Search Results

Search found 2467 results on 99 pages for 'pinal dave'.

Page 91/99 | < Previous Page | 87 88 89 90 91 92 93 94 95 96 97 98  | Next Page >

  • Why isn't this javascript code working?

    - by DarkLightA
    http://jsfiddle.net/LU3pE/ I want the function to make the arguments into a single string and return it. What have I done incorrectly? function cooncc(divider, lastdiv){ var returner; for (var i = 0; i < (arguments.length - 2); i++) { returner += arguments[i+2] + divider; } returner -= divider; returner += lastdiv + arguments[arguments.length - 1]; return divider; } var output = cooncc(", ", ", and ", "Andy", "Becky", "Caitlin", "Dave", "Erica", "Fergus", "Gaby"); document.body.innerHTML = "<h1>" + output + ".</h1>";

    Read the article

  • How to Create a Generic Method and Create Instance of The Type

    - by DaveDev
    Hi Guys I want to create a helper method that I can imagine has a signature similar to this: public static MyHtmlTag GenerateTag<T>(this HtmlHelper htmlHelper, object obj) { // how do I create an instance of MyAnchor? // this returns MyAnchor, which has a MyHtmlTag base } When I invoke the method, I want to specify a type of MyHtmlTag, such as MyAnchor, e.g.: <%= Html.GenerateTag<MyAnchor>(obj) %> or <%= Html.GenerateTag<MySpan>(obj) %> Can someone show me how to create this method? Also, what's involved in creating an instance of the type I specified? Activator.CreateInstance()? Thanks Dave

    Read the article

  • Load remote csv into CHCSVParser

    - by Matt
    Hey guys. I'm using Dave DeLong's CHCSVParser to parse a csv. I can parse the csv locally, but I cannot get it load a remote csv file. I have been staring at my MacBook way too long today and the answer is right in front of me. Here's my code: NSString *urlStr = [[NSString alloc] initWithFormat:@"http://www.somewhere.com/LunchSpecials.csv"]; NSURL *lunchFileURL = [NSURL URLWithString:urlStr]; NSStringEncoding encoding = 0; CHCSVParser *p = [[CHCSVParser alloc] initWithContentsOfCSVFile:[lunchFileURL path] usedEncoding:&encoding error:nil]; [p setParserDelegate:self]; [p parse]; [p release]; Thanks for any help that someone can give me.

    Read the article

  • URL Encoding - Illegal Character Replacement

    - by ThePower
    Hi, I am doing some url redirections in a project that I am currently working on. I am new to web development and was wondering what the best practise was to remove any illegal path characters, such as ' ? etc. I'm hoping I don't have to resort to manually replacing each character with their encoded urls. I have tried UrlEncode and HTMLEncode, but UrlEncode doesn't cater for the ? and HTMLEncode doesn't cater for ' E.G. If I was to use the following: Dim name As String = "Dave's gone, why?" Dim url As String = String.Format("~/books/{0}/{1}/default.aspx", bookID, name) Response.Redirect(url) I've tried wrapping url like this: Dim encodedUrl As String = Server.UrlEncode(url) And Dim encodedUrl As String = Server.HTMLEncode(url) Thanks in advance. P.S. Happy Christmas

    Read the article

  • Ad/Banner Management/Rotation for Ruby on Rails?

    - by David N. Welton
    Hi, I have a niche site that I'd like to sell banners for directly, rather than going through adsense. I need a system to manage the whole process: displaying ads and an administrative interface to manage them. It doesn't have to be anything terribly fancy, although open source is greatly preferred so that I can grow the system as needs be. Since the site itself is in Rails, I would prefer something for that environment. Googling turns up bunches of them in PHP, but the results are a bit polluted and I didn't have any luck finding one that was done in/for Rails. If I don't find one, I suppose I'll see what I can do to hack together something and release it myself under an open license. Another possibility is this: http://www.google.com/admanager - anyone have anything to say about it? Is it right for someone just selling a few ads for a not-so-big site? Thanks, Dave

    Read the article

  • How To Get Type Info Without Using Generics?

    - by DaveDev
    Hi Guys I have an object obj that is passed into a helper method. public static MyTagGenerateTag<T>(this HtmlHelper htmlHelper, T obj /*, ... */) { Type t = typeof(T); foreach (PropertyInfo prop in t.GetProperties()) { object propValue = prop.GetValue(obj, null); string stringValue = propValue.ToString(); dictionary.Add(prop.Name, stringValue); } // implement GenerateTag } I've been told this is not a correct use of generics. Can somebody tell me if I can achieve the same result without specifying a generic type? If so, how? I would probably change the signature so it'd be like: public static MyTag GenerateTag(this HtmlHelper htmlHelper, object obj /*, ... */) { Type t = typeof(obj); // implement GenerateTag } but Type t = typeof(obj); is impossible. Any suggestions? Thanks Dave

    Read the article

  • Stripes link event triggering validation that is incorrect.

