Search Results

Search found 88759 results on 3551 pages for 'new developper'.

Page 52/3551 | < Previous Page | 48 49 50 51 52 53 54 55 56 57 58 59  | Next Page >

  • New release for the Visual Studio 2010 and .NET Framework 4 Training Kit

    - by Enrique Lima
    Among the new content in the release, is a set of ALM docs and labs. The ALM content referenced above is: o Using Code Analysis with Visual Studio 2010 to Improve Code Quality o Introduction to Exploratory Testing with Microsoft Test Manager 2010 o Introduction to Platform Testing with Microsoft Test Manager 2010 o Introduction to Quality Tracking with Visual Studio 2010 o Introduction to Test Planning with Microsoft Test Manager 2010 All ALM labs point to the latest version of the VS 2010 RTM VM. You can download the Training Kit from :  http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=23507 Visit the online content: http://msdn.microsoft.com/en-us/VS2010TrainingCourse Download the most recent version of the Visual Studio: http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=240

    Read the article

  • New Release of Survey webapplication - C# open source

    Published today at http://survey.codeplex.com a new release of the free and open source survey & webform application: Survey v. 1.2.1 Survey is a free web based survey and form engine toolkit for Microsoft .Net. written in asp.net and C#. The open source Survey project is a restart of the former websurvey solution NSurvey.A demosite is available at http://survey.dotnetnukes.nlMore information available at the Survey Community site at http:/www.surveyproject.info ...Did you know that DotNetSlackers also publishes .net articles written by top known .net Authors? We already have over 80 articles in several categories including Silverlight. Take a look: here.

    Read the article

  • New Development Snapshot

    I finished all the .NET 4.0 security model changes. If you build from source, you can now (optionally) build on .NET 4.0 and get native .NET 4.0 assemblies that use the new .NET 4.0 security model (and also experimental class gc support). The .NET 2.0 binaries also work on .NET 4.0. This is probably the final development snapshot before the first 0.44 release candidate and it has been tested more than a typical development snapshot. Please start testing ...Did you know that DotNetSlackers also publishes .net articles written by top known .net Authors? We already have over 80 articles in several categories including Silverlight. Take a look: here.

    Read the article

  • New in Production: Fusion CRM Implementation Specialist Exams!

    - by Richard Lefebvre
    Oracle PartnerNetwork Specialized program is releasing new certifications on our latest products, and partners are invited to be the first candidates. Oracle Fusion Customer Relationship Management 11g Sales Essentials Exam (1Z0-456) – now in Production! ·               All Beta exam participants will receive their exam scores as of September 24, 2012. ·               The successful candidates will receive their certificates starting mid-October, 2012. Contact Us Please direct any inquiries you may have to Oracle Partner Enablement team at [email protected].

    Read the article

  • New White Paper: The Career Benefits Of Certification

    - by Harold Green
    Is Certification Worth It? The answer is a resounding YES for IT professionals who are looking to boost their career. While there are no guarantees, certification has been shown to enhance various aspects of an IT professional’s career, including: Employability Salary Job Effectiveness Job Satisfaction With the economy in a slump and unemployment at record levels, it’s tougher than ever to stand out in the competitive field of IT. Numerous research studies have shown that certification can provide IT professionals the knowledge & skills they need to succeed. This new white paper from Oracle and Pearson VUE summarizes the key advantages of certification and provides examples from IT professionals on the benefits of certification. Download your copy now.

    Read the article

  • Windows 8 on my new i7 Macbook Pro

    - by Bob Hardister
    Using bootcamp I installed Windows 8 on my new Macbook Pro 15" (not a retina screen version), which has OS X 10.8.2, 2.6 Ghz Core i7 with 8 GB RAM.  I followed the simple procedure outlined here. The only problem I had was the wireless device driver wasn't provided. I had to find and download it myself. Even so it only provided 5G not 2G protocol support. I downloaded a Broadcom driver.   I was able to enable the Hyper-V features on Windows 8 and look forward to using VMs. So far so good :)

