CJOnline Users Won't Have to Register
480477
By Adrielle Harvey  By Adrielle Harvey  THE CAPITAL-JOURNAL  Visitors to CJOnline.com are no longer required to register or sign in to access stories.  The plan is to increase readership on the site by removing obstacles to accessing articles.
350661
Blog: Charlie Martin leaves Novell to join MuleSource.  Not a jackass move at all.
739055
Yahoo is moving in a big way to embrace the new OpenID 2.0 specification, which eliminates the need for Web surfers to create separate IDs and logins at each of the Web sites, blogs and profile pages that they may visit during an online session.
684816
OK - I actually like and enjoy LDAP, but do not allow that to cloud your judgment. LDAP took much more of my time and effort to learn than Bind and/or DNS. And I recall sitting in front of DNS chapters wondering why we needed another language to do something as easy as mapping a friendly name to an IP address. This jargon stuff has value though such as constraing insomnia.
728050
According to this security release from Secunia, there's a cross-site scripting vulnerability with the Travelsized CMS package (PHP-based) in the main index file.   David Vieira-Kurz has discovered some vulnerabilities in Travelsized CMS, which can be exploited by malicious people to conduct cross-site scripting attacks.   The problem comes from the input parameters "page" and "langauge" not being verified and sanitized. Users are encouraged to go in and manually edit the source to correct the problem as there is no patch currently posted as of yet. You can get complete information about this issue from the full Secunia report.
100893
Changes to the social networking site will make the names and profiles of its members available to nonmembers.
257280
Consumers won&#39;t have to pay a tax to log on to the Internet until at least 2007, after Congress voted Friday to renew a recently lapsed ban on Internet taxation.
437127
I should have known... The idiots want to rule the Reddit I started for Scripting News readers. I couldn't figure out how to delete it, and while trying, I deleted my account, so forget the experiment, and if anyone at Reddit is listening, could you please delete it for me. (I sent an email but there was no response.) Still diggin!
377661
MoJT Login System is simple, but yet powerful login system. The Program consist of a login, registration and members page. It has also the administration panel which is easy to access and even more easier to use!   New version/update for version 1.05 was released today! Here is the change log:  - Changed bottom (copyright) link with new one (old one caused pop-ups!) - Fixed small language bugs - Fixed FROM form; now can be defined in php configuration file - Reedit php config file for easier use - Updated the readme file for better understanding and easier configuration of script - Updated installation page  Regards,  Stefan
347402
In this new post on the PHP Security Blog, Stefan Esser brings up an interesting issue when dealing with web applications - being able to bind a script/application to a different port on the local machine.   Unfortunately the ability to bind yourself to a port and receive connections is a threat to webapplications installed on different virtual hosts on the same IP, even if other security measures in place, like tight filesystem permissions or executing PHP script with the permission of the owner.   He gives an example in PHP of how this can happen and one of the scary side effects of having it in the same domain - the cookie information is passed in. It's a simple concept that could have very bad consequences in the wrong hands.    Additionally, you don't even have to create it in PHP either. As cyberlot mentions, it could be created in any language that has socket functions. Be sure to check out the comments for more thoughts and comments on the post.
631685
With the closure of IETF&#39;s MARID group a month ago, many of us have left Microsoft&#39;s Sender-ID standard for the dead. After being rejected by the Apache Foundation and the Debian Project over licensing issues
734119
It's high time for a better way to protect his identity online, CNET News.com's Mike Ricciuti says. He's sick of yellow stickies.
5785
According to this posting on the SecWatch board today, there are some issues with the CJ Tag Board software that allow for code injection issues.   Multiple input validation vulnerabilities in CJ Tag Board have been reported, which can be exploited by remote users to compromise a vulnerable system.   The issue comes from improperly filtered user input for the "User-Agent" HTTP header and the "banned" parameter for the admin side. This issue effects CJ Tag Board version 3.0. No update or patch has been posted as of yet to correct this issue.