    - by Davoink
    I have stripes:link tag in a jsp with an event attribute: <stripes:link href="${actionBean.context.currentStage.stripesForwardAction}" addSourcePage="true" event="showTab2Link"> This triggers the validation to trigger on nested properties: @ValidateNestedProperties({ @Validate(field="county", required=true, minlength=2, maxlength=2, mask="\\d\\d"), @Validate(field="parish", required=true, minlength=3, maxlength=3, mask="\\d\\d\\d"), @Validate(field="holding", required=true, minlength=4, maxlength=4, mask="\\d\\d\\d\\d") }) However this would been fine if the actual values it is validation are not present, but they are present within the html and when debugging the bean. Why would the stripes:link trigger this? If I change it to an stripes:submit then it is fine. thanks, Dave

    Read the article

  • eclipse: how to debug a Java program as a .jar file?

    - by Jason S
    I use ant for creating .jar files in Eclipse. Works great. I have a .jar file I am working on that expects the code to be in a .jar file (it looks for .properties files in the same directory as the .jar file) -- the standard Eclipse "Run" and "Debug" menus execute the main() method of a specified Java class... but they do it from the directory containing the compiled class files, not a jar file. Is there a way to change this behavior so Eclipse runs code from the appropriate .jar file instead? (My workaround right now is to run the .jar file externally, with it suspended waiting for a debugger, per Dave Ray's answer to one of my other questions.)

    Read the article

  • Get all Select Elements in a Form by referencing $(this) instead of $("form select")

    - by DaveDev
    Hi Guys I'm currently getting all the Select elements that exist in a form with the following: $("form").submit(function(event) { // gather data var data = GetSelectData($("form select")); // do submit $.post($(this).attr("action"), data, ..etc) }); Instead of passing in $("form select"), is there a way I can say something like $(this).children('select') // this doesn't work, btw to get all the select elements that exist within the context of the form the submit event is executing for? This will allow me to reduce my code to the following, moving all the functionality into a common function: $("form").submit(function(event) { GatherDataAndSubmit($(this)); }); function GatherDataAndSubmit(obj) { var data = GetSelectData(obj.children('select')); $.post(obj.attr("action"), data, ..etc) } Thanks Dave

    Read the article

  • Installed Android on Mac, cannot find SDK

    - by David Matuszek
    Using Mac OS X 10.6.2, Eclipse SDK 3.5.2. I installed the Android plugin, following the instructions at: http://developer.android.com/sdk/eclipse-adt.html In the next section (step #3) it says: For the SDK Location in the main panel, click Browse... and locate your downloaded SDK directory. I cannot find such a directory. When I try some other directory, it says the directory has no 'tools' folder, so I've searched for a 'tools' folder, but none of those found (of 15 or 20) appear to be Android. Where is this directory??? --Dave [email protected]

    Read the article

  • Ownership regarding to returned Quartz objects

    - by huggie
    I have recently asked about autoreleasing a returned quartz object: http://stackoverflow.com/questions/2819548/autorelease-for-cgmutablepathref Dave DeLong answered my question that there is no autorelease for quartz (or any NS foundation objects) and I should use the Create Rule. However the naming convention on the document says, The Core Foundation naming conventions, in particular use of the word “create”, only apply to C functions that return Core Foundation objects. Naming conventions for Objective-C methods are governed by the Cocoa conventions, irrespective of whether the method returns a Core Foundation or Cocoa object. By this account since my function is a message in an objective C object it doesn't seem proper to name it createSomething. I still want to return this object. What's the best way to approach this? Should I use the Get Rule and then have the caller explicitly retain it? But this is not within Cocoa convention. What's the proper way to handle this?

    Read the article

  • how do I send stuff to method using the JQuery Ajax method

    - by nisardotnet
    $.ajax({ type: "POST", url: "WebService.asmx/AddVisitor", data: "{'fname':'dave', 'lname':'ward'}", contentType: "application/json; charset=utf-8", dataType: "json" }); I have an Asp.Net WebMethod that takes a firstName, lastName.....as a parameter, how do I send that stuff to that method using the JQuery Ajax method. if i hardcode the above it works without any problem but if i pass dynamic it fails var firstName = $("[id$='txtFirstName']"); var lastName = $("[id$='txtLastName']"); //data: "{'firstName':'Chris','lastName':'Brandsma'}"<br> data: "{'firstname':'" + escape(firstName.val()) + "','lastName':'" + escape(lastName.val()) + "'}", my WebMethod looks like this [WebMethod] public bool AddVisitor(string firstName, string lastName) { return true; } what wrong here? i have tried with eval and escape none of that works. Thanks for any help.

