impl.emented» security

Stack Overflow, HTML 5, Chrome Processes, Atmosphir and More [Best of September '08 #2]

Jonas Bolinder — Tue, 16 Sep 2008 19:23:38 +0000

An assortment of the most interesting posts this week (September 8-14 2008):

Stack Overflow launches, a Q&A site for programmers, who can ask questions and get answers from other programmers. The site is community driven, good answers get voted up and rise in the list of answers to a question. As a result, any discussions among the answers are discouraged, as these will be scrambled, explains Joel Spolsky, one of the founders. Community members can build a reputation by earning points and badges in response to good answers and other activity. Marshall Kirkpatrick liked Stack Overflow in his review, and I think it could be a useful service. Marshall requested subscribable feeds for answers to a question. I found a link to an Atom feed for each question, not sure if it is optimal though. There are also feeds for a users top answers and questions, and the top 30 questions for a specific tag. A chronological feed with all questions belonging to a tag would perhaps be more useful.
Tags: programming, web development
Webmonkey has an article about HTML 5, the next specification in works for the HTML language. The latest specification 4.01 was completed in 1999, and we probably will have to wait at least another 10 years for a completed version 5. In the meantime some browser vendors have implemented parts of the HTML 5 draft, e.g. the canvas element, and more recently the video element, as I wrote about last week. Browser extensions like Gears, and plugins like Silverlight and Flash also find a niche, where the current standard is lagging behind.
Tags: HTML5, web standards
Scott Hanselman writes about the use of multiple processes in the Chrome browser and in IE8. Separate processes create a greater degree of isolation between tabs: If one process/tab crashes, the other processes/tabs stay unaffected. The potential overhead of processes vs. threads, and the inter-communication between processes, are really no problem nowadays considering the rapid development of computer hardware.
Tags: Chrome, IE8
A new tool dubbed CookieMonster will soon be released to the public. It is able to get hold of user credentials submitted to secured sites via a man-in-the-middle attack. Several banks are identified as insecure. The tool utilizes a programming flaw, where the website developer has failed to designate the authentication cookie as secure.
Tags: security
Atmosphir, a 3D platform game creation tool, is currently in private beta but expects to open to the public at the end of the year. Atmosphir got one of the five jury selection prices at this years TechChrunch50. Hopefully it is fun for creative kids.

Tags: gaming

Vista Security is Broken - Midori Coming to the Rescue? [Best of August '08 #1]

Jonas Bolinder — Mon, 11 Aug 2008 17:04:53 +0000

This week was all about Microsoft's current and future operating systems (August 4-10 2008):

The much touted security of Windows Vista seems to be worthless, according to findings by the two security researchers Mark Dowd and Alexander Sotirov. SearchSecurity writes:

By taking advantage of the way that browsers, specifically Internet Explorer, handle active scripting and .NET objects, the pair have been able to load essentially whatever content they want into a location of their choice on a user's machine. [...] That's completely game over.

The researchers seems to have found a way to compromise .NET objects, which IE assumes are safe, effectively using the objects as stepping stones for other attacks.
Tags: security, Windows Vista
Dave Winer has a piece about why he thinks Vista may fail, comparing the operating system to two other failed OSes of the past: OS/2 and Apple III. "Vista has the smell of death," writes Winer, outlining a few other reasons why he disapproves of the OS. The ones I particularly agree with are "5. Everything is happening in the web browser now," and "6. [...] there is no demand for new operating systems." No one actually needs grand new operating system, just keeping tuning and tweaking the existing OSes should be enough. That's one thing I like about Linux (the kernel specifically), it's (almost) from the beginning been called Linux and will probably be called that forever. It just has a version number (currently 2.6.26), which is incremented as bugs are fixed and new features are added. The only reason I see for Microsoft to release a new OS is if they come up with a complete rewrite, with all junk code discarded that has piled up through the years (cf. this highlight mentioning the current problem with Windows core architecture). This could be the promise of Midori, which is pointed out as Microsoft's future non-windows operating system, see the next item below.
Tags: Windows Vista
Ars technica reports on recent speculations about Midori, a coming non-Windows operating system from Microsoft. Key features of Midori are that it's based on managed code, .NET presumably, which takes the load of memory management off the developer. Further, the OS should be easy to virtualize, even allowing it to run as a separate Windows process. This would facilitate backwards compatibility, as the OS could initially be run inside a legacy Windows OS. Midori is also assumed to be well prepared for cloud computing, allowing for asynchronous API calls and making it easier to program for multiple processors. This last part is important from a performance and efficiency point of view, as CPUs get multiple cores. Multithreaded programming is a difficult and error-prone task, not well suited for the everyday programmer.
Tags: Midori
On a lighter note, Lifehacker featuring the How-To Geek, debunks a number of Windows performance tweaking myths. Like registry cleaning and memory optimizing, as is offered by several tools, and disabling of Windows services (except for possibly a few ones). Personally, I use CCleaner to remove temporary files, and I defragment my hard drives a few times a year, which seems to be enough to keep Windows XP reasonably fit.
Tags: tools, Windows

Microsoft Plummets on Search - Android in Trouble [Best of July '08 #3]

Jonas Bolinder — Mon, 21 Jul 2008 15:48:39 +0000

This week featured some troubling news for Microsoft and Google (July 14-20 2008):

Recent data from Hitwise shows that Microsoft has lost almost 50 percent of its market share in search from June 2007 to June 2008. In the U.S. the drop is from 9.8 % market share to 5.5 %. In the U.K. the drop is from 5.7 % to 3.7 %, and in Australia a dramatic fall from 14.7 % to 6.7 %. Google is the great winner, while Yahoo shows a minor drop and Ask a minor gain. Ask is now almost as big as Microsoft on search in the U.S. As it seems, to remain a major player in the search field, Microsoft desperately needs to get hold of Yahoo's search service.
Tags: Microsoft, search
Google's supposedly open mobile platform Android, loses in credibility among developers, as it was revealed this week that a few select top contestants of the Android Developer Challenge were given access, under the counter, to an updated version of the SDK. Additionally, the code was provided under a non-disclosure clause, rhyming poorly with the promise of open, though technically Google has done nothing wrong.
There seems to be a lack of communication from the part of Google. As suggested by AndroidGuys, more frequent updates to the official Android blog would certainly calm down some hard feelings among developers. It will be interesting to see in the coming year what impact Android will make on the mobile phone market, which currently is overwhelmed, in terms of buzz at least, by the new iPhone.
Tags: Android
Gnip, the notification proxy service, finally hooks up to the XMPP firehose of Twitter. Does this mark the beginning of the end of the troubles of Twitter?
Tags: Gnip, Twitter
OStatic points to an "executive summary of Open Source", a white paper challenging 10 Open Source Myths. Some examples of myths covered: "Open source is free", "Open source equals open standards", "Open source is not for mission-critical functions", "Open source is for non-conformists" and "Open source software is lower quality".
Tags: open source
5 tips on using Twitter to improve your online-reputation. Some examples: "Start conversations with notable peers", "Share valuable industry news" and "Monitor your Twitter reputation".
Tags: online reputation, Twitter
IPv6, the next generation internet protocol, about to replace the current IPv4 in a couple of years, might pose a security risk, writes the Wired. The problem is that it is enabled by default in many operating systems, and lots of applications may not yet be up-to-date to handle the new protocol. Affected operating systems include Windows Vista and Mac OS X. Windows XP is however safe, i.e. IPv6 is not enabled by default. You can test here which IP protocols are supported by your computer.
Tags: IPv6, security

From Yahoo Search BOSS to Rocking Fractals [Best of July '08 #2]

Jonas Bolinder — Mon, 14 Jul 2008 20:57:06 +0000

Lots of interesting stuff the past week (July 7-13 2008):