    Read the article

  • Unable to boot from new SSD after installing from USB

    - by user73725
    I'm using a new SSD with nothing on it. It's installed via USB drive, and boots from USB as well. While in Ubuntu I can see the SSD and other devices. When I install from the desktop (have tried from the boot screen as well), system restarts. It takes me to the boot screen, select boot from first hard disk, nothing, goes right back to boot screen. When I take the USB out, it hangs on "Verifing DMI." If I boot onto the USB I can see the correct files located in the SSD. I have a basic knowledge of computers. Give me any thing you think would help. No other OS's are loaded. Gigabyte ga-k8n-sli 1GB RAM AMD Athlon 64 x2 dual core 3800+ OCZ SSD Agility 3 120GB

    Read the article

  • Choosing a new programming language to learn [on hold]

    - by Xelom
    I'm a Microsoft Stack(ASP.NET, C#) developer. Mainly, I develop server side software, windows services, restful apis etc. My client side interaction is really really low. So aside from C# I want to learn a new language. Time is precious and I want to give my focus to a language which have a future. My language list is: Scala (Powerful usage in Twitter) Go (Getting popular and channels are pretty awesome) Erlang (Stable server side programs. Used at Whatsapp) You can give advice for the above or you can give me a better option. My only exception is Objective-C. I don't want to get in that one. Thanks

    Read the article

  • ASP.NET Pivot Grid Control Supports New Layout - v2010 vol 1

    The ASPxPivotGrid will now support a slick new feature that will help save you screen space: Compact Layout for Hierarchical Row Values With DXperience v2010 vol 1, you can create compact layouts for hierarchical pivot table row values (this capability is also available in the WinForms and WPF versions of this control). The compact layout allows you get more space horizontally without sacrificing the distinction between the hierarchical row values: DXperience? What's That? DXperience is the...Did you know that DotNetSlackers also publishes .net articles written by top known .net Authors? We already have over 80 articles in several categories including Silverlight. Take a look: here.

    Read the article

  • Find the new coordinates using a starting point, a distance, and an angle

    - by dqhendricks
    Okay, say I have a point coordinate. var coordinate = { x: 10, y: 20 }; Now I also have a distance and an angle. var distance = 20; var angle = 72; The problem I am trying to solve is, if I want to travel 20 points in the direction of angle from the starting coordinate, how can I find what my new coordinates will be? I know the answer involves things like sin/cosin, because I used to know how to do this, but I have since forgotten the formula. Can anyone help?

    Read the article

  • Html 5 &ndash; new size units

    - by Norgean
    There are some new size units with CSS 3, which allows you to resize elements relative to the viewport size. They are vw, vh, vmin (that’s vm in IE), and perhaps vmax. (Viewport width, height, smaller of the two, larger of the two.) 8vw is 8% of the viewport width – or 205 pixels on my 2560 screen. I created a tiny demo clock which sizes the elements so that it uses the whole screen. Clock – in Norwegian, but it’s the source that is interesting… Bug: Resize does not work. Tested for IE 9 & 10 and Chrome. Firefox and Safari: does not work.

    Read the article

  • Install failing new hard drives

    - by John
    I'm trying to install Ubuntu server 12.04 on my new hard drives but it seems to fail. Once past the option menu where is asked the partition to install the OS on, goes into a hold and no progress is shown afterwards. The hard disk I'm trying to install it on is: Western Digital WD20EARX The installation process hangs around 'installing core packages/installing the base system' . The CD comes through the test with being valid/ok. any help would be appreciated. Thanks in advance.

    Read the article

  • New Development Snapshot

    It's been a while and enough changes have accumulated to warrant a new development snapshot. Changes: Volker implemented dumping a list of threads when Ctrl-Break is pressed (Windows only). Fixed class loader caching in CallerID (thanks to Mainsoft for reporting this). Added workaround to ikvmc for Assembly.Location differing in case when the assembly is loaded from DEVPATH. Added error handling to ikvmc -key: and -keyfile: options. ...Did you know that DotNetSlackers also publishes .net articles written by top known .net Authors? We already have over 80 articles in several categories including Silverlight. Take a look: here.

