The nmap project has, as a technology showcase, created a popularity map of the web. They have taken Alexa traffic data, downloaded the Favicon of each site and made a popularity map of the result.
If you search for temme.net, you find that it is just east of Facebook and just north of Microsoft… and it’s certainly not the smallest possible size. Not bad for a little vanity website!
I need to prepare for my upcoming speaking engagement, so I’m playing around with Ruby on Rails today. Excellent opportunity to learn a new web technology. No, the speaking gig has nothing to do with RoR: this is pure procrastination.
Learned a couple of interesting things:
There is no better way to procrastinate than to go learn something, and there is no better way to put off learning something than to mess around with tools.
I will be speaking next Wednesday at the monthly meeting of SofTECH. The topic will be Security and Open Source Software:
Many software choices are available to professionals who need to run applications in their business. Some of these will be delivered by conventional vendors who have full control over the product and its development. However, over the past decade many Open Source applications have emerged as viable alternatives, developed using an open process by volunteers from many different companies.
Speaking from his experience as an Open Source Software developer, Sander will compare some security aspects of Open Source and Closed Source software, likely debunking some myths along the way. We will examine the security vulnerability mitigation process used by the Apache Software Foundation and discuss how an open development process can provide enhanced security.
See the meeting page for details. An RSVP link is at the bottom of the page.
I don’t spend a lot of time on The Apache HTTP Server Users mailing list, but a discussion sprang up there this week on which I think I should share my response. The issue was why the server in question did not have permission to show a particular file. The initial response was “just chown your document root to the Apache user” and, when pointed out that this introduced security issues,
Oh man an experienced sys admin told me to do it that way. Please tell me what is wrong in this and where is this documented on Apache docs. I want to read.
Here is my response reproduced: read on.
The Apache HTTP Server needs read access to its configuration files and the files it serves. In and of itself, the server does not need write access anywhere on the system: even its log files are opened for write when the server is still root, and the open file descriptors passed to the child processes which change their user id to the lesser privileged user.
Read access only. The web server user should not own, or be able to write to, its configuration files or content.
Content, other than CGI scripts, generally does not need Execute permissions. Even PHP files that are interpreted by the server do not need to be Executable.
Certain applications, especially publishing platforms and Content Management Systems that you manage and populate through the web server itself using a browser, require that certain directories on the system be made writable by the web server user. You can do this by changing the owner of the directory to that user (usually www but ymmv), or by making the directory group-writable and changing the group to the group as which Apache runs.
Making directories writable by the web server should be done only with care and consideration. The usual threat model is that someone manages to upload (for instance) a PHP script of their own making into the document root, and simply executes that by accessing it through a browser. Now someone is executing code on your machine. Google for ‘r57′ for an example of what such code can do.
If a web app needs writable directories, it’s often better to have those outside the DocumentRoot: that way the uploads can’t be accessed from the outside through a direct URL. Some applications (WordPress for instance) support this, others do not.
In many cases, writable directories are not strictly necessary even though the web app might like them: rather than upload plugins (which contain code that gets executed or interpreted, yech!) through the web browser, upload them through ssh and manually unpack them on the server. The CMS Joomla! likes to write its configuration file to the Document Root on initial install (which promptly becomes a popular attack target) but if it can’t write to the Document Root, it will output the config to the browser to the user can manually upload it.
The Apache Documentation will merely tell you to make the server installation root-owned. The HTTP Server Documentation does not cover third party applications like WordPress or Joomla!, so it will not discuss their need to have some directories writable. I hope the above makes the picture a little more complete.
Mark Suster writes The Power of “In Person” — Why Distributed Teams are Less Effective about the importance of in-person communications in an early-stage Startup. I have worked in an office, then been a remote employee (an effective one, I like to think) of two post-scaling companies. I fully agree with Mark’s arguments: the dynamics of in-person communications are hugely important, especially at an early stage when you are defining what your company is actually doing.
The comments Mark attracks also rock: one commenteer states “It’s too hard to move the needle, or even be poked by the needle, if you aren’t in the room.” Well said.
Insightful cover story by Intel founder Andy Grove in Business week: How America can Create Jobs. America needs Industry jobs: I agree with Grove’s statement that letting go of technologies to be manufactured elsewhere puts the country in a knowledge hole. We can’t all be knowledge workers, and not all people in the country (any country, not limited to the USA) do will be designing the next great technology only to then hand it off to other geographic regions to be manufactured. Especially seen in the light of something like this TechCrunch post: if the US doesn’t make the product, there will be less of a need to develop it there. One can go elsewhere with lower taxes, better healthcare and fine education.