Yahoo continues their open strategy with the launch of Search BOSS (Build your Own Search Service). This is a different offering than SearchMonkey, which just allowed you to enhance the presentation of the search results. The new service has quite liberal terms. It allows you to re-order the search results and mix in other results as you see fit. These are desired options I wrote about in my first post on this blog. The terms also have a no-attribution requirement, which expressively requires you not to mention Yahoo in your search offering. Still you are not allowed to use the search index data in any way you might want to. You must provide a search service, with a search box, and only query the index in response to a search performed by a real user of your service. Also, considering the current uncertainty of the future of Yahoo, building a business on top of BOSS seems a bit risky.
Tags: search, Yahoo
From the security department, there was much talk about a potential, yet unexploited flaw in the Domain Name System, DNS, the "address book" of the internet, which translates human friendly URLs to IP addresses. Dan Kaminsky, who discovered the flaw, secretly informed the major vendors without talking to the security community, which has spawned some speculation about the significance of the discovery. The details of the vulnerability will not be publicly disclosed until August 7. Though, it is likely related to insufficient randomness provided by the 16 bit session ID of DNS. In that respect, the vulnerability is rooted in the same problem domain as the OpenSLL flaw I wrote about in May.
Tags: security
Two news from the virtual world(s): Google launches a customizable and embeddable virtual world called Lively. Second Life, the hitherto largest virtual world, reported on the first successful teleportation of an avatar between two (experimental) virtual worlds. They also recorded a video of the event.
Tags: virtual worlds
Ars Technica writes about recent speculations about a new non-Windows operating system in development at Microsoft, code name Midori. To be released some 9 years from now, probably beyond Windows 8.
Tags: Windows
The new URL shortening service bit.ly, has a host of innovative features, including an API, as reported by Marshall Kirkpatrick. Dave Winer is one of the brains behind the service.
Tags: URLs, tools
Soon we might be able to program Flash using C, meaning a speed boost that is useful in gaming applications, for example.
Tags: Flash
Moopz, a FriendFeed conversation aggregator reviewed by Sarah Perez. Among the features are item threading, noise reduction and automatic summary and tag generation. Only items containing a link are considered, thus reducing the noise. First impression is that it's a useful service. (Btw. I'm jobol on FriendFeed.)
Tags: aggregation, FriendFeed
Josh Catone is back to blogging. Now at SitePoint, a resource site for web developers and designers, where he is running the News & Trends blog. Glad to have him back.
Tags: Josh Catone
Finally, a bonus video on the math theme featuring fractals, found via Brad Feld.

Nerds Make Money, Geeks are Cool [Best of May '08 #4]

Jonas Bolinder — Mon, 26 May 2008 20:53:02 +0000

Some of the most interesting posts this week (May 19-25 2008):

Robert Scoble writes about the real PR secrets: "PR now stands for 'Professional Relationships'." That is, you should build personal relationships with influential bloggers and journalists to be successful in PR. Obviously this doesn't scale, and is out of scope for most people. Luckily, as Robert writes: "You don’t need PR at all if you have a great product." Loic Le Meur points to the importance of participation and building a community.
Tags: entrepreneurial
A serious security flaw was recently detected in the OpenSSL library of the Debian an Ubuntu Linux-based operating systems, affecting several applications involved in secure communications across the Internet, the Apache web server included. The flaw was introduced in the key generation code, effectively reducing the key length from 128 to 15 bit, making a brute force attack very feasible. The flaw has been around for about two years, affecting millions of systems which ever have used the key generation mechanism of the affected operating systems.
Tags: security
On the distinction between a nerd and a geek writes Brad Feld, who concludes that "nerds are geeks who make money." David Brooks outlines the history of the words nerd and geek, dating nerd back to 1950, and writing that "At first, a nerd was a geek with better grades." But later, geeks got higher status: "A nerd was still socially tainted, but geekdom acquired its own cool counterculture. A geek possessed a certain passion for specialized knowledge, but also a high degree of cultural awareness and poise that a nerd lacked." Coolness seems to be a characteristic of a geek, which might explain why you so often see people describe themselves as geeks, but less frequently as nerds. Brad Feld, by the way, describes himself as a nerd. Geeks are cool and Mac users for the most, I guess. I'm a PC guy, and probably more of a nerd than a geek. It just remains to make some serious money to become a real nerd (like Bill Gates).
Tags: trivia
Dave Winer says that to him "Twitter is a publishing medium." Having 9644 followers, Twitter is obviously a useful publishing medium, not so useful however with just a handful of followers.
Tags: Twitter
Steve Rubel presents 9 future trends, broken down into three categories based on the likelihood of hitting: Faint Signals (more likely): The Cut and Paste Web, The Attention Crash, Digital Curators, Super Crunching and Collaboration. Watch List: Living Room 2.0 and Geek Marketers. Hallucinations (less likely): Digital Nomads and Data Leaking.
Tags: trends