Sander's Weblog » ApacheCon

ApacheCon NA 2010 HTTP Server Track Call for Participation

Sander — Mon, 22 Mar 2010 14:42:43 +0000

ApacheCon North America 2010 will be held 1-5 November 2010, at the Westin Peachtree in Atlanta, Georgia, USA.

The official conference, trainings and expo of the Apache Software Foundation (ASF) will run to Atlanta this November, with dozens of sessions on Servers, Cloud Computing, Search NoSQL, Incubating projects, innovations, emerging technologies, and more.

ApacheCon would not be complete without a track dedicated to the project that started it all, the Apache HTTP Server. The Project Management Committee (PMC) are currently planning our own technical track for ApacheCon. We are solliciting 50-minute presentations for our conference track, to fill one day at the conference.

Topics of interest include:

Case studies on deployment of the Apache HTTP Server within your organization
How-to sessions on working with certain aspects of the Apache HTTP Server technology
What’s New? sessions on new features of recent and upcoming versions of the Apache HTTP Server
Sessions discussing third-party extensions to the Apache HTTP Server
Security topics surrounding the Apache HTTP Server
Performance and scalability of Apache HTTP Server deployment
Cool things we all should know the Apache HTTP Server can do
How you solved particularly gnarly problems deploying the Apache HTTP Server

Submissions are open to anyone with relevant expertise: ASF affiliation is not required to present at, attend, or otherwise participate in ApacheCon.

Please keep in mind that whilst we are encourage submissions that the highlight the use of specific Apache solutions, we are unable to accept marketing/commercially-oriented presentations.

All accepted speakers (not co-presenters) qualify for general conference admission and a minimum of two nights lodging at the conference hotel. Additional hotel nights and travel assistance are possible, depending on the number of presentations given and type of assistance needed.

To submit a presentation proposal, please edit the Wiki page and add your proposal, including:

Your full name, title and organization
Contact information, including your e-mail address. Feel free to obfuscate if you think that this will make a difference in your SPAM load
The name of your proposed session (keep your title simple and relevant to the topic)
A 75-200 word overview of your presentation
A 100-200 word speaker bio that includes prior conference speaking or related experience

You will find an empty table template at the bottom of the page. Please copy this and fill it in.

Please mail any quesions regarding proposal submissions to pmc at httpd.apache.org.

To be considered, proposals must be received by Sunday, April 4nd, 2010, at 23:59:59 Pacific Time. Following this time, the PMC will hold a vote and suggest the most interesting proposals to the ApacheCon Planning Committee for acceptance to the conference. Note that the Apache HTTP Server PMC does not itself accept session proposals: it merely makes recommendations to the Planning Committee.

Key Dates:

April 4, 2010: Call for Participation closes
May 17, 2010: Speaker Acceptance/Rejection notification
November 1-5, 2010: ApacheCon NA 2010

We look forward to seeing you in Atlanta!

Share this post:

ApacheCon US 2009 PGP Keysigning

Sander — Wed, 04 Nov 2009 20:38:40 +0000

We’ll be doing a PGP Keysigning Session at ApacheCon. If you would like to participate, check out http://wiki.apache.org/apachecon/PgpKeySigning and make sure to mail me your public key before the end of today, Wednesday.

Share this post:

My ApacheCon US 2009 Wishlist

Sander — Tue, 03 Nov 2009 20:07:14 +0000

Get Apache HTTP Server building again on Gump (which involves losing the dependency on the Apache Portable Runtime Utility library, which was folded into APR proper)
Get @pgollucci what he needs on clarus.apache.org, and work on the future of that box
Talk about Apache 2.4, and what is still needed to get that out the door. Then, maybe start talking about figuring out what 3.0 is going to be like
Prepare for the Keysigning — which may mean creating a new PGP key
Prepare for my presentation on Thursday
Do some httpd hacking. Perhaps pull in the ECC patch that has been sitting in Bugzilla

Web Hacking Incident Database Report

Sander — Wed, 19 Aug 2009 04:12:32 +0000

The The Web Hacking Incidents Database 2009: Bi-Annual Report is out. If I recall correctly, the first report Breach did, in 2007, did not mention any bi-annualness. Also, the eventual landing page has as HTML title “The Web Hacking Incidents Database 2008: Annual Report”. Is it possible that they simply didn’t get their act together last year and retroactively declared the report bi-annual?

I went in through the link above, gave up my e-mail, phone number and name of my first born, and downloaded the report. This will probably land me another copy of every marketing e-mail Breach sends out (guess how I learned of this report?), and a phone call from some poor guy in a cube who has to make 75 phone calls a day for a living. Oops, guess I put down a fax number. Sorry dude, hope your headset isn’t too loud.

Anyway, after you go though the lead generation form you land here and can follow a direct link to the PDF. This is fairly standard practice, but from a security company I would expect that they would make some more effort to not inadvertedly expose the goods.

