Comodo resolves site validation glitch
1787
Trust restored Digital certificate firm Comodo has restored services to normal after websites displaying Comodo's Trust Logo were reduced to a crawl on Friday.â¦
184845
The WordPress.com blog-hosting service suffered a DoS (denial-of-service) attack that began Saturday and was still preventing users from logging in or posting to their blogs on Tuesday.Matt Mullenweg, spokesman for Automattic, confirmed that the service experienced a DoS attack with spikes of up to 6 gigabits of incoming traffic, which was making some blogs inaccessible for about five to 15 minutes on Tuesday. Though service had mostly been restored, Automattic, which maintains WordPress.com, was still working on returning service to normal levels on Tuesday afternoon, he said.&quot;Obviously that [is not good] and is pretty unusual for our service,&quot; he said. &quot;All our people who can are working on the issue.&quot;However, an employee at a New York-based company that has blogs hosted by WordPress.com suggested that some users were experiencing outages for longer than 15 minutes. The source, who asked not to be identified, said on Tuesday afternoon that users there were unable to log in to their blogs and post comments for &quot;most of the day.&quot; However, the blogs were still able to be viewed publicly.&quot;It&#39;s starting to come back to life now, slowly,&quot; said the source on Tuesday afternoon.WordPress.com users were notified via e-mail about the DoS attack. In the e-mail, the service provider said that the attack was affecting user log-in and causing some forums to be offline.Mullenweg said that the main Wordpress.com page was down longer than some blogs because &quot;we sacrificed it in order to keep blogs and our users up.&quot; However, the site&#39;s home page and Web site were up and running on Tuesday.He also provided a link to a graph that shows the traffic spikes to WordPress.com on the graph, where the service&#39;s traffic is displayed in a brown line.A DoS attack is an attempt to make a Web site or service unavailable to intended users by flooding the service or site with incoming data requests, such as e-mails. Motives for DoS attacks vary, but perpetrators mostly target companies with high-profile, highly trafficked Web sites.Joris Evers, a spokesman for security research and software company McAfee, said DoS attacks are still fairly common, although they have tapered off in recent years because technology has been developed that can head off such attacks before they affect service.Though he had not heard specifically of the WordPress attack, Evers said that it&#39;s possible the attack was mounted by someone &quot;who was upset about something that was written on a WordPress blog, and they decided to take action against that.&quot;
663829
The FrSIRT site has posted a new advisory for users of the Vivvo Article Management CMS software about potential holes that could allow for some very large-scale damage to be done.    Multiple vulnerabilities have been identified in Vivvo Article Management CMS, which could be exploited by remote attackers to compromise a vulnerable server.   The first issue is due to an input validation error in the "pdf_version.php" script that does not validate the "id" parameter before being used in SQL statements, which could be exploited by malicious people to conduct SQL injection attacks.   The second vulnerability is due to an input validation error in the "index.php" script that do not validate the "classified_path" parameter, which may be exploited by remote attackers to include local or remote scripts with the privileges of the web server.    Versions 3.2 and higher of the software are effected, and, unfortunately, there has been no patch issued for the issue.
561815
Anyone noticing some "quirkiness" happening when they use the eZ Mail component in their scripts and bounce the messages off of a Qmail server, might want to check out this helpful hint from Tobias Schlitt on how he solved it.   While working with the eZ Mail component, for sending some emails comfortably, I noticed some issue with my Qmail installation. With some email accounts that received the emails, the headers were broken and had double line break characters, so the complete email was broken. That (weirdly) happened only with some servers (e.g. Gmail), while my own server handeled the emails gracefully.   He discovers that the issue lies on Qmail's side, where the sendmail wrapper for it looks for a "n" instead of a "rn" line PHP sends at the end of a line. Thankfully, it's an easy fix with the eZ Mail component: [php]  [/php] Check out this page for more information on this functionality.
274667
The Bakery (the CakePHP repository) has posted a few new things recently with topics ranging from Javascript helpers to new behaviors. Here's the latest:   JSMin Helper Compress and cache javascript Yahoo weather component Using JpGraph Protip Helper Breadcrumb helper Showing a text excerpt around multiple keywords ConditionalValidation behavior CakeSWXPHP   As always, you can find these and lots more great CakePHP-related content over on The Bakery.