    Read the article

  • Overloading Controller Actions

    - by DaveDev
    Hi Guys I was a bit surprised a few minutes ago when I tried to overload an Action in one of my Controllers I had public ActionResult Get() { return PartialView(/*return all things*/); } I added public ActionResult Get(int id) { return PartialView(/*return 1 thing*/); } .... and all of a sudden neither were working I fixed the issue by making 'id' nullable and getting rid of the other two methods public ActionResult Get(int? id) { if (id.HasValue) return PartialView(/*return 1 thing*/); else return PartialView(/*return everything*/); } and it worked, but my code just got a little bit ugly! Any comments or suggestions? Do I have to live with this blemish on my Controllers? Thanks Dave

    Read the article

  • Looking for Info on a Javascript Testing framework

    - by DaveDev
    Hi Can somebody fill me in on JavaScript Testing Frameworks? I'm working on a project now and as the JS (Mostly jQuery) libraries grow, it's getting more and more difficult to introduce change or refactor, because I have no way of guaranteeing the accuracy of the code without manually testing everything. I don't really know anything about JavaScript Testing Frameworks, or how they integrate/operate in a .Net project, so I thought I'd ask here. What would a good testing framework be for .Net? What does a JavaScript test look like? (e.g. with NUnit, I have [TestFixture] classes & [Test] methods in a ProjectTests assembly) How do I run a javascript test? What are the conceptual differences between testing JS & testing C#? Is there anything else that would be worth knowing? Thanks Dave

    Read the article

  • Do you have to create a View Controller to move between views?

    - by Frames84
    I want a single startup view with a button and a welcome screen. When the button is pressed I then want to navigate to a second view which contains a table view and toolbar. I've tried creating a ViewController but my button is shown on all views. I just want a single view, then when it's pressed i go to the next view and the 'real' app starts. Can someone please try and explain the best architecture to do this? (like in chapter 6 of beginning iPhone 3 Development by Dave Mark and Jeff LaMarche ) Thanks

    Read the article

  • How does the Amazon Recommendation feature work?

    - by Rachel
    What technology goes in behind the screens of Amazon recommendation technology? I believe that Amazon recommendation is currently the best in the market, but how do they provide us with such relevant recommendations? Recently, we have been involved with similar recommendation kind of project, but would surely like to know about the in and outs of the Amazon recommendation technology from a technical standpoint. Any inputs would be highly appreciated. Update: This patent explains how personalized recommendations are done but it is not very technical, and so it would be really nice if some insights could be provided. From the comments of Dave, Affinity Analysis forms the basis for such kind of Recommendation Engines. Also here are some good reads on the Topic Demystifying Market Basket Analysis Market Basket Analysis Affinity Analysis Suggested Reading: Data Mining: Concepts and Technique

    Read the article

  • Annoying Bug in banner cycle

    - by Davemof
    I have created a rotating banner script for a new site I'm developing View banner here(it rotates every 10 seconds) Unfortunately to the transition seems to be a biut buggy, and the image will fade out, show the same image again and then fade in the new one. I think I have made a simple error somewhere, but can't figure out where it is. the code used to cycle the banners is: In document ready: if ($('.home').length > 0){ $('<img width="100%" />').attr('src', '/assets/img/backgrounds/home/hero'+homecount+'.jpg').load(function(){ $('.hero').append( $(this) ); $('.hero img').fadeIn('medium').delay(10000).fadeOut('slow', loopImages); setHeroHeight(); }); } Outside document ready: function loopImages(){ homecount = homecount+1; if (homecount > 5){ homecount = 1; } $('.hero img') .attr('src', '/assets/img/backgrounds/home/hero'+homecount+'.jpg') .load(function(){ $('.hero img').fadeIn('fast')}).delay(10000).fadeOut('slow', loopImages); } Any help would be greatly appreciated Thanks Dave

    Read the article

  • Unable to modify a table

    - by the Hampster
    I'm having trouble with mysql. I can read and write, but now I want to add some fields to a table. I run this command: ALTER TABLE Pubs ADD COLUMN issue tinyint AFTER volume; but get this error message: ERROR 7 (HY000): Error on rename of './user_acct/Pubs.MYI' to './user_acct/#sql2-cb0-76f2.MYI' (Errcode: 13) I created this table a few months ago, modified it a little bit, so it worked then. I can still update and insert items, but I just can't modify the table anymore. Any help would be appreciated. --Dave

    Read the article

  • from JS to iphone dev - what's the best language to start with?

    - by Enkai
    I am a total beginner and would like to eventually learn to develop for the iphone. I have just done a beginner's CS course where the language we learned was JavaScript. We studied basic concepts like: variables, arrays, loops (for,while,if,if..else..), properties and functions. I'm wondering if I am starting in the right/wrong place by following this book: Learn C on the Mac by Dave Mark? I have read a few chapters and am finding it a bit hard to get my head around the way that C works, for example the way that Strings are printed seems overly complicated as compared to JS. Do you think that JS was the wrong language to start off with and would I be better to go from JS straight to Objective-C rather than to C? I have tried to read up on previous threads on the merits/demerits of learning C first but haven't found any that relate JS to learning C/Obj C/ Cocoa. Any advice appreciated as I am very new to this. Thanks

    Read the article

  • Android USB driver v2 vs v3? V3 doesnt see moto droid in device chooser?!?