    Read the article

  • New and Improved Patch for FRM-40654 Errors in Purchase Orders and Requisitions

    - by user793044
    Development has modified the code in purchase orders and requisition forms to prevent error FRM-40654 when there are trailing spaces in the tables for most of the fields.  After applying the patch, the form will still display the error but a requery will allow you to save the transaction. For the scenarios not covered in the fix, the FND log will now display the specific field that causes the error.  This an example of the FND log for one document where the note_to_vendor has trailing spaces: Form note_to_vendor oldvalue Database  note_to_vendor newvalue Failed first if statement when comparing fields FRM-40654: Record has been updated. Requery block to see change. This new patch includes the fix in Patch 14204845:"In Oracle Purchasing, leading or trailing spaces in po lines data was resulting in errors".  For more information on FRM-40654 errors see the patching section of Note 1203796.1. Be proactive and apply Patch 14479586:R12.PO.B for 12.1.3 or Patch 14569747 for 11.5.10 now!

    Read the article

  • How to update the USB Ubuntu (ISO) with new software

    - by nakata
    I have Peppermint (based on Ubuntu) running of USB. Its bascially an ISO image that loads using Grub4Dos. Problem is that I each time I load Ubuntu - and want to use i.e. teamviewer or Firefox...I have to install it on the running live system. Since its running from a ISO image...a reboot means the software is gone. I can edit/open the ISO image using WinImage (on XP) - would you know how I can add extra software into this ISO image so next time Ubuntu loads...the new software is on there? Is there some special repositary director where I should copy the software files into and recreate the ISO image? The directory structure of this iso image is along the lines of: .disk [BOOT] Casper dists install isolinux pool preseed Appreciate your help with this. The software I am really interested in installing is the plugin for LogMeIn (for which I may need Firefox...thus I need Firefox installation) and Teamviewer. Thanks Nakata

    Read the article

  • New Java ME JSRs submitted

    - by heathervc
    Two new Java ME related JSRs were submitted to the JCP program office this week and are now available for review. JSR 360, Connected Limited Device Configuration (CLDC) 8, has been submitted by Oracle for JSR Review.  This review period is open until 15 October.  The ME EC will vote on the JSR Approval Ballot 16-29 October. JSR 361 Java ME Embedded Profile, has been submitted by Oracle for JSR Review. This review period is open until 15 October.  The ME EC will vote on the JSR Approval Ballot 16-29 October.

    Read the article

  • Microsoft Secret Event: New Tablet Unveiling?

    If you read the headline, you know what everyone thinks it will be: a new tablet computer, that Microsoft will manufacture from beginning to end. Apparently, the company believes it will be better able to compete against Apple if it controls both the hardware and the software. But why choose this location for the announcement? Wired thinks it makes sense if the tablet features Xbox live streaming. That would turn the humble device into something of a media machine. Speaking of the device itself, what kind of specs will this hypothetical tablet have? It's hard to say. Microsoft boasts software...

    Read the article

  • A relatively new blog seems to be getting very poor Google indexing

    - by Genadinik
    I have a new blog that is 2 months old. In the first few weeks, it was getting indexed nicely and my GoogleWebmaster reports were showing that it was getting crawled and began ranking for some terms. Then as I kept writing, the GoogleWebmaster report thinned out and showed less and less terms that this blog ranks for. Now there are only 4 terms with one of them being my name. Is there something I need to do to keep the old posts to remain indexed and crawled? Thanks, Alex

    Read the article

  • Preparing for Microsoft TechEd New Orleans 2010

    I’m grateful to have been selected as a speaker to this years Microsoft TechEd North America. I know there are 1000’s of qualified speakers and I’m honored to have had high enough scores in TechEd’s past to be invited back. That said – planning is well under way to make the best talk possible. My talk is titled “Visual Studio Tips and Tricks” and I’m co-presenting with the famous Dustin Campbell. My goal is to cover as much new material as possible....Did you know that DotNetSlackers also publishes .net articles written by top known .net Authors? We already have over 80 articles in several categories including Silverlight. Take a look: here.