I will give this report a read, and probably discuss it in my upcoming talk at ApacheCon US 2009. Oh, they just extended the early bird registration deadline… without changing their own website to tell you about it. Register now and experience the mayhem.

Share this post:

Hardening Apache Presentation Book List

Sander — Wed, 19 Nov 2008 03:04:34 +0000

At the end of my Hardening Enterprise Apache Installations Against Attacks presentation at ApacheCon US 2008 I had a slide of interesting reading material. Here are the books on the list, and links to some of the articles:

I also included links to some interesting articles and organizations. Most of these were visited early November 2008:

The Apache HTTP Server Security Report
The Center for Internet Security who publish benchmarks for web server and operating system security
The Open Web Application Security Foundation concentrates on developing secure web application code
The Web Application Security Consortium
The National Institute for Standards and Technology (NIST) published a checklist for securing internet-facing web servers

Share this post:

Security Roadmap for ApacheCon US 2008

Sander — Wed, 05 Nov 2008 16:13:20 +0000

At the end of my conference presentations, I usually put a Conference Roadmap slide. This slide shows sessions at the conference that are related to mine, and that attendees may find worth while to check out. For my Hardening Enterprise Apache Installations session this coming Thursday, I would suggest the following related conference content:

Training: Web Application Security Bootcamp by Christian Wenz
Thursday, 9AM: Hardening Enterprise Apache Installations Against Attacks by yours truly
Thursday, 10AM: Web Intrusion Detection with ModSecurity by Ivan Ristic
Thursday, 2PM: (In)secure Ajax and Web 2.0 Web Sites by Christian Wenz
Thursday, 3PM: Geronimo Security, now and in the future by David Jencks
Thursday, 4:30PM: Securing Apache Tomcat for your Environment by Mark Thomas
Thursday, 5:30PM: Securing Communications with your Apache HTTP Server by Lars Eilebrecht

Besides the training (which happened on Monday), this means that you can pretty much stay in the same room all Thursday and catch all the Security-related talks. In addition, of course, this track will be streamed live for a modest fee, so you can watch from the comfort of your own office if you find yourself unable to make it to ApacheCon this year.

Share this post:

Celebrating Obama Victory

Sander — Wed, 05 Nov 2008 07:02:03 +0000

This is the Next Generation Brass Band in New Orleans, celebrating Barack Obama’s presidential election victory on the corner of Bourbon Street in New Orleans.

This was more fun than all the Bourbon Street craziness combined.

Share this post:

SQL Considered Harmful

Sander — Tue, 04 Nov 2008 18:13:45 +0000

According to the Web Hacking Incidents Database 2007 Annual Report, SQL Injection is still the most common attack vector for security breaches on websites. Consider the following cartoon:

Why is it that our websites almost universally use a data access language whose statements can be completely subverted by the parameters fed into the queries? The problem is that web applications compose queries out of text strings concatenated with the input fed in by the client. The result is a SQL query that is sent, as a text string, to the SQL server and executed. Any input from the client that constitutes valid SQL fragment will be incorporated into the query, and can be used to wreak havoc with the database just like little Bobby Tables just did.

The main line of defense against this attack is to validate anything the client sends to a web application, and to strip out any SQL fragments that may be in there. This is of course an arms race: any validation attempt is met with new attempt to defeat the validation, ad infinitum. What we need is a new paradigm for querying databases from web applications: query parameters should never be treated as part of the query definition, but become opaque entities that are passed to the database engine as-is. The result of the above should be noting else than Bobby bringing home a report card that says “Robert'); DROP TABLE Students;--” across the top.

Oh, and what business has the web application dropping tables anyway? Why does its user have that privilege?

Share this post:

ApacheCon New Orleans, day 1

Sander — Mon, 03 Nov 2008 18:38:37 +0000

Flew into New Orleans late last night for ApacheCon US 2008. The taxi booth at the airport actually has a flat rate posted: $28 for travel to Downtown or the French Quarter. Our cabbie charged us $30, which is close enough. We went for coffee and beignets at Cafe Du Monde, which is part of New Orleans, The Ride. Beignets are like donuts, except with more powdered sugar and slightly undercooked which may not be intentional.

Share this post:

ApacheCon Jack-o-Lantern

Sander — Sat, 01 Nov 2008 22:19:16 +0000

Last night we made an ApacheCon US 2008 Jack-o-Lantern! It projects “ApacheCon 2008” on the wall behind it if there is enough light inside: a Mini-Maglite did the trick, with the lens taken off to make for a nice point source and a crisp image.

Meanwhile, I’ve been working on the slide deck for this week’s presentation at the conference. I think it’s shaping up pretty nicely, although I’m going to have to put a ton of content in the handout. There is simply too much to talk about. However, by putting some of the technical details in the paper handout, I can keep the slides themselves cleaner and improve the flow of the story.

Share this post: