Developer Tutorials Blog: And the winner of the most important security tip competition is...
22096
The Developer Tutorials blog has posted their "winner" of a list of things to do to keep you and your website secure:   When it comes to PHP security, you often think of input filtering, SQL injection prevention, XSS in user submitted content and so on. Well, forget about that. They're all pretty trivial compared to what I feel is by far the most important security issue of any web application. Read on to find out why.   Their number one thing to do to keep safe and secure? "Keep your systems updated." They point out that security a web site is one thing but securing the system that it runs on/has been developed on is another (and improperly patched, it could cause some huge problems).    Now, the best way to keep on top of potential vulnerabilities in your underlying systems is with updates. Sometimes, however, you need to go a little further. [...] Watching the web is also a good idea; major security vulnerabilities generally make it to the front page of Digg.
101975
0. Introduction 1. SysAdmin of the Year Contest 2. Statistics  This SF.net update brought to you by HP --------------------------------------------------------- Open source and Linux from HP From eight consecutive years of Linux market leadership to countless community outreach programs, HP has proven solutions you can value, on a next generation, highly-efficient BladeSystem platform ideal for Linux, with the approach, experience, and customer commitment you can trust. http://www.linux.com/sponsor_solutions/hpos ---------------------------------------------------------  Hello, and welcome to this month's edition.  Last month, we announced the winners of the 2007 Community Choice Awards during our party at OSCON.  There were some surprises, lots of great winners, and a good time was certainly had by all.  For information about the winning projects, visit our Community Hub at http://sourceforge.net/community and click on the CCA logo.  The beta of our Marketplace continues to go well.  Our beta participants have been creating quality listings to provide our users with access to the experts they need...and, in the process, our design decisions are being validated one-by-one.  Keep a close watch on this new tool, it promises to be a hotspot of engineering activity for us over the next few months.  We will need some help, though!  We're looking for engineering talent to make all the complex things simple around here.  If you're in the bay area and want to join us, email jobs@corp.sourceforge.com  Thanks for reading!  The SourceForge.net Crew    SysAdmin of the Year Contest ----------------------------  Do have know a SysAdmin who goes beyond the call of duty? If so, nominate them as SysAdmin of the Year 2007.  They can win great prizes (Macbook Pro, iPhone, Splunk License), including the knowledge that you care.   The first 2500 SysAdmins nominated get a free t-shirt.  http://www.sysadminoftheyear.com    Statistics and Top Projects ---------------------------  Number of Projects: 155,959 Number of Registered Users: 1,662,751   Daily Stats for 20 August, 2007:  SF.net: 4,026,722 pages served Open Source Files downloaded in 24 hour period: 2,014,157  ---------------------------------------------------------  Top 25 Projects:   1. Azureus https://sourceforge.net/projects/azureus Azureus is a powerful, full-featured, cross-platform bittorrent client.  2. phpMyAdmin https://sourceforge.net/projects/phpmyadmin phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the Web. Currently it can create and drop databases, create/drop/alter tables, delete/edit/add fields, execute any SQL statement, manage keys on fields.  3. Notepad++ https://sourceforge.net/projects/notepad-plus Notepad++ is a generic source code editor (it tries to be anyway) and Notepad replacement written in C++ with the win32 API. The aim of Notepad++ is to offer a slim and efficient binary with a totally customizable GUI.  4. OpenProj - Project Management https://sourceforge.net/projects/openproj OpenProj by Projity is a desktop replacement of Microsoft Project. OpenProj has equivalent functionality, a familiar user interface and even opens existing MSProject files. OpenProj is interoperable with Project, with a Gantt Chart and PERT chart etc.  5. ZK - Simply Ajax and Mobile https://sourceforge.net/projects/zk1 ZK is Ajax framework enriching Web apps with little programming. With event-driven and markup languages, development is as simple as programming desktops and authoring HTML/XUL pages. ZK supports scripting lang including Java, JavaScript, Ruby, Groovy...  6. dimdim meeting server https://sourceforge.net/projects/dimdim Dimdim is an open source web meeting product with features like Application, Desktop and Presentation sharing with A/V streaming and chat. No attendee installation - all features are available through a web browser. Dimdim can be integrated with Moodle.  7. ADempiere Bazaar https://sourceforge.net/projects/adempiere Adempiere is an ERP Bazaar for Open Source Developers that contribute improvements of Compiere, CRM, Shopfloor, POS, Helpdesk, Financials Accounting, Supply Chain, Knowledge and Business apps in an open and unabated fashion. Focus is on the Community.  8. Zenoss Core - Enterprise IT Monitoring https://sourceforge.net/projects/zenoss Zenoss Core is an enterprise network and systems management application written in Python/Zope. Zenoss provides an integrated product for monitoring availability, performance, events and configuration across layers and across platforms.  9. Openbravo ERP https://sourceforge.net/projects/openbravo Web based ERP for SMEs, built on proven MVC & MDD framework that facilitate customization & maintenance of code. Already in production, it encompasses a broad range of functionalities such as finance, supply chain, project mgmt, manufacturing & much more  10. FreeCol https://sourceforge.net/projects/freecol FreeCol is an open version of Colonization. It is a Civilization-like game in which the player has to conquer the new world.  11. FileZilla https://sourceforge.net/projects/filezilla FileZilla is a fast FTP and SFTP client for Windows with a lot of features. FileZilla Server is a reliable FTP server.  12. WebCalendar https://sourceforge.net/projects/webcalendar WebCalendar is a PHP application used to maintain a calendar for a single user or an intranet group of users. It can also be configured as an event calendar.  13. PhpGedView https://sourceforge.net/projects/phpgedview PhpGedView parses GEDCOM 5.5 genealogy files and displays them on the internet in formats and charts that you are familiar with.It also allows relatives to edit their genealogy online and collaborate together on their research.  14. MediaInfo https://sourceforge.net/projects/mediainfo Get technical information and tags of a lot of multimedia files. Supported formats : - Video : AVI/OGM/MKV/MPG/VOB/MP4/3GP/... - Audio : MP3/OGG/MKA/MP4/AAC/...  15. 7-Zip https://sourceforge.net/projects/sevenzip 7-Zip is a file archiver with the high compression ratio. The program supports 7z, ZIP, CAB, RAR, ARJ, LZH, CHM, GZIP, BZIP2, Z, TAR, CPIO, RPM and DEB formats. Compression ratio in the new 7z format is 30-50% better than ratio in ZIP format.  16. KeePass Password Safe https://sourceforge.net/projects/keepass KeePass Password Safe is a free, open source, light-weight and easy-to-use password manager for Windows. You can store your passwords in a highly-encrypted database, which is locked with one master password or key file.  17. MinGW - Minimalist GNU for Windows https://sourceforge.net/projects/mingw MinGW: A native Win32 port of the GNU Compiler Collection (GCC), with freely distributable import libraries and header files for building native Windows applications; includes extensions to the MSVC runtime to support C99 functionality.  18. XOOPS Dynamic Web CMS https://sourceforge.net/projects/xoops XOOPS is a dynamic web content management system written in PHP for the MySQL database. Its object orientation makes it an ideal tool for developing small or large community websites, intra company and corporate portals, weblogs and much more.  19. FreeMind https://sourceforge.net/projects/freemind A mind mapper, and at the same time an easy-to-operate hierarchical editor with strong emphasis on folding. These two are not really two different things, just two different descriptions of a single application. Often used for knowledge and content mgmt.  20. Arianne RPG https://sourceforge.net/projects/arianne Arianne is a multiplayer online engine to develop turn based and real time games providing a simple way of creating the game server rules and clients like Stendhal. Marauroa, our server, uses Java and MySQL for hosting hundreds of players on a solo host.  21. OrangeHRM - Human Resource Management https://sourceforge.net/projects/orangehrm OrangeHRM developed by OrangeHRM Inc is an Open Source HR Information Systems(HRIS) that assists you in managing company's human resources. Through scalable modular architecture it covers main areas of Personnel Management/HRM such as PIM, ESS & Leave.  22. Gallery https://sourceforge.net/projects/gallery A slick, intuitive web based photo gallery. Gallery is easy to install, configure and use. Gallery photo management includes automatic thumbnails, resizing, rotation, and more. Authenticated users and privileged albums make this great for communities.  23. Pidgin https://sourceforge.net/projects/pidgin Pidgin is a GTK+ instant messaging application for Windows and Unix. It supports AIM, ICQ, Jabber/XMPP, MSN, Yahoo!, Bonjour, Gadu-Gadu, IRC, QQ, SILC, SIMPLE and more. See http://pidgin.im/about.php for more information.  24. XBMC (Xbox Media Center) https://sourceforge.net/projects/xbmc XBMC (Xbox Media Center) is a free multimedia player jukebox for Microsoft Xbox game console, it is capable of playing back almost all known video, audio and picture formats from the Xbox harddrive, DVD-ROM drive, a local-network, and even the internet.  25. JasperReports - Java Reporting https://sourceforge.net/projects/jasperreports JasperReports, the market leading open source business intelligence and reporting engine. This project is being moved to http://www.jasperforge.org/. This project is the home for all things Jasper, Reports, Analysis, Server, and Intelligence.