    Read the article

  • What's New in JMS 2 - Part 1

    - by reza_rahman
    JMS 2 is one of the most significant parts of Java EE 7. One of the principal goals of the JMS 2 API is improving developer productivity by reducing the amount of code to work with JMS by adopting programming paradigms like higher level abstractions, dependency injection, annotations, runtime exceptions, the builder pattern and intelligent defaults. In a recent OTN article, JMS 2 specification lead Nigel Deakin covers the ease-of-use changes in detail. The article is the first of a two part series on JMS 2. For more visual folks, there is my JMS 2 slide deck: What’s New in Java Message Service 2 from Reza Rahman You can also check out the official specification yourself or try things out with the newly released Java EE 7 SDK.

    Read the article

  • New Validation Attributes in ASP.NET MVC 3 Future

    - by imran_ku07
         Introduction:             Validating user inputs is an very important step in collecting information from users because it helps you to prevent errors during processing data. Incomplete or improperly formatted user inputs will create lot of problems for your application. Fortunately, ASP.NET MVC 3 makes it very easy to validate most common input validations. ASP.NET MVC 3 includes Required, StringLength, Range, RegularExpression, Compare and Remote validation attributes for common input validation scenarios. These validation attributes validates most of your user inputs but still validation for Email, File Extension, Credit Card, URL, etc are missing. Fortunately, some of these validation attributes are available in ASP.NET MVC 3 Future. In this article, I will show you how to leverage Email, Url, CreditCard and FileExtensions validation attributes(which are available in ASP.NET MVC 3 Future) in ASP.NET MVC 3 application.       Description:             First of all you need to download ASP.NET MVC 3 RTM Source Code from here. Then extract all files in a folder. Then open MvcFutures project from mvc3-rtm-sources\mvc3\src\MvcFutures folder. Build the project. In case, if you get compile time error(s) then simply remove the reference of System.Web.WebPages and System.Web.Mvc assemblies and add the reference of System.Web.WebPages and System.Web.Mvc 3 assemblies again but from the .NET tab and then build the project again, it will create a Microsoft.Web.Mvc assembly inside mvc3-rtm-sources\mvc3\src\MvcFutures\obj\Debug folder. Now we can use Microsoft.Web.Mvc assembly inside our application.             Create a new ASP.NET MVC 3 application. For demonstration purpose, I will create a dummy model UserInformation. So create a new class file UserInformation.cs inside Model folder and add the following code,   public class UserInformation { [Required] public string Name { get; set; } [Required] [EmailAddress] public string Email { get; set; } [Required] [Url] public string Website { get; set; } [Required] [CreditCard] public string CreditCard { get; set; } [Required] [FileExtensions(Extensions = "jpg,jpeg")] public string Image { get; set; } }             Inside UserInformation class, I am using Email, Url, CreditCard and FileExtensions validation attributes which are defined in Microsoft.Web.Mvc assembly. By default FileExtensionsAttribute allows png, jpg, jpeg and gif extensions. You can override this by using Extensions property of FileExtensionsAttribute class.             Then just open(or create) HomeController.cs file and add the following code,   public class HomeController : Controller { public ActionResult Index() { return View(); } [HttpPost] public ActionResult Index(UserInformation u) { return View(); } }             Next just open(or create) Index view for Home controller and add the following code,  @model NewValidationAttributesinASPNETMVC3Future.Model.UserInformation @{ ViewBag.Title = "Index"; Layout = "~/Views/Shared/_Layout.cshtml"; } <h2>Index</h2> <script src="@Url.Content("~/Scripts/jquery.validate.min.js")" type="text/javascript"></script> <script src="@Url.Content("~/Scripts/jquery.validate.unobtrusive.min.js")" type="text/javascript"></script> @using (Html.BeginForm()) { @Html.ValidationSummary(true) <fieldset> <legend>UserInformation</legend> <div class="editor-label"> @Html.LabelFor(model => model.Name) </div> <div class="editor-field"> @Html.EditorFor(model => model.Name) @Html.ValidationMessageFor(model => model.Name) </div> <div class="editor-label"> @Html.LabelFor(model => model.Email) </div> <div class="editor-field"> @Html.EditorFor(model => model.Email) @Html.ValidationMessageFor(model => model.Email) </div> <div class="editor-label"> @Html.LabelFor(model => model.Website) </div> <div class="editor-field"> @Html.EditorFor(model => model.Website) @Html.ValidationMessageFor(model => model.Website) </div> <div class="editor-label"> @Html.LabelFor(model => model.CreditCard) </div> <div class="editor-field"> @Html.EditorFor(model => model.CreditCard) @Html.ValidationMessageFor(model => model.CreditCard) </div> <div class="editor-label"> @Html.LabelFor(model => model.Image) </div> <div class="editor-field"> @Html.EditorFor(model => model.Image) @Html.ValidationMessageFor(model => model.Image) </div> <p> <input type="submit" value="Save" /> </p> </fieldset> } <div> @Html.ActionLink("Back to List", "Index") </div>             Now just run your application. You will find that both client side and server side validation for the above validation attributes works smoothly.                      Summary:             Email, URL, Credit Card and File Extension input validations are very common. In this article, I showed you how you can validate these input validations into your application. I explained this with an example. I am also attaching a sample application which also includes Microsoft.Web.Mvc.dll. So you can add a reference of Microsoft.Web.Mvc assembly directly instead of doing any manual work. Hope you will enjoy this article too.   SyntaxHighlighter.all()