    - by BobG
    I can see my adp2 in ddms device chooser, but cant see Dave's droid. (used to be able to before updating to usb v3!). Can some smart person diff the inf files from usb v2 and v3 and see if they dropped the droid by mistake when they added the nexus? I can't think of any other reason why I cant see the droid in the device chooser. USB debug turned on, same debuggable app that runs on the 1.6 adp2. I'd like to be able to see the 2.1 device even if it has a red x by it!

    Read the article

  • Deploying Rails app over VPN

    - by DavidGouge
    You'll have to bear with me as I'm not a Ruby dev, but have inherited a Ruby system. I need to deploy some changes to the app from my repository to the server. I've been instructed to run cap deploy and told that that script will get the latest code from my repository and deploy it to the server. My problem is that I have to VPN to get to the production server and the VPN client then blocks access to my local network, cutting off the repository. So my question is, how can I change my deploy.rb so that I can deploy from my local machine instead? Or is there a better way. If you need to see the deploy.rb, please let me know. Thanks Dave

    Read the article

  • How does Array.ForEach() compare to standard for loop in C#?

    - by DaveN59
    I pine for the days when, as a C programmer, I could type: memset( byte_array, '0xFF' ); and get a byte array filled with 'FF' characters. So, I have been looking for a replacement for this: for (int i=0; i < byteArray.Length; i++) { byteArray[i] = 0xFF; } Lately, I have been using some of the new C# features and have been using this approach instead: Array.ForEach<byte>(byteArray, b => b = 0xFF); Granted, the second approach seems cleaner and is easier on the eye, but how does the performance compare to using the first approach? Am I introducing needless overhead by using Linq and generics? Thanks, Dave