568284
Everyone in the PHP community (as is probably true all around the web) is buzzing about the new offering from Google - the Google Code Search. In the PHP community, the ones talking about it so far include:  Chris Shiflett's look at the security aspect of the search Ilia Alshanetsky's take on the search as it possibly being a hacker's good friend Pierre-Alain Joye's searches for macros and the term "virtual_file_ex" Harry Fuecks' own search for superglobal-related issues Ivo Jansch's happy look into frustrations other developers have had (ex. this search)    Check out this handy tool and see what you think. Does it provide too much access to code that needs to stay out of hacker's hands? Or does it promote the "open" in open source better than most of the tools out there?
559039
Check Point Software Technology's Gil Shwed weighs in on who's winning the war of attrition between virus writers and the security companies they drive crazy.
361236
Today Jonathan Moore  and I headed over to LinuxWorld after lunch to see what kind of cool hardware and Linux hacks they had on the expo floor.  Only $15 to get in the door so I figure why not.  I'm a bit of a privacy freak.  When you're trading some security for liberty there are situations where it *might* be worth it.  In situations of extreme violence having the police by your side might be a good idea.    I think we can all agree that trading liberty for *nothing* isn't worth it. This country was *founded* on liberty after the British were abusing their colonial powers.  Every true American should cherish their liberty and think long and hard about just turning them over for no reason.  ...
228766
Student detained after attacks on Estonian websites &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29
49129
Over on the SecurityFocus website, there's an interview posted with Stefan Esser of the Hardened-PHP Project (as interviewed by Federico Biancuzzi.   Federico Biancuzzi discussed with him how the PHP Security Response Team works, why he resigned from it, what features he plans to add to his own hardening patch, the interaction between Apache and PHP, the upcoming "Month of PHP bugs" initiative, and common mistakes in the design of well-known applications such as WordPress.   Some of the topics discussed include  the Hardened-PHP Project Suhosin the PHP Security Response Team (his role in it and why he left) PHP5's security focus versus PHP4's and more...  Check out the full interview to have all of your questions answered.
234398
QUESTION: What is the best approach to protecting me from ID theft and related activities? Will a software package work best, or must I go to a hardware firewall?
448776
Sara Golemon describes the path she took in a search for an OpenID library to work with in PHP. The trip took her through both PEAR and PECL with no promising results. Heading off to a Yahoo! search she comes up with one good result - Auth_OpenID.   Now, granted, this is the first OpenID system I've looked at, and I haven't really dug into it in depth, but I've got to say, this is some clean, well written code and the author clearly understands the maths involved (or at least fakes it shockingly good).   Knowing this, she asks "why isn't this in PEAR" if it's so well-structured and useful? It works with any version of PHP from 4 up and is smart enough to adapt itself to whatever the structure of your application might be.   There's also some great comments on the post where it's explained why the library isn't in PEAR, another OpenID package for PHP and suggestions for alternate distribution methods (PEAR channel).
35985
Virtualized rootkits - Part 1 &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29
377359
Digital tracks may help pinpoint Potter leaker &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29
122246
As mentioned by the Zend Developer Zone, Ed Finkler has posted the latest version of his Inspekt security tool.   Although downloads have been on the Google Code site for a bit, I recently put up a new build of Inspekt. This could probably be described as a late alpha release, with most proposed features implemented.   Also included in this new edition are full API documentation for the application, some documentation on its basic usage and, of course, the source of this latest release.
729820
Scammers and hackers are targeting the human factor in system setups. Part of a series on hot security topics.
415712
To set things right about a misquote on Slashdot, Zeev Suraksi has posted this long statement mentioning what he really said and a few more personal opinions.   I've just been misquoted on Slashdot, as if I said there are no security problems in PHP itself, and that I instead point my finger only at inexperienced developers. If you read the original article on Heise Security, you'll see that I have not said anything of the sort. [...] I believe this is the belief of most others on the security team, but I'm only speaking on behalf of myself and do not represent them.   He also covers five more points pertaining to the article and the situation:  Where the bugs/problems lie with problems in PHP Why there are security problems in web PHP applications Why the current security level can be partially blamed on the language itself An admission that yes, there are security problems in PHP And the track record the PHP developers have had in fixing these issues  There's much more than just these brief highlights here, so I encourage you to head on over and check out the full post for yourself.   There are some other opinions on the matter from a few others out there too:  cyberlot's blog Zend Developer Zone's post Tony Bibbs' blog
509091
JavaScript development goes to the dogs What you can - and cannot do - with your software is often determined by the code owner's license. From not using open source APIs with closed-source digital rights management (DRM) to being barred from fiddling with Windows source code, we've seen it all.â¦Learn &amp; Contribute, Live &amp; Online - The Register Debates Green Computing
576728
The Zend Developer Zone has starting up their own contribution to the security side of the PHP community - a "Security Tip of the Week" starting with the first three new ones posted just recently:   Tip number one involves a good recommendation - keeping your PHP version up to date. Many security issues and exploits have come around because of older versions and the issues they hold. Tip number two focuses on the errors that your site gives to the viewing public and the information they can betray (file locations, etc) Tip number three talks about using other applications to help you find issues in your code that you might not even know were there - such as Chorizo and the PHPSecInfo reporting tool.  Stay tuned for even more security goodness from Cal and the Zend Developer Zone over the coming weeks...
390760
For the second year running, security researcher Kurt Grutzmacher has found a way to get a free &quot;Platinum&quot; pass to the MacWorld Conference &amp; Expo, being held in San Francisco this week.Thanks to a design flaw in the conference&#39;s Web site, he was able to figure out the special promotional code and award himself a 100 percent discount when purchasing the show&#39;s most expensive pass .The problem was that the site was downloading an encrypted version of the promotional codes to the browser so that it could check for discounts before passing data to MacWorld&#39;s Web server. Site developers may have done this to reduce the time it takes to process conference applications, but in doing so they introduced a serious security vulnerability, Grutzmacher said.Although the promotional codes were encrypted, Grutzmacher used a password-cracking tool called John the Ripper to break the encryption and see the discount codes. &quot;I was very surprised it worked,&quot; he said in an e-mail interview.That&#39;s because it was the same technique that yielded a Platinum pass for the 2007 show . At that time, the show&#39;s promoter, IDG World Expo, &quot;removed all the codes, fixed the site, and said thanks,&quot; Grutzmacher said in a Monday blog posting showing how he cracked the site. &quot;I gave them a few tips (don&#39;t trust user input, don&#39;t give your secret codes to everyone, encryption is not one-way, etc). Did they listen? Nope.&quot;Grutzmacher ran his test in the weeks prior to the show, and the code he obtained stopped working on Jan. 7, he said.Show representatives were not immediately available to comment.The security penetration tester went down to San Francisco&#39;s Moscone Center on Monday to print up his pass, just to see if his trick worked, but he didn&#39;t actually use it to visit the show. &quot;That would be very unethical,&quot; he said.Had he made use of the US$1,895 pass, however, Grutzmacher could have had a free lunch, access to sessions at the conference, entry into the MacWorld party and priority access to Steve Jobs&#39; keynote on Tuesday.&quot;Justin,&quot; a commentator on Grutzmacher&#39;s blog, said he reported a similar bug to IDG in 2003.Grutzmacher said that this is probably not the last we&#39;ll hear of this problem. &quot;I suspect we&#39;ll see this again in 2009,&quot; he said.The MacWorld Conference &amp; Expo is run by IDG Wold Expo, an IDG News Service affiliate.