    Read the article

  • European Interoperability Framework - a new beginning?

    - by trond-arne.undheim
    The most controversial document in the history of the European Commission's IT policy is out. EIF is here, wrapped in the Communication "Towards interoperability for European public services", and including the new feature European Interoperability Strategy (EIS), arguably a higher strategic take on the same topic. Leaving EIS aside for a moment, the EIF controversy has been around IPR, defining open standards and about the proper terminology around standardization deliverables. Today, as the document finally emerges, what is the verdict? First of all, to be fair to those among you who do not spend your lives in the intricate labyrinths of Commission IT policy documents on interoperability, let's define what we are talking about. According to the Communication: "An interoperability framework is an agreed approach to interoperability for organisations that want to collaborate to provide joint delivery of public services. Within its scope of applicability, it specifies common elements such as vocabulary, concepts, principles, policies, guidelines, recommendations, standards, specifications and practices." The Good - EIF reconfirms that "The Digital Agenda can only take off if interoperability based on standards and open platforms is ensured" and also confirms that "The positive effect of open specifications is also demonstrated by the Internet ecosystem." - EIF takes a productive and pragmatic stance on openness: "In the context of the EIF, openness is the willingness of persons, organisations or other members of a community of interest to share knowledge and stimulate debate within that community, the ultimate goal being to advance knowledge and the use of this knowledge to solve problems" (p.11). "If the openness principle is applied in full: - All stakeholders have the same possibility of contributing to the development of the specification and public review is part of the decision-making process; - The specification is available for everybody to study; - Intellectual property rights related to the specification are licensed on FRAND terms or on a royalty-free basis in a way that allows implementation in both proprietary and open source software" (p. 26). - EIF is a formal Commission document. The former EIF 1.0 was a semi-formal deliverable from the PEGSCO, a working group of Member State representatives. - EIF tackles interoperability head-on and takes a clear stance: "Recommendation 22. When establishing European public services, public administrations should prefer open specifications, taking due account of the coverage of functional needs, maturity and market support." - The Commission will continue to support the National Interoperability Framework Observatory (NIFO), reconfirming the importance of coordinating such approaches across borders. - The Commission will align its internal interoperability strategy with the EIS through the eCommission initiative. - One cannot stress the importance of using open standards enough, whether in the context of open source or non-open source software. The EIF seems to have picked up on this fact: What does the EIF says about the relation between open specifications and open source software? The EIF introduces, as one of the characteristics of an open specification, the requirement that IPRs related to the specification have to be licensed on FRAND terms or on a royalty-free basis in a way that allows implementation in both proprietary and open source software. In this way, companies working under various business models can compete on an equal footing when providing solutions to public administrations while administrations that implement the standard in their own software (software that they own) can share such software with others under an open source licence if they so decide. - EIF is now among the center pieces of the Digital Agenda (even though this demands extensive inter-agency coordination in the Commission): "The EIS and the EIF will be maintained under the ISA Programme and kept in line with the results of other relevant Digital Agenda actions on interoperability and standards such as the ones on the reform of rules on implementation of ICT standards in Europe to allow use of certain ICT fora and consortia standards, on issuing guidelines on essential intellectual property rights and licensing conditions in standard-setting, including for ex-ante disclosure, and on providing guidance on the link between ICT standardisation and public procurement to help public authorities to use standards to promote efficiency and reduce lock-in.