149334
On the heels of a rant posted by Matt Mullenweg (of Wordpress), Ed Finkler has posted some of his own thoughts and rebuttals to the points Matt made.   Among these points are comments about PHP5 features that "could be helping Wordpress users right now" including:   Parameterized SQL input to eliminate SQL injection attacks Filter extension to combat XSS, CSRF, etc. attacks Prepared statement/transaction support in PDO and MySQLi Improved OOP features and support (code quality, extensibility)   Ed pushes that it's not about the slow adoption of PHP5 in other places. Its about the slow adoption of it in Wordpress so far as it relates to Matt:   The thing is, support of PHP5-only features in WP would give it better speed and security right now. And especially in the case of security, Matt's reliance on what users say they want is a critical error: users don't ask about security until well after it becomes a serious issue. Wordpress has one of the worst security records of any PHP application, so I'll go out on a limb and say that it's a problem now. Even if WP users aren't talking about it, WP's core dev team should have addressed this already.
452780
McAfee says it's sorry for glitches in new security software.
178847
A bug in Microsoft&#39;s Internet Security and Acceleration (ISA) Server 2000 and Proxy Server 2.0 can let hackers spoof Web content, such as a trusted site, with their own fake content, the Redmond
567864
As you spring forward this year, brace yourself for a software glitch that could affect computers, digital watches and clocks. By the Associated Press.
486652
A coding error during routine upgrade maintenance at online payment Web site PayPal.com has created havoc for users, who have had only intermittent access to their accounts since Friday.
517091
Fixes made for "critical" JavaScript vulnerability in the Firefox browser and the SeaMonkey application suite.
265009
We are proud to announce the release of version 0.9 or LeafRSS! This version includes full smarty template integration, as well as options to embed the articles in another web page, or even to allow the output of the filter as an RSS feed.   A patch file has been included to upgrade from version 0.8 to avoid any loss of data. Please see the PATCH file for details.  This will be the final major release before we release our first stable version.  If you have any questions or discover any bugs in this version, please post them either in the Help section of our sourceforge forums or in our sourceforge bug tracker. We would appreciate any input you could give us to help us test this release in preparation for moving this project to stable status.  More detail is available at: https://sourceforge.net/projects/leafrss
445482
Todd Cochrane noticed that feedvalidator.org is acting strangely. I checked it out and verified the problems he reported. There's nothing wrong with Todd's feed, at least as far as I can see, and the validator should not be warning about the problems it's warning about, imho. Please, would the maintainers of the validator check this out and make whatever corrections are necessary. Thanks!!
413097
The firm has rated the flaw as moderately critical. It demonstrated the flaw on its site, with options for both users who use pop-up blockers and those who don&#39;t.
267769
It can be the hardest word Registration and web hosting company 123-Reg has again apologised to customers hit by hardware problems which meant some customers' websites fell offline.â¦
460038
In this post to his blog, Chris Shiflett talks about some issues surrounding character encoding and the cross-site scripting issues it can open up in your application.    In the post [on Good and Bad PHP Code], he provides a few useful PHP interview questions, including some questions from Yahoo. He explains that good PHP code should be Structured, Consistent, Portable and Secure   In the comments, many additional improvements have been suggested, but there's one that has yet to be mentioned. When using htmlspecialchars() without specifying the character encoding, XSS attacks that use UTF-7 are possible.    Included in the post is an example to illustrate the point as well as a solution, a simple one involving the header() function, to help correct the problem and prevent bad things from happening.   Be sure to check out http://shiflett.org/blog/2007/may/character-encoding-and-xss#comments">the comments for more great tips.