    Read the article

  • Toorcon14

    - by danx
    Toorcon 2012 Information Security Conference San Diego, CA, http://www.toorcon.org/ Dan Anderson, October 2012 It's almost Halloween, and we all know what that means—yes, of course, it's time for another Toorcon Conference! Toorcon is an annual conference for people interested in computer security. This includes the whole range of hackers, computer hobbyists, professionals, security consultants, press, law enforcement, prosecutors, FBI, etc. We're at Toorcon 14—see earlier blogs for some of the previous Toorcon's I've attended (back to 2003). This year's "con" was held at the Westin on Broadway in downtown San Diego, California. The following are not necessarily my views—I'm just the messenger—although I could have misquoted or misparaphrased the speakers. Also, I only reviewed some of the talks, below, which I attended and interested me. MalAndroid—the Crux of Android Infections, Aditya K. Sood Programming Weird Machines with ELF Metadata, Rebecca "bx" Shapiro Privacy at the Handset: New FCC Rules?, Valkyrie Hacking Measured Boot and UEFI, Dan Griffin You Can't Buy Security: Building the Open Source InfoSec Program, Boris Sverdlik What Journalists Want: The Investigative Reporters' Perspective on Hacking, Dave Maas & Jason Leopold Accessibility and Security, Anna Shubina Stop Patching, for Stronger PCI Compliance, Adam Brand McAfee Secure & Trustmarks — a Hacker's Best Friend, Jay James & Shane MacDougall MalAndroid—the Crux of Android Infections Aditya K. Sood, IOActive, Michigan State PhD candidate Aditya talked about Android smartphone malware. There's a lot of old Android software out there—over 50% Gingerbread (2.3.x)—and most have unpatched vulnerabilities. Of 9 Android vulnerabilities, 8 have known exploits (such as the old Gingerbread Global Object Table exploit). Android protection includes sandboxing, security scanner, app permissions, and screened Android app market. The Android permission checker has fine-grain resource control, policy enforcement. Android static analysis also includes a static analysis app checker (bouncer), and a vulnerablity checker. What security problems does Android have? User-centric security, which depends on the user to grant permission and make smart decisions. But users don't care or think about malware (the're not aware, not paranoid). All they want is functionality, extensibility, mobility Android had no "proper" encryption before Android 3.0 No built-in protection against social engineering and web tricks Alternative Android app markets are unsafe. Simply visiting some markets can infect Android Aditya classified Android Malware types as: Type A—Apps. These interact with the Android app framework. For example, a fake Netflix app. Or Android Gold Dream (game), which uploads user files stealthy manner to a remote location. Type K—Kernel. Exploits underlying Linux libraries or kernel Type H—Hybrid. These use multiple layers (app framework, libraries, kernel). These are most commonly used by Android botnets, which are popular with Chinese botnet authors What are the threats from Android malware? These incude leak info (contacts), banking fraud, corporate network attacks, malware advertising, malware "Hackivism" (the promotion of social causes. For example, promiting specific leaders of the Tunisian or Iranian revolutions. Android malware is frequently "masquerated". That is, repackaged inside a legit app with malware. To avoid detection, the hidden malware is not unwrapped until runtime. The malware payload can be hidden in, for example, PNG files. Less common are Android bootkits—there's not many around. What they do is hijack the Android init framework—alteering system programs and daemons, then deletes itself. For example, the DKF Bootkit (China). Android App Problems: no code signing! all self-signed native code execution permission sandbox — all or none alternate market places no robust Android malware detection at network level delayed patch process Programming Weird Machines with ELF Metadata Rebecca "bx" Shapiro, Dartmouth College, NH https://github.com/bx/elf-bf-tools @bxsays on twitter Definitions. "ELF" is an executable file format used in linking and loading executables (on UNIX/Linux-class machines). "Weird machine" uses undocumented computation sources (I think of them as unintended virtual machines). Some examples of "weird machines" are those that: return to weird location, does SQL injection, corrupts the heap. Bx then talked about using ELF metadata as (an uintended) "weird machine". Some ELF background: A compiler takes source code and generates a ELF object file (hello.o). A static linker makes an ELF executable from the object file. A runtime linker and loader takes ELF executable and loads and relocates it in memory. The ELF file has symbols to relocate functions and variables. ELF has two relocation tables—one at link time and another one at loading time: .rela.dyn (link time) and .dynsym (dynamic table). GOT: Global Offset Table of addresses for dynamically-linked functions. PLT: Procedure Linkage Tables—works with GOT. The memory layout of a process (not the ELF file) is, in order: program (+ heap), dynamic libraries, libc, ld.so, stack (which includes the dynamic table loaded into memory) For ELF, the "weird machine" is found and exploited in the loader. ELF can be crafted for executing viruses, by tricking runtime into executing interpreted "code" in the ELF symbol table. One can inject parasitic "code" without modifying the actual ELF code portions. Think of the ELF symbol table as an "assembly language" interpreter. It has these elements: instructions: Add, move, jump if not 0 (jnz) Think of symbol table entries as "registers" symbol table value is "contents" immediate values are constants direct values are addresses (e.g., 0xdeadbeef) move instruction: is a relocation table entry add instruction: relocation table "addend" entry jnz instruction: takes multiple relocation table entries The ELF weird machine exploits the loader by relocating relocation table entries. The loader will go on forever until told to stop. It stores state on stack at "end" and uses IFUNC table entries (containing function pointer address). The ELF weird machine, called "Brainfu*k" (BF) has: 8 instructions: pointer inc, dec, inc indirect, dec indirect, jump forward, jump backward, print. Three registers - 3 registers Bx showed example BF source code that implemented a Turing machine printing "hello, world". More interesting was the next demo, where bx modified ping. Ping runs suid as root, but quickly drops privilege. BF modified the loader to disable the library function call dropping privilege, so it remained as root. Then BF modified the ping -t argument