ProWebDeveloper.info: Reducing Database Load with Secure Client-side Sessions
640982
On prowebdeveloper.info, Marcel Esser has posted the first in a series of articles looking at functionality to reduce database load in applications, specifically those using secure client-side sessions.   Scaling web applications is easy. Generally, if a web application is designed to store all of its session information in a database, it can be easily scaled by adding more servers in a load-balanced setup. This is tried and true, and it works very well - until your database server runs out of capacity.   He lists the common ways most developers solve this problem (four of them) but notes that thay are more of a temporary solution rather than a long-term fix. Instead, he outlines what the requirements for a library to correctly handle the connections should be and explains how each of them would be implemented. He's been following this kind of mentality in the development of his own package - proWebComponents.
710202
Blanket Discovery for Stolen Laptops &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29
200433
An enhanced multi-threaded syslogd, supporting reliable syslog over TCP and RFC 3195, writing to MySQL databases, fully configurable output formats (with great timestamps), ability to filter on anything, and on-the-wire message compression.   Hi all,  Rsyslog 3.11.2 has just been released. Now it has the ability to convert text files into syslog. This is done by the imfile plugin, which monitors text files. A new libdbi-based output plugin has been written. This adds six additional databases (including Firebird and Oracle) to the supported database set. Also contains small bug fixes. Version 3.11.2 is a recommended release for all version 3 users.  Doc for new Modules:    http://www.rsyslog.com/doc-omlibdbi.html    http://www.rsyslog.com/doc-imfile.html  Changelog:    http://www.rsyslog.com/Article175.phtml  Download:    http://www.rsyslog.com/Downloads-req-getit-lid-79.phtml  I hope this release is useful. As always, feedback is appreciated.  Best regards, Rainer Gerhards
765627
Your Space, My Space, Everybody's Space &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29
385776
This article begins a series of three articles dedicated to configuring Apache 2.0 with SSL/TLS support, in order to ensure maximum security and optimal performance of secure web communication. This part introduces key aspects of SSL/TLS and then shows how to compile and configure Apache 2.0 with support for these protocols.
328302
JavaScript and databases have a mixed history, due in part to JavaScript's success. But Web security provisions restricts the ability of a Web program to read (and write) local files. Here are some options to change that. By Jacques Surveyor. 0827
346334
By Miguel Helft  Millions of people enjoy free Web-based software programs, but they have a drawback in that they are available to users only when they are online.
444532
Ten security flaws found in Firefox browser, Thunderbird e-mail client.
583590
The trials and tribulations of application dependency in a virtualized, hosted world.
391310
Internet Security Systems' intrusion prevention software on Crossbeam Systems security switches.
466917
This third and final article in the Metasploit series covers the msfcli scripting interface as well as the intuitive web interface to the Framework. The article also discusses what's new with version 2.2, and then introduces the exploit development process through an example.
739698
Businesses and non-commercial entities have much to consider when it comes to securing their web applications and the data they keep on customers and patrons.
292176
NBC muckraker outed at DEFCON &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29
612223
Thin-client computing has been around for a decade, but the rising costs of updating software and installing security patches on networked personal computers is sparking renewed interest
674304
Mike Wallner has thrown together some stats for the latest edition of the pecl/http package to test its response performance.   The results surprised me, because it clearly shows that the performance drop for starting the PHP engine and doing the neccessary negotiation to provide caching is not that bad.   There's a chart of the results as well as a full PDF with all of the stats the graph maps out. He includes the legend to make the graph easier to understand.
347402
In this new post on the PHP Security Blog, Stefan Esser brings up an interesting issue when dealing with web applications - being able to bind a script/application to a different port on the local machine.   Unfortunately the ability to bind yourself to a port and receive connections is a threat to webapplications installed on different virtual hosts on the same IP, even if other security measures in place, like tight filesystem permissions or executing PHP script with the permission of the owner.   He gives an example in PHP of how this can happen and one of the scary side effects of having it in the same domain - the cookie information is passed in. It's a simple concept that could have very bad consequences in the wrong hands.    Additionally, you don't even have to create it in PHP either. As cyberlot mentions, it could be created in any language that has socket functions. Be sure to check out the comments for more thoughts and comments on the post.
377359
Digital tracks may help pinpoint Potter leaker &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29