223142
(InfoWorld) - Microsoft has blamed an unspecified server problem for a 19-hour stretch during which paying users of Windows XP and Vista were accused by the company's WGA (Windows Genuine Advantage) validation system of running pirated software. Any Vista system fingered during the episode was stripped of some features, including the operating system's Aero graphical interface. As of Saturday at 3 p.m. EDT, Microsoft said the problem had been fixed. "We are aware it is a server-side issue," said Phil Liu, a Microsoft program manager in the WGA group. "[But] the cause is unknown at this current time." "Customers who received an incorrect validation response can fix their system by revalidating on our site," said Alex Kochis, senior product manager of WGA, in a blog posting. The site Kochis referred to is the Genuine Microsoft Software home page, which includes links to validation tests for Windows and Microsoft Office. "After successfully revalidating, any affected system should be rebooted to ensure the genuine-only features are restored," Kochis continued. The validation server snafu began sometime prior to 8 p.m. EDT on Friday, when users started posting messages on Microsoft's support forums, including Vista Validation Issues, saying that their PCs had been tagged as running nongenuine Windows. Overnight, the number of users adding their accounts to the tale spiked significantly, as did the frustration index. "What in hell is going on, Microsoft?" asked a user named Hedgemeister. "SUPPORT? Where are you? Validation issues with Vista. Hello? All of us need help," wrote Gnrlbzik. "This is an absolute disgrace. Treating legitimate customers like criminals is a great way to make people want to buy your software in the future! [I'm] absolutely disgusted," added Costanza. Although copies of both Windows XP and Vista were being tagged as counterfeit during the 19 hours, users of the latter were especially incensed. The WGA antipiracy scheme for that operating system disables several features when it thinks the copy is bogus, among them the Aero graphical user interface and ReadyBoost. Early in the outage, several Microsoft customers posted what they said was the text of e-mail they had received from Microsoft support that suggested users sit tight for several days. "I'm sorry to inform you that the Windows Genuine server might be down for few days," the e-mail, attributed to Microsoft Technical Support, said. "I have escalated the issue to our Genuine team, kindly try to validate again on Tuesday 28 Aug 2007." If the message was intended to mollify users, it didn't work. "TUESDAY!?! Yeah, f that," said Nooaah. It wasn't until Saturday around 1 p.m. EDT that a non-anonymous Microsoft manager offered up information. "I guarantee that we're working on this issue right now," said Liu in a post to the forum. "My goal is to identify a FIX for this issue -- afterwards get you all what you are looking for, an explanation and cause. I promise I will have an explanation and resolution as soon as humanly possible." Users' testy relationship with WGA Although Microsoft did not identify the number of affected systems Saturday, based on the user comments and Liu's promises, it appeared to be systemwide. If so, it would be the biggest problem so far in the developer's contentious WGA program. Designed to spot pirated copies of its Windows and Office software, WGA has been mandatory since mid-2005 before nonsecurity updates or files can be downloaded from Microsoft's site. WGA has faced criticism almost since its inception, but until Friday, the most vocal complaints dated back to June 2006, when users discovered that the Windows XP version of WGA was "phoning home" to Microsoft every time the PC was booted. Those critics returned when Microsoft upped the ante with Vista by replacing the WGA messages that only nagged XP users suspected of running counterfeits with a new policy that used an RFM (reduced functionality mode) to cripple machines. In RFM, only Internet Explorer works, and then for just an hour at a time. Because RFM only allows a grace period of three days to those who previously activated Windows but are subsequently deemed pirates, any problems must be fixed quickly to prevent customers' PCs from going dark. Microsoft managed to beat the deadline. That, however, didn't mean much to some, who said this was it for their relationship with the vendor. One claimed that he was heading out the door to buy a Mac, while others swore they would switch to Linux. Others called on Microsoft to ditch WGA. "Once again the legitimate person gets screwed while the people who pirate software probably aren't even affected," said Mark in the support forum. "This whole validation process should be dropped. This is just another nail in the Microsoft coffin." Saturday's outage was not the first time the validation service has gone dark and then identified all PCs connecting with the servers as running pirated copies. In October 2006, Microsoft's Kochis acknowledged a similar blackout. "Earlier this week, a server on the back end of the WGA service experienced a bug that resulted in a temporary outage. As a result, some systems were incorrectly flagged as being non-genuine, and we want to confirm for those who contacted us about this that it was indeed an error," he wrote.