Devshed: Putting Apache in Jail
616512
In a new article on DevShed, the spotlight is on putting Apache "in jail" with chroot, but they also include a section on setting up PHP to work inside it.   In this conclusion to a six-part series on Apache configuration and installation, you will learn how to use chroot to put Apache in jail, how to prepare PHP to work in jail, and more.    The article is an excerpt from the O'Reilly book "Apache Security" and shows how to get PHP to cooperate by installing it normally and then setting up some shared libraries to be used in the jail. They note one common problem - an issue with PHP accessing sendmail - that can be solved easily with a change to php.ini for the setup.
90388
A distributed multi-protocol load testing tool.
666009
Good-guy sites, like CastleCops.com, are suffering Web site outages from distributed denial-of-service attacks.
542850
A directory reversal within "flat" extensions could lead to system profile attacks.
660571
DevShed is starting up a new series this morning with this new tutorial, part one in the creation of a simple blogging system using PHP and MySQL.   In this three-part tutorial we are going to be creating an open blogging system. We are also going to provide scripts that will make it possible to switch to a closed blogging system. This article, which is the first part, will cover the creation of the login scripts for a closed system.   They start with a definition, the difference between an open blogging system and a closed one (if users have to register or not). They start with the creation of the database to store the users in followed by the PHP code for the simple login page. It uses sessions to keep track of which user is logged in. Of course, where there's a log in, there needs to be a log out and they give the simple code for that. Finally, they include a "forgot your password" script to help users when they can't remember the info they'd signed up with.
481653
I'm back, with a very interesting topic too!  Joel Spolsky, ex-Microsoft Manager and software engineering guru has a new essay, How Microsoft Lost the API War that is creating quite a big storm in the blogging communitiy.  Joel posits that the priests in the holy Temple of Microsoft have lost their way, because it has split into two factions, and the wrong faction is winning. One faction worships on the alter of backward compatibility, while the other is led by fervent priests who are proselytizing to raise up the new gods of .NET and Longhorn. Joel suggests that the new gods will cause the destruction of the holy Temple because Microsoft's great victories were built on the altar of keeping customers happy with backward compatibility. Furthermore the old gods of the Windows API continue to grow more grotesque and cruel with the passing of time, driving former worshipers into the arms of the friendlier gods of World Wide Web.  This story sounds extremely plausible. I must admit that i fit the profile of the developer who used to develop on the Window's API, is familiar with COM and Win32 who now develops mostly using PHP and Python. However I continue to develop and maintain Windows apps that keep our customers happy, and we still plan to develop new Windows apps. Some points:  Temple of the Blind? Firstly, Microsoft is still a compelling place to work for to people who feel that they can make a difference. The Temple continues to attract talented people with a Unix background. For example we have the recent hiring of Ward Cunningham, author of the Wiki.  Microsoft is still able to keep talented people like Raymond Chen, and others like him who continue to look after the Windows API, and Longhorn apparently will still give high priority to backward compatibility. Open sourcerers like Miguel Icaza are sufficiently attracted to the .NET vision to stake their careers on Mono. Longhorn and .NET are compelling technologies, so even if Win32 is not so cute anymore, M'soft is providing something that remains very attractive.  What i do see M'soft doing wrong is that they aren't disseminating the .NET runtime fast enough. It remains an optional install in XP Service Pack 2 for example. Also their IE dev team appears to be hog-tied due to political reasons; nevertheless IE remains good enough, particularly when I can embed IE as an activeX control, something I cannot do with Mozilla (AFAIK) - Update: I'm wrong.  Temple of the Spider?  Secondly, people don't merely use a web browser. They run the web browser in the OS.  So let me ask you, if you are using DreamWeaver or HomeSite or Photoshop or vi or emacs or Gimp, how many of you are willing to give it up for a java applet (or whatever your favorite technology is) running in your web-browser? Precisely.  Temple of the Abandoned?  Third, Joel makes the claim that developers are not developing to the Windows API. Well he could be right. But I bet a lot of them are still calling Win32.  If you are using a framework or IDE like Delphi or wxWindows (or .NET or VB) then you certainly are insulated from the Windows API, but that doesn't mean that you're not calling the Windows API all the time. I don't see Borland dropping their Windows version of Delphi at any point in time.   In fact, the fact that many developers are using some form of framework is a compelling argument for Microsoft to enhance the .NET framework to attract developers who are using other frameworks.  Today, not that many students learn x86 assembler, but that doesn't mean that Intel lost the CPU wars. Just because fewer people are learning Win32 doesn't mean Microsoft has lost the API wars, if the frameworks run predominantly on Win32.  Temple of the Lost  Joel even warns you in the beginning that "because I'm talking about big trends, I need to exaggerate and generalize". But you still get sucked in because Joel Spolsky is a first-class writer, in the same order as Philip Greenspun or Eric Raymond. That makes him so persuasive and plausible. But this is not Indiana Jones and doomed temples, but Steve Jobs and reality distortion fields.  Other opinions:  Harry Fuecks (PHP is ASP's upgrade path),  Dennis Hamilton (M'soft is just covering all bases), Robert McLaws (Joel is wrong in 7 points), Oliver Travers (the web is not good enough), One Run-time to Rule them all....
159077
Try not to smile: A top spammer may be sentenced to hard time.
255902
Now for some real Apache code Column As I write this, I'm on the Eurostar train, just returning from O'Reilly's OSCon (Open Source Conference) in Brussels. Some fascinating insights there; and even my own talk generated some interesting discussion. Some of the delegates, including O'Reilly himself, are promoting opensource ideas going beyond software and into society more generally. I've touched on that in this very column before now, but a related argument that's new to me is that the open/closed debate in software could become largely sidelined, as the industry focuses on software as a service (such as Google's offerings) more than as a product.â¦
690580
On the Dotvoid.com blog today, there's a new post that shares some handy code to parse out information from the incoming user agent string for the visitors for your site.   Recently I experimented a bit with an Apache log file analyzer written in PHP. It's not all that difficult were it not for trying to parse the browser, or user agent, string. [...] For my purposes I don't care much for the operating system details. This is the result so far. I'm still not very satisfied but I thought maybe other people might be interested and maybe help out.   He provides the code in the format of an encapsulated PHP function that returns the product they're using, the version number of the browser and other various comments.
249002
Prepare yourself for "time bomb" exploits that attack web-based systems at a pre-determined time.
202255
OK, we had an extended breather from our last look at BIND's zone file pri.example.org. It's time to finish up and get a sense of what these records mean. To go off-topic a little, recently, I had the task of setting up two OpenLDAP servers and putting together a test environment for a project with several developers and several applications including some LAMP applications. Without a working knowledge of DNS, the project would have gone amuck.
742375
DevShed is moving right along with their series concerning Command objects with this new article showing even more examples of how they're used.   Turning special attention to this second article of the series, I'll develop a few more hands-on examples concerning the pattern in question, thus you can reaffirm the concepts learned in the preceding installment.   They start off by building an array command class to act as a base for the rest of the tutorial. They make two more command classes to point to the commands to be issued (lowercase or reverse a string). Next up is the commanded class to handle the actions themselves. Finally, they plug it all together and show a complete example, including usage.
91596
Padraic Brady has posted a manifesto of sorts about the work that he's been doing on his PHPSpec library and trying to work it into the approval process for the Zend Framework.   I'll be attempting to pound the Zend Framework into submission so I can apply Behaviour-Driven Development (BDD) using PHPSpec when I write a Controller. Why? Because I feel like it, and it gives me an excuse to promote one possible incarnation of PHPMock and the PHPSpec Zend Framework extension. See? Perfectly reasonable selfishness!   He hopes to move it past the typical test-driven development process that PHPUnit offers and "kick your ass into high-TDD gear" without having to have worked much with it before then (the key is simplicity).   He includes some code examples (how it should flow) and describes some of the challenges that he's coming across so far, specifically with the way that the Zend Framework works with the Controllers and what he wants to accomplish.
26905
Plus: Spammers go to jail, and laptops get LED backlights.
300638
SableVM is a robust, extremely portable, efficient, and specifications-compliant Java Virtual Machine that aims to be easy to maintain and to extend. It features a state-of-the-art and efficient interpreter engine. Its source code is very accessible and easy to understand. It also has many robustness features that have been the object of careful design.     SableVM is a clean-room implementation of the publicly available specifications.    In this version, we added an experimental generational garbage collector, we imported a new GNU Classpath snapshot, we added handling of Jar/Zip files on boot classpath, we added user-friendly failure messages for bootstrap problems, we added added a profiling switch, we made sablevm-classpath install its files in standard locations, we made jikes and gcc be less verbose by default, and we made several important bugfixes and improvements.  You can download the SableVM from: http://sourceforge.net/project/showfiles.php?group_id=5523&release_id=281502
558542
Easy-peasy-sleazy: A new piece of PHP code making the malware rounds can install a phishing site on a compromised server in about two minutes.
676591
Ziff Davis - Holes in KOffice and RealPlayer allow attackers to take over a user's system.