Applications security: Cenzic stands alone
116297
Applications security testing specialist Cenzic contends that it's ready to reap the rewards of remaining independent.
66343
But 'Gi-Fi' pointless without robust security
441772
Vista's EULA Product Activation Worries &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29
769408
In 1980, I signed a deal with a company to market a product I was developing. The contract required me to turn over the source code, which I did. One day I went to a meeting at the office of the company, and there on the product manager's desk, right next to a door that opened to the outside, was a floppy labeled "Dave Winer's source code" in big letters.  If you own a Mac you may soon find out what that felt like. It's amazing to me that the tech blogosphere doesn't treat Apple's policy re broken hard disks as the huge gaping security hole that it is.  Think about it. We worry about bad people getting their hands on little pieces of data that, when added together, give them the power to be you in banking and credit transactions.  Think about what you would do if your laptop was stolen. Well, if you own a Mac and its hard disk goes bad, and you make the mistake of bringing it to Apple for service, you will turn over all that data to Apple. Not "may" or "might" but "will." What Apple in turn does with that data is none of your affair. They don't sign anything or offer any guarantees that they won't sell the disk to a data miner. Think it can't happen or that it's unlikely? I don't gain much comfort from your feeling of security. I've been writing about this issue since December 22. Usually when I write something critical of Apple, the results are mixed. Some people are supportive, but far more people attack. This time the ratio is very different. Almost everyone who has commented gets that there's a huge problem here. Can we solve this problem? Of course we can.  Some say that other vendors do this too. That gives me less comfort, not more. That means there's no escaping this crazy way of treating user's confidentiality. Ultimately it hurts the vendors because people can't use their computers for things the manufacturers say we can.  Further, it's got to be an issue for the banks, brokerage firms, credit agencies. If you are a newspaper and you employ reporters and they use a computer, how exactly are you guarding the confidentiality of your sources? If you're a confidential source, don't you have an interest when the reporter gives their computer manufacturer all their data to do with as they please? Imagine what you would do if it turned out there was a bug in a Netgear or Linksys router that allowed, under special circumstances, a mailicous person to gain access to the full content of your hard disk at any time. Would you have a problem with that? This is worse than Microsoft's neglect of malware that got me to stop using their computers. In that case it was Microsoft being neglegent. This time Apple itself is the cause of the problem. It's as if they planted a virus in their operating system that entitled them, under special circumstances, completely out of the user's control, to gain access to everything on your disk, with as much time as they want, with no way for you to prevent or even detect the intrusion.  See also: My letter to Steve Jobs.
477670
As mentioned by Derick Rethans on his blog today, there's some new versions of several (five) of the components in the next version of the eZ Components framework:   In the just released alpha versions you can find new features, such as better support for OpenID, a Database backend for OpenID authentication, a validating method for e-mail addresses, SMTP authentication support for DIGEST-MD5, CRAM-MD5, NTLM and LOGIN and encoding support for e-mail headers.   He also mentions other goodies like tree structure handling and functionality to support WebDav connections. Check out their roadmap to get a better idea of what's to come.
126417
The ThinkPHP Blog has some new information posted about a collaboration between the Mayflower Group and Stefan Esser (and the Hardened-PHP Project) to create SektionEins.    SektionEins specializes in Web Application Security, supporting every web platform available out there. Of course there is some special knowledge in the area of PHP included and the Chorizo and Consulting experience does add a lot of Web2.0 knowhow.   With SektionEins both Suhosin and Chorizo found a new home. And so does Web Application Security.    Currently, the new service hasn't launched yet, but you can enter your email address to be notified when it's open for business.
489450
Some data is private. Other data, less so. Secure applications make it possible--and easy--to keep user data visible to the right people and invisible to the wrong people. Vladi Belperchinov explains how access control works and demonstrates with working code suitable for implementing your own access controls.
344614
Amero's defense requests judge throw out verdict &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29
24218
A tool that could help in the battle against spam and phishing attacks receives industry approval.
374515
Security industry analysts and other market watchers are still working to understand the long-term viability of NAC (network access control) as a standalone technology, but some end-users contend that they are already seeing major benefits using best-of-breed tools.
90155
Based off of a previous article from Mike Willbanks, Stuart Herbert has posted some of his own thoughts on tuning and tweaking your applications for the best performance you can get out of them.   There's some good advice in there, and I thought it'd be a good idea to quickly add a bit more detail about the separate approaches that Mike raises.   He goes over the APC caching, memcache, the "gzip trick", the "Not Modified" header and optimized SQL statements.   He also mentions one thing that Mike didn't mention - a split between static files (no PHP needed) and their dynamic cousins. Having a more pure Apache (no PHP installed) can help give a minute jump in speed that, depending on the size of the site, could really add up from a user's perspective.
520249
Con password accedevano in Sistema dell'Anagrafe Tributaria
328278
Opinion: Already we&#39;re hearing it, that spammers are beating SPF and the other authentication systems. But the truth has always been that authentication is only a tool for anti-spam systems to use.
49129
Over on the SecurityFocus website, there's an interview posted with Stefan Esser of the Hardened-PHP Project (as interviewed by Federico Biancuzzi.   Federico Biancuzzi discussed with him how the PHP Security Response Team works, why he resigned from it, what features he plans to add to his own hardening patch, the interaction between Apache and PHP, the upcoming "Month of PHP bugs" initiative, and common mistakes in the design of well-known applications such as WordPress.   Some of the topics discussed include  the Hardened-PHP Project Suhosin the PHP Security Response Team (his role in it and why he left) PHP5's security focus versus PHP4's and more...  Check out the full interview to have all of your questions answered.
229644
Services try different approaches to sender authentication to halt spam.
313471
Finnish security firm F-Secure has discovered what is believed to be the first adware application built specifically for Mac OS X. The program does not require administrative privileges in order to install itself on the user's computer.
40472
In response to this recent article from the Hiveminds website, Marco Tabini has a few choice words about some of the topics they cover in the article, and cover incorrectly.   Over the last few years, I've made it a point of trying to respond to at least some of the "PHP is dead"-type articles that crop up on the Net from time to time. The latest one comes from Hiveminds and reveals a complete misunderstanding of almost every point it covers.   He notes that though the article seems to be a coherent whole for why PHP is dwindling, it's "based on nothing more than a string of misinformed concepts cobbled together to give the appearance that the author knows what he or she is talking about". Marco comes back against each of the points made in the article, setting things right and eliminating some of the FUD (fear, uncertainly, and doubt) that the Hiveminds article spreads.