share have read/write default access via FTP. My settings: Port: 21 Authentication mode: User Allow upload resumes: Yes Passive ports: 1024-65535 Masquerade as: (empty, but I've tried the internal IP address). I've even poked around at my router, which has a firewall, and even tried to poke a hole for the 'FTP Server'app for the ReadyNAS. Doesn't seem like I should need to do this, or should. Any ideas what else to check? Thanks! -Daniel

    Read the article

  • Is there a way to add AD LDS users to an AD Domain Group or allow them domain security rights?

    - by Tom
    I have a web application in which our outside customers need access to run transactions (stored procs on Sql Server) on our domain. We have looked into LDS to keep these users separate from our domain. The problem we are having is allowing the LDS users the AD security rights to access these stored procs. For administration purposes we would like to use an AD group for each transaction (stored proc) which has access to execute. Is there a way to add LDS users to this AD group or allow them the security rights to do this? We have setup LDS and can authenicate an AD user thru to runs these transactions. LDS is running on Server 08 R2. AD is also Server 08 R2. Thanks.

    Read the article

< Previous Page | 303 304 305 306 307 308 309 310 311 312 313 314  | Next Page >