(Communication, p.7)" All in all, quite a few good things have happened to the document in the two years it has been on the shelf or was being re-written, depending on your perspective, in any case, awaiting the storms to calm. The Bad - While a certain pragmatism is required, and governments cannot migrate to full openness overnight, EIF gives a bit too much room for governments not to apply the openness principle in full. Plenty of reasons are given, which should maybe have been put as challenges to be overcome: "However, public administrations may decide to use less open specifications, if open specifications do not exist or do not meet functional interoperability needs. In all cases, specifications should be mature and sufficiently supported by the market, except if used in the context of creating innovative solutions". - EIF does not use the internationally established terminology: open standards. Rather, the EIF introduces the notion of "formalised specification". How do "formalised specifications" relate to "standards"? According to the FAQ provided: The word "standard" has a specific meaning in Europe as defined by Directive 98/34/EC. Only technical specifications approved by a recognised standardisation body can be called a standard. Many ICT systems rely on the use of specifications developed by other organisations such as a forum or consortium. The EIF introduces the notion of "formalised specification", which is either a standard pursuant to Directive 98/34/EC or a specification established by ICT fora and consortia. The term "open specification" used in the EIF, on the one hand, avoids terminological confusion with the Directive and, on the other, states the main features that comply with the basic principle of openness laid down in the EIF for European Public Services. Well, this may be somewhat true, but in reality, Europe is 30 year behind in terminology. Unless the European Standardization Reform gets completed in the next few months, most Member States will likely conclude that they will go on referencing and using standards beyond those created by the three European endorsed monopolists of standardization, CEN, CENELEC and ETSI. Who can afford to begin following the strict Brussels rules for what they can call open standards when, in reality, standards stemming from global standardization organizations, so-called fora/consortia, dominate in the IT industry. What exactly is EIF saying? Does it encourage Member States to go on using non-ESO standards as long as they call it something else? I guess I am all for it, although it is a bit cumbersome, no? Why was there so much interest around the EIF? The FAQ attempts to explain: Some Member States have begun to adopt policies to achieve interoperability for their public services. These actions have had a significant impact on the ecosystem built around the provision of such services, e.g. providers of ICT goods and services, standardisation bodies, industry fora and consortia, etc... The Commission identified a clear need for action at European level to ensure that actions by individual Member States would not create new electronic barriers that would hinder the development of interoperable European public services. As a result, all stakeholders involved in the delivery of electronic public services in Europe have expressed their opinions on how to increase interoperability for public services provided by the different public administrations in Europe. Well, it does not take two years to read 50 consultation documents, and the EU Standardization Reform is not yet completed, so, more pragmatically, you finally had to release the document. Ok, let's leave some of that aside because the document is out and some people are happy (and others definitely not). The Verdict Considering the controversy, the delays, the lobbying, and the interests at stake both in the EU, in Member States and among vendors large and small, this document is pretty impressive. As with a good wine that has not yet come to full maturity, let's say that it seems to be coming in in the 85-88/100 range, but only a more fine-grained analysis, enjoyment in good company, and ultimately, implementation, will tell. The European Commission has today adopted a significant interoperability initiative to encourage public administrations across the EU to maximise the social and economic potential of information and communication technologies. Today, we should rally around this achievement. Tomorrow, let's sit down and figure out what it means for the future.