to execute the -t filename as root. It's best to show what this modified ping does with an example: $ whoami bx $ ping localhost -t backdoor.sh # executes backdoor $ whoami root $ The modified code increased from 285948 bytes to 290209 bytes. A BF tool compiles "executable" by modifying the symbol table in an existing ELF executable. The tool modifies .dynsym and .rela.dyn table, but not code or data. Privacy at the Handset: New FCC Rules? "Valkyrie" (Christie Dudley, Santa Clara Law JD candidate) Valkyrie talked about mobile handset privacy. Some background: Senator Franken (also a comedian) became alarmed about CarrierIQ, where the carriers track their customers. Franken asked the FCC to find out what obligations carriers think they have to protect privacy. The carriers' response was that they are doing just fine with self-regulation—no worries! Carriers need to collect data, such as missed calls, to maintain network quality. But carriers also sell data for marketing. Verizon sells customer data and enables this with a narrow privacy policy (only 1 month to opt out, with difficulties). The data sold is not individually identifiable and is aggregated. But Verizon recommends, as an aggregation workaround to "recollate" data to other databases to identify customers indirectly. The FCC has regulated telephone privacy since 1934 and mobile network privacy since 2007. Also, the carriers say mobile phone privacy is a FTC responsibility (not FCC). FTC is trying to improve mobile app privacy, but FTC has no authority over carrier / customer relationships. As a side note, Apple iPhones are unique as carriers have extra control over iPhones they don't have with other smartphones. As a result iPhones may be more regulated. Who are the consumer advocates? Everyone knows EFF, but EPIC (Electrnic Privacy Info Center), although more obsecure, is more relevant. What to do? Carriers must be accountable. Opt-in and opt-out at any time. Carriers need incentive to grant users control for those who want it, by holding them liable and responsible for breeches on their clock. Location information should be added current CPNI privacy protection, and require "Pen/trap" judicial order to obtain (and would still be a lower standard than 4th Amendment). Politics are on a pro-privacy swing now, with many senators and the Whitehouse. There will probably be new regulation soon, and enforcement will be a problem, but consumers will still have some benefit. Hacking Measured Boot and UEFI Dan Griffin, JWSecure, Inc., Seattle, @JWSdan Dan talked about hacking measured UEFI boot. First some terms: UEFI is a boot technology that is replacing BIOS (has whitelisting and blacklisting). UEFI protects devices against rootkits. TPM - hardware security device to store hashs and hardware-protected keys "secure boot" can control at firmware level what boot images can boot "measured boot" OS feature that tracks hashes (from BIOS, boot loader, krnel, early drivers). "remote attestation" allows remote validation and control based on policy on a remote attestation server. Microsoft pushing TPM (Windows 8 required), but Google is not. Intel TianoCore is the only open source for UEFI. Dan has Measured Boot Tool at http://mbt.codeplex.com/ with a demo where you can also view TPM data. TPM support already on enterprise-class machines. UEFI Weaknesses. UEFI toolkits are evolving rapidly, but UEFI has weaknesses: assume user is an ally trust TPM implicitly, and attached to computer hibernate file is unprotected (disk encryption protects against this) protection migrating from hardware to firmware delays in patching and whitelist updates will UEFI really be adopted by the mainstream (smartphone hardware support, bank support, apathetic consumer support) You Can't Buy Security: Building the Open Source InfoSec Program Boris Sverdlik, ISDPodcast.com co-host Boris talked about problems typical with current security audits. "IT Security" is an oxymoron—IT exists to enable buiness, uptime, utilization, reporting, but don't care about security—IT has conflict of interest. There's no Magic Bullet ("blinky box"), no one-size-fits-all solution (e.g., Intrusion Detection Systems (IDSs)). Regulations don't make you secure. The cloud is not secure (because of shared data and admin access). Defense and pen testing is not sexy. Auditors are not solution (security not a checklist)—what's needed is experience and adaptability—need soft skills. Step 1: First thing is to Google and learn the company end-to-end before you start. Get to know the management team (not IT team), meet as many people as you can. Don't use arbitrary values such as CISSP scores. Quantitive risk assessment is a myth (e.g. AV*EF-SLE). Learn different Business Units, legal/regulatory obligations, learn the business and where the money is made, verify company is protected from script kiddies (easy), learn sensitive information (IP, internal use only), and start with low-hanging fruit (customer service reps and social engineering). Step 2: Policies. Keep policies short and relevant. Generic SANS "security" boilerplate policies don't make sense and are not followed. Focus on acceptable use, data usage, communications, physical security. Step 3: Implementation: keep it simple stupid. Open source, although useful, is not free (implementation cost). Access controls with authentication & authorization for local and remote access. MS Windows has it, otherwise use OpenLDAP, OpenIAM, etc. Application security Everyone tries to reinvent the wheel—use existing static analysis tools. Review high-risk apps and major revisions. Don't run different risk level apps on same system. Assume host/client compromised and use app-level security control. Network security VLAN != segregated because there's too many workarounds. Use explicit firwall rules, active and passive network monitoring (snort is free), disallow end user access to production environment, have a proxy instead of direct Internet access. Also, SSL certificates are not good two-factor auth and SSL does not mean "safe." Operational Controls Have change, patch, asset, & vulnerability management (OSSI is free). For change management, always review code before pushing to production For logging, have centralized security logging for business-critical systems, separate security logging from administrative/IT logging, and lock down log (as it has everything). Monitor with OSSIM (open source). Use intrusion detection, but not just to fulfill a checkbox: build rules from a whitelist perspective (snort). OSSEC has 95% of what you need. Vulnerability management is a QA function when done right: OpenVas and Seccubus are free. Security awareness The reality is users will always click everything. Build real awareness, not