282113
'It's not a dirty trick. It's a security measure' Network Solutions is front running domain name registrations, temporarily preventing competitors from selling domains that web users show interest in. But the popular registrar insists this is merely a way of preventing others from front running.â¦
459086
(InfoWorld) - The Internet Corporation for Assigned Names and Numbers is seeking ideas and opinions on ways to modify the agreement terms it enters into with Internet registrars to protect individuals and organizations that do business with them. The effort stems from theÂ recent debacle involving registrar RegisterFly, which ICANN had to strip of its accreditation due to poor quality of service, which prompted massive and loud complaints from many of its tens of thousands of customers. At its 29th International Public Meeting in San Juan, Puerto Rico, ICANN on Monday hosted a workshop to discuss possible changes to its Registrar Accreditation Agreement (RAA) and steps it is taking to make sure registrars provide good service to their customers. Participants in the workshop, titled "Protection of Registrants," generally agreed that the RAA is due for a makeover to prevent another RegisterFly-like situation and because much has changed since the RAA was last amended about seven years ago. "We need to deal with registrar accreditation and the procedures by which we accommodate registrants," said Susan Crawford, an ICANN board member who moderated the discussion. Among the issues panelists and audience members debated was the need for Internet registrars -- companies ICANN accredits to sell Internet domain names to individuals and organizations -- to escrow their customers' data with ICANN or another third party. That way, in the event of a registrar meltdown, ICANN, which manages and oversees the Internet's domain name system, could access the customer data and help customers switch to another registrar. "This is important to registrants. We want to be able to reconstitute a registrar if it fails so that registrants can continue to have access to their domains and be able to work with them," Crawford said. Ironically, in its current form, the RAA has a data escrow provision but it hasn't been implemented for several reasons. "It put a burden on ICANN to receive data, so the cost was all on ICANN. And until recently, there wasn't a budget item for the registered data escrow program," Crawford said. Details on how this escrow will work need to be established, such as what will constitute a valid trigger for the data release and what data will be stored. Jon Nevett, policy and ethics vice president of Internet registrar Network Solutions, said that ICANN's Registrar Constituency, which he chairs, has worked in recent months on the data escrow program with ICANN, which recently requested proposals to provide escrow services. A key point for registrars is how ICANN will protect their customers' data if it needs to be transferred, Nevett said. "There is a lot of private information in this data," he said. One of the issues ICANN is trying to work through is what data would be put in escrow. Under the current RAA provisions that data includes: registrant, administrative contact, technical contact, billing contact, name servers and expiration dates. "When the provision was drafted, these were the elements that were believed to be critically necessary to restore the functionality of a registrar," said Mike Zupke, ICANN's Registrar Liaison Manager. Changing the data requirements would require amending the RAA, he said. This issue is an interesting one, considering individuals' privacy concerns when registering a domain name, concerns that have prompted the appearance of "proxy" services that let registrants "hide" from the public some of the information they submit to a registrar, Crawford said. Nevett argued that providing data to an escrow party that the registrant wants to keep from public view doesn't compromise privacy, because the escrow data wouldn't be publicly available. Meanwhile, Beau Brendler, director of Consumer Reports Webwatch, suggested that ICANN provide more information about registrars, including ratings, so that consumers can make better informed decisions when choosing one. There are about 900 registrars currently, according to ICANN. "Measures that increase compliance are good," Brendler said, adding that ICANN might consider setting up a system to rate registrars and hold registrars to best practices guidelines. Stacy Burnette, ICANN's director of contractual compliance, said that starting next month her team will publish a report twice a year with results from their registrar audits. Citing preliminary results, Burnette said that in March her team found that of 881 audited registrars, 19 had non-working Web sites, and that in April, 192 registrars had invoices that were overdue by 30 days or more. Based on these findings, her group is seeking compliance from the offending registrars. Her group is also currently doing a "code of conduct audit" to ensure that registrars are not engaging in conduct that would give "the appearance of impropriety," she said. Meanwhile, a future audit will focus on registrars' back-end systems performance, checking on issues like availability, downtime and outages, to see if they are meeting standards set in their agreements with ICANN. Moreover, an ongoing audit is focusing on registrar data retention requirements, while a future audit will verify whether registrars are maintaining the required commercial liability insurance levels, she said. "We want to encourage compliance to enhance ICANN's ability to preserve and enhance the operational stability, reliability, security and global interoperability of the Internet," Burnette said.
664458
On PHPGeek.com, there's a new post talking about the use of the AuthComponent for CakePHP for access control in your application. It's not a tutorial, but it does follow how the developer came upon the component and why they're using it.   Nearly everything that is built needs at least some level of authentication and authorization before users can be let loose to use it. Unfortunately, not only is there a lot of confusion out there on how to use it, but lots of poorly done, reinvented wheels out there because of it.   He points out the solution he came across via another article from the "Another Cake Baker" blog (lemoncake) show how to use the component for ACL in CakePHP 1.2.
94330
On the Zend Developer Zone, there's a new tutorial covering the use of the Zend_Acl and Zend_Auth modules in the Zend Framework to create a simple user login and authentication system from Simon Mundy.   After submitting the initial example of how Zend_Auth and Zend_Acl could be implemented Gavin pointed out areas that weren't really addressed in my proof of concept and it could potentially confuse newcomers to the way MVC is utilised. I'd like to clarify that post to a) Address those concerns and b) see if there's any constructive criticism of the process that could benefit everyone.   He sets up the site layout (including where the actions lie) and defines some of the access rules the script will follow. From there, he creates a bootstrap file and an index.php to work with it. On top of this, he builds the key piece - the Auth.php - to handle the validation of the users.