    Read the article

  • A New Threat To Web Applications: Connection String Parameter Pollution (CSPP)

    - by eric.maurice
    Hi, this is Shaomin Wang. I am a security analyst in Oracle's Security Alerts Group. My primary responsibility is to evaluate the security vulnerabilities reported externally by security researchers on Oracle Fusion Middleware and to ensure timely resolution through the Critical Patch Update. Today, I am going to talk about a serious type of attack: Connection String Parameter Pollution (CSPP). Earlier this year, at the Black Hat DC 2010 Conference, two Spanish security researchers, Jose Palazon and Chema Alonso, unveiled a new class of security vulnerabilities, which target insecure dynamic connections between web applications and databases. The attack called Connection String Parameter Pollution (CSPP) exploits specifically the semicolon delimited database connection strings that are constructed dynamically based on the user inputs from web applications. CSPP, if carried out successfully, can be used to steal user identities and hijack web credentials. CSPP is a high risk attack because of the relative ease with which it can be carried out (low access complexity) and the potential results it can have (high impact). In today's blog, we are going to first look at what connection strings are and then review the different ways connection string injections can be leveraged by malicious hackers. We will then discuss how CSPP differs from traditional connection string injection, and the measures organizations can take to prevent this kind of attacks. In web applications, a connection string is a set of values that specifies information to connect to backend data repositories, in most cases, databases. The connection string is passed to a provider or driver to initiate a connection. Vendors or manufacturers write their own providers for different databases. Since there are many different providers and each provider has multiple ways to make a connection, there are many different ways to write a connection string. Here are some examples of connection strings from Oracle Data Provider for .Net/ODP.Net: Oracle Data Provider for .Net / ODP.Net; Manufacturer: Oracle; Type: .NET Framework Class Library: - Using TNS Data Source = orcl; User ID = myUsername; Password = myPassword; - Using integrated security Data Source = orcl; Integrated Security = SSPI; - Using the Easy Connect Naming Method Data Source = username/password@//myserver:1521/my.server.com - Specifying Pooling parameters Data Source=myOracleDB; User Id=myUsername; Password=myPassword; Min Pool Size=10; Connection Lifetime=120; Connection Timeout=60; Incr Pool Size=5; Decr Pool Size=2; There are many variations of the connection strings, but the majority of connection strings are key value pairs delimited by semicolons. Attacks on connection strings are not new (see for example, this SANS White Paper on Securing SQL Connection String). Connection strings are vulnerable to injection attacks when dynamic string concatenation is used to build connection strings based on user input. When the user input is not validated or filtered, and malicious text or characters are not properly escaped, an attacker can potentially access sensitive data or resources. For a number of years now, vendors, including Oracle, have created connection string builder class tools to help developers generate valid connection strings and potentially prevent this kind of vulnerability. Unfortunately, not all application developers use these utilities because they are not aware of the danger posed by this kind of attacks. So how are Connection String parameter Pollution (CSPP) attacks different from traditional Connection String Injection attacks? First, let's look at what parameter pollution attacks are. Parameter pollution is a technique, which typically involves appending repeating parameters to the request strings to attack the receiving end. Much of the public attention around parameter pollution was initiated as a result of a presentation on HTTP Parameter Pollution attacks by Stefano Di Paola and Luca Carettoni delivered at the 2009 Appsec OWASP Conference in Poland. In HTTP Parameter Pollution attacks, an attacker submits additional parameters in HTTP GET/POST to a web application, and if these parameters have the same name as an existing parameter, the web application may react in different ways depends on how the web application and web server deal with multiple parameters with the same name. When applied to connections strings, the rule for the majority of database providers is the "last one wins" algorithm. If a KEYWORD=VALUE pair occurs more than once in the connection string, the value associated with the LAST occurrence is used. This opens the door to some serious attacks. By way of example, in a web application, a user enters username and password; a subsequent connection string is generated to connect to the back end database. Data Source = myDataSource; Initial Catalog = db; Integrated Security = no; User ID = myUsername; Password = XXX; In the password field, if the attacker enters "xxx; Integrated Security = true", the connection string becomes, Data Source = myDataSource; Initial Catalog = db; Integrated Security = no; User ID = myUsername; Password = XXX; Intergrated Security = true; Under the "last one wins" principle, the web application will then try to connect to the database using the operating system account under which the application is running to bypass normal authentication. CSPP poses serious risks for unprepared organizations. It can be particularly dangerous if an Enterprise Systems Management web front-end is compromised, because attackers can then gain access to control panels to configure databases, systems accounts, etc. Fortunately, organizations can take steps to prevent this kind of attacks. CSPP falls into the Injection category of attacks like Cross Site Scripting or SQL Injection, which are made possible when inputs from users are not properly escaped or sanitized. Escaping is a technique used to ensure that characters (mostly from user inputs) are treated as data, not as characters, that is relevant to the interpreter's parser. Software developers need to become aware of the danger of these attacks and learn about the defenses mechanism they need to introduce in their code. As well, software vendors need to provide templates or classes to facilitate coding and eliminate developers' guesswork for protecting against such vulnerabilities. Oracle has introduced the OracleConnectionStringBuilder class in Oracle Data Provider for .NET. Using this class, developers can employ a configuration file to provide the connection string and/or dynamically set the values through key/value pairs. It makes creating connection strings less error-prone and easier to manager, and ultimately using the OracleConnectionStringBuilder class provides better security against injection into connection strings. For More Information: - The OracleConnectionStringBuilder is located at http://download.oracle.com/docs/cd/B28359_01/win.111/b28375/OracleConnectionStringBuilderClass.htm - Oracle has developed a publicly available course on preventing SQL Injections. The Server Technologies Curriculum course "Defending Against SQL Injection Attacks!" is located at http://st-curriculum.oracle.com/tutorial/SQLInjection/index.htm - The OWASP web site also provides a number of useful resources. It is located at http://www.owasp.org/index.php/Main_Page