compliance driven checkbox, and have it integrated into the culture. Pen test by crowd sourcing—test with logging COSSP http://www.cossp.org/ - Comprehensive Open Source Security Project What Journalists Want: The Investigative Reporters' Perspective on Hacking Dave Maas, San Diego CityBeat Jason Leopold, Truthout.org The difference between hackers and investigative journalists: For hackers, the motivation varies, but method is same, technological specialties. For investigative journalists, it's about one thing—The Story, and they need broad info-gathering skills. J-School in 60 Seconds: Generic formula: Person or issue of pubic interest, new info, or angle. Generic criteria: proximity, prominence, timeliness, human interest, oddity, or consequence. Media awareness of hackers and trends: journalists becoming extremely aware of hackers with congressional debates (privacy, data breaches), demand for data-mining Journalists, use of coding and web development for Journalists, and Journalists busted for hacking (Murdock). Info gathering by investigative journalists include Public records laws. Federal Freedom of Information Act (FOIA) is good, but slow. California Public Records Act is a lot stronger. FOIA takes forever because of foot-dragging—it helps to be specific. Often need to sue (especially FBI). CPRA is faster, and requests can be vague. Dumps and leaks (a la Wikileaks) Journalists want: leads, protecting ourselves, our sources, and adapting tools for news gathering (Google hacking). Anonomity is important to whistleblowers. They want no digital footprint left behind (e.g., email, web log). They don't trust encryption, want to feel safe and secure. Whistleblower laws are very weak—there's no upside for whistleblowers—they have to be very passionate to do it. Accessibility and Security or: How I Learned to Stop Worrying and Love the Halting Problem Anna Shubina, Dartmouth College Anna talked about how accessibility and security are related. Accessibility of digital content (not real world accessibility). mostly refers to blind users and screenreaders, for our purpose. Accessibility is about parsing documents, as are many security issues. "Rich" executable content causes accessibility to fail, and often causes security to fail. For example MS Word has executable format—it's not a document exchange format—more dangerous than PDF or HTML. Accessibility is often the first and maybe only sanity check with parsing. They have no choice because someone may want to read what you write. Google, for example, is very particular about web browser you use and are bad at supporting other browsers. Uses JavaScript instead of links, often requiring mouseover to display content. PDF is a security nightmare. Executible format, embedded flash, JavaScript, etc. 15 million lines of code. Google Chrome doesn't handle PDF correctly, causing several security bugs. PDF has an accessibility checker and PDF tagging, to help with accessibility. But no PDF checker checks for incorrect tags, untagged content, or validates lists or tables. None check executable content at all. The "Halting Problem" is: can one decide whether a program will ever stop? The answer, in general, is no (Rice's theorem). The same holds true for accessibility checkers. Language-theoretic Security says complicated data formats are hard to parse and cannot be solved due to the Halting Problem. W3C Web Accessibility Guidelines: "Perceivable, Operable, Understandable, Robust" Not much help though, except for "Robust", but here's some gems: * all information should be parsable (paraphrasing) * if not parsable, cannot be converted to alternate formats * maximize compatibility in new document formats Executible webpages are bad for security and accessibility. They say it's for a better web experience. But is it necessary to stuff web pages with JavaScript for a better experience? A good example is The Drudge Report—it has hand-written HTML with no JavaScript, yet drives a lot of web traffic due to good content. A bad example is Google News—hidden scrollbars, guessing user input. Solutions: Accessibility and security problems come from same source Expose "better user experience" myth Keep your corner of Internet parsable Remember "Halting Problem"—recognize false solutions (checking and verifying tools) Stop Patching, for Stronger PCI Compliance Adam Brand, protiviti @adamrbrand, http://www.picfun.com/ Adam talked about PCI compliance for retail sales. Take an example: for PCI compliance, 50% of Brian's time (a IT guy), 960 hours/year was spent patching POSs in 850 restaurants. Often applying some patches make no sense (like fixing a browser vulnerability on a server). "Scanner worship" is overuse of vulnerability scanners—it gives a warm and fuzzy and it's simple (red or green results—fix reds). Scanners give a false sense of security. In reality, breeches from missing patches are uncommon—more common problems are: default passwords, cleartext authentication, misconfiguration (firewall ports open). Patching Myths: Myth 1: install within 30 days of patch release (but PCI §6.1 allows a "risk-based approach" instead). Myth 2: vendor decides what's critical (also PCI §6.1). But §6.2 requires user ranking of vulnerabilities instead. Myth 3: scan and rescan until it passes. But PCI §11.2.1b says this applies only to high-risk vulnerabilities. Adam says good recommendations come from NIST 800-40. Instead use sane patching and focus on what's really important. From NIST 800-40: Proactive: Use a proactive vulnerability management process: use change control, configuration management, monitor file integrity. Monitor: start with NVD and other vulnerability alerts, not scanner results. Evaluate: public-facing system? workstation? internal server? (risk rank) Decide:on action and timeline Test: pre-test patches (stability, functionality, rollback) for change control Install: notify, change control, tickets McAfee Secure & Trustmarks — a Hacker's Best Friend Jay James, Shane MacDougall, Tactical Intelligence Inc., Canada "McAfee Secure Trustmark" is a website seal marketed by McAfee. A website gets this badge if they pass their remote scanning. The problem is a removal of trustmarks act as flags that you're vulnerable. Easy to view status change by viewing McAfee list on website or on Google. "Secure TrustGuard" is similar to McAfee. Jay and Shane wrote Perl scripts to gather sites from McAfee and search engines. If their certification image changes to a 1x1 pixel image, then they are longer certified. Their scripts take deltas of scans to see what changed daily. The bottom line is change in TrustGuard status is a flag for hackers to attack your site. Entire idea of seals is silly—you're raising a flag saying if you're vulnerable.