Grove’s solution, a tax on products created with foreign labor, should raise some hackles. Taxes are bad, right? However, if not for government intervention, I don’t think anything can change. Corporations can’t be expected to change their ways for the greater good: their job is to do business and maximize profits. Only the government can steer their behavior by turning the greater good into a business decision. And, unfortunately, taxes are the main instrument at their disposal to do so.
ApacheCon North America 2010 will be held 1-5 November 2010, at the Westin Peachtree in Atlanta, Georgia, USA.
The official conference, trainings and expo of the Apache Software Foundation (ASF) will run to Atlanta this November, with dozens of sessions on Servers, Cloud Computing, Search NoSQL, Incubating projects, innovations, emerging technologies, and more.
ApacheCon would not be complete without a track dedicated to the project that started it all, the Apache HTTP Server. The Project Management Committee (PMC) are currently planning our own technical track for ApacheCon. We are solliciting 50-minute presentations for our conference track, to fill one day at the conference.
Topics of interest include:
Submissions are open to anyone with relevant expertise: ASF affiliation is not required to present at, attend, or otherwise participate in ApacheCon.
Please keep in mind that whilst we are encourage submissions that the highlight the use of specific Apache solutions, we are unable to accept marketing/commercially-oriented presentations.
All accepted speakers (not co-presenters) qualify for general conference admission and a minimum of two nights lodging at the conference hotel. Additional hotel nights and travel assistance are possible, depending on the number of presentations given and type of assistance needed.
To submit a presentation proposal, please edit the Wiki page and add your proposal, including:
You will find an empty table template at the bottom of the page. Please copy this and fill it in.
Please mail any quesions regarding proposal submissions to pmc at httpd.apache.org.
To be considered, proposals must be received by Sunday, April 4nd, 2010, at 23:59:59 Pacific Time. Following this time, the PMC will hold a vote and suggest the most interesting proposals to the ApacheCon Planning Committee for acceptance to the conference. Note that the Apache HTTP Server PMC does not itself accept session proposals: it merely makes recommendations to the Planning Committee.
Key Dates:
April 4, 2010: Call for Participation closes
May 17, 2010: Speaker Acceptance/Rejection notification
November 1-5, 2010: ApacheCon NA 2010
We look forward to seeing you in Atlanta!
Wall Street Journal columnist Gary Hamel wrote a while ago about The Hole in the Soul of Business. He correlates the lack of passion many employees of big companies have for their jobs to the sterile language in their published goals and values.
I think the problem at hand is that, during the lifecycle of any company, a shift must take place where the commitment to product quality and customer satisfaction becomes no longer the emotional product of a few passionate individuals, but becomes part of the fabric of the corporation. This means that process and procedure takes over from actual people who may care about customers.
Said process and procedures bring with them the danger that individuals within the company become disempowered and demotivated. Sadly, it is the only way to scale an operation beyond a few individuals: process and procedures must be put in place to ensure customers have a consistent experience. You can’t put the burden on what few employees you have that happen to be the driven customer satisfaction rock stars. They will burn out and leave, and expose the rotten structure underneath.
There is a fine line between empowering and disempowering your employees. If you do it right, employees remain involved, passionate and motivated. If you do it wrong, the customer experience will be consistent, but it will be crappy. Taken to its logical extreme, the only continuing contribution your employees will make to morale is to post Dilbert cartoons on their cubicles.
The BBC discusses a man-in-the-middle attack on EMV payment cards, also known as Chip-and-PIN. The attack was developed by a team at Cambridge University in the UK. Using a real card wired up to a laptop, connected to a fake card that is inserted in the POS terminal, this attack can authorize payments with an arbitrary PIN.
I am not sufficiently familiar with the cryptography in use for the EMV protocol, but my first thought is that astute observation by POS personnel should provide substantial defense against this entire class of attack: if someone shows up at your cash register with an EMV card wired to his backpack, something fishy is probably afoot.
My other thought has to do with the notion that banks might attempt to shift the responsibility for fraudulent Chip-and-PIN transaction to the consumer. “Since EMV is so secure,” the reasoning goes, “the PIN authorization is proof positive that the transaction is valid.” Except it has now been shown that PIN authorization can be spoofed.
Security is not black and white: it does not make fraud impossible, but makes it harder and more expensive to commit fraud. The protection level provided by a security feature should be commensurate to the value of the transaction it protects. Too high a protection level is likely to be more cumbersome, or more expensive, than the transaction in question justifies.
Powered by WordPress