    Read the article

  • New SSIS tool on Codeplex – SSIS Log Analyzer

    I stumbled across a new SSIS tool on Codeplex today, the SSIS Log Analyzer which was only released a few days ago. Whilst it is a beta release and currently only supports 2005 (2008 is promised) it looks quite interesting. It seems to be a fancy log viewer, but with some clever features and a nice looking front-end. I’ve only read the documentation so far, but it has graphs and a debug view that shows your package with the colour animations similar to when debugging in BIDS, and everyone knows, the way the pretty colours and numbers change is the best bit! I’ll quote some of the features for you here and then let you make your own mind up, is it useful in the real world? Option to analyze the logs manually by applying row and column filters over the log data or by using queries to specify more complex criterions. Automated Performance Analysis which provides a quick graphical look on which tasks spent most time during package execution. Rerun (debug) the entire sequence of events which happened during package execution showing the flow of control in graphical form, changes in runtime values for each task like execution duration etc. Support for Auto Analyzers to automatically find out issues and provide suggestions for problems which can be figured out with the help of SSIS logs and/or package. Option to analyze just log file or log and package together. Provides a lightweight environment to have a quick look at the package. Opening it in BIDS takes some time as being an authoring environment it does all sorts of validations resulting in some delay. See http://ssisloganalyzer.codeplex.com/  for more details.

    Read the article

  • New SSIS tool on Codeplex – SSIS Log Analyzer

    I stumbled across a new SSIS tool on Codeplex today, the SSIS Log Analyzer which was only released a few days ago. Whilst it is a beta release and currently only supports 2005 (2008 is promised) it looks quite interesting. It seems to be a fancy log viewer, but with some clever features and a nice looking front-end. I’ve only read the documentation so far, but it has graphs and a debug view that shows your package with the colour animations similar to when debugging in BIDS, and everyone knows, the way the pretty colours and numbers change is the best bit! I’ll quote some of the features for you here and then let you make your own mind up, is it useful in the real world? Option to analyze the logs manually by applying row and column filters over the log data or by using queries to specify more complex criterions. Automated Performance Analysis which provides a quick graphical look on which tasks spent most time during package execution. Rerun (debug) the entire sequence of events which happened during package execution showing the flow of control in graphical form, changes in runtime values for each task like execution duration etc. Support for Auto Analyzers to automatically find out issues and provide suggestions for problems which can be figured out with the help of SSIS logs and/or package. Option to analyze just log file or log and package together. Provides a lightweight environment to have a quick look at the package. Opening it in BIDS takes some time as being an authoring environment it does all sorts of validations resulting in some delay. See http://ssisloganalyzer.codeplex.com/  for more details.

    Read the article

< Previous Page | 48 49 50 51 52 53 54 55 56 57 58 59  | Next Page >