    Read the article

  • Microsoft Templates included in jQuery 1.5!

    - by Stephen Walther
    When I joined the ASP.NET team as the Program Manager for Ajax, the ASP.NET team was working on releasing a new version of the Microsoft Ajax Library. This new version of the Microsoft Ajax Library had several really innovative and unique features such as support for client templates, client data-binding, script dependency management, and globalization. However, we kept hearing the message that our customers wanted to use jQuery when building ASP.NET applications. Therefore, about ten months ago, we decided to pursue a risky strategy. Scott Guthrie sent me to Cambridge to meet with John Resig – the creator of jQuery and leader of the jQuery project – to find out whether Microsoft and jQuery could work together. We wanted to find out whether the jQuery project would be open to allowing Microsoft to contribute the innovative features that we were developing for the Microsoft Ajax Library -- such as client templates and client data-binding -- to the jQuery library. Fortunately, the Cambridge meeting with Resig went well. John Resig was very open to accepting contributions to the jQuery library. Over the next few months, we worked out a process for Microsoft to contribute new features to the open-source jQuery project. Resig and Guthrie appeared on stage at the MIX10 conference to announce that Microsoft would be contributing features to jQuery. It has been a long journey, but I am happy to report success. Today, Microsoft and the jQuery project have announced that three plugins developed by developers on the ASP.NET team – the jQuery Templates, jQuery Data Link, and jQuery Globalization plugins – have been accepted as official jQuery plugins. In addition, the jQuery Templates plugin will be integrated into jQuery 1.5 which is the next major release of jQuery. You can learn more about the plugins by watching the following Web Camps TV episode hosted by James Senior with Stephen Walther: Web Camps TV #5 - Microsoft Commits Code to jQuery! You can read Scott Guthrie’s blog announcement here: http://weblogs.asp.net/scottgu/archive/2010/10/04/jquery-templates-data-link-and-globalization-accepted-as-official-jquery-plugins.aspx You can read the jQuery team’s announcement here: http://blog.jquery.com/2010/10/04/new-official-jquery-plugins-provide-templating-data-linking-and-globalization/ I wrote the original proposal for the jQuery Templates plugin. Dave Reed and Boris Moore were the ASP.NET developers responsible for actually writing the plugin (with lots of input from the jQuery team and the jQuery community). Boris has written a great set of tutorials on the Templates plugin. The first tutorial in his series is located here: http://www.borismoore.com/2010/09/introducing-jquery-templates-1-first.html I want to thank John Resig, Richard Worth, Scott Gonzalez, Rey Bango, Jorn Zaefferer, Karl Swedberg and all of the other members of the jQuery team for working with the ASP.NET team and accepting our contributions to the jQuery project.

    Read the article

  • Tom Cruise: Meet Fusion Apps UX and Feel the Speed

    - by ultan o'broin
    Unfortunately, I am old enough to remember, and now to admit that I really loved, the movie Top Gun. You know the one - Tom Cruise, US Navy F-14 ace pilot, Mr Maverick, crisis of confidence, meets woman, etc., etc. Anyway, one of more memorable lines (there were a few) was: "I feel the need, the need for speed." I was reminded of Tom Cruise recently. Paraphrasing a certain Senior Vice President talking about Oracle Fusion Applications and user experience at an all-hands meeting, I heard that: Applications can never be too easy to use. Performance can never be too fast. Developers, assume that your code is always "on". Perfect. You cannot overstate the user experience importance of application speed to users, or at least their perception of speed. We all want that super speed of execution and performance, and increasingly so as enterprise users bring the expectations of consumer IT into the work environment. Sten Vesterli (@stenvesterli), an Oracle Fusion Applications User Experience Advocate, also addressed the speed point artfully at an Oracle Usability Advisory Board meeting in Geneva. Sten asked us that when we next Googled something, to think about the message we see that Google has found hundreds of thousands or millions of results for us in a split second (for example, About 8,340,000 results (0.23 seconds)). Now, how many results can we see and how many can we use immediately? Yet, this simple message communicating the total results available to us works a special magic about speed, delight, and excitement that Google has made its own in the search space. And, guess what? The Oracle Application Development Framework table component relies on a similar "virtual performance boost", says Sten, when it displays the first 50 records in a table, and uses a scrollbar indicating the total size of the data record set. The user scrolls and the application automatically retrieves more records as needed. Application speed and its perception by users is worth bearing in mind the next time you're at a customer site and the IT Department demands that you retrieve every record from the database. Just think of... Dave Ensor: I'll give you all the rows you ask for in one second. If you promise to use them. (Again, hat tip to Sten.) And then maybe think of... Tom Cruise. And if you want to read about the speed of Oracle Fusion Applications, and what that really means in terms of user productivity for your entire business, then check out the Oracle Applications User Experience Oracle Fusion Applications white papers on the usable apps website.

    Read the article

< Previous Page | 87 88 89 90 91 92 93 94 95 96 97 98  | Next Page >