Firefox Overzealous… Or Is It?

Posted on by

Man In The Middle is defeated by context. — Bruce Schneier

As has been widely discussed, Firefox 3.0 is a little over-zealous when it encounters an unknown certificate on an SSL website. Where previous versions would just warn the user about the observed irregularities, the new version requires that the user add an exception for every certificate that has an unknown certification chain, is expired or for which the hostname does not match the information in the certificate.

Adding an exception takes four clicks, most met with a stern warning that will deter anyone but the most determined user. Folks who use self-signed certificates as a matter of habit are howling, because they have to tediously make exceptions for all of them. This Firefox features seems over the top, but is it? Continue reading →

Be Sociable, Share!

Security Roadmap for ApacheCon US 2008

Posted on by


ApacheCon US 2008
At the end of my conference presentations, I usually put a Conference Roadmap slide. This slide shows sessions at the conference that are related to mine, and that attendees may find worth while to check out. For my Hardening Enterprise Apache Installations session this coming Thursday, I would suggest the following related conference content:

Besides the training (which happened on Monday), this means that you can pretty much stay in the same room all Thursday and catch all the Security-related talks. In addition, of course, this track will be streamed live for a modest fee, so you can watch from the comfort of your own office if you find yourself unable to make it to ApacheCon this year.

Be Sociable, Share!

SQL Considered Harmful

Posted on by

According to the Web Hacking Incidents Database 2007 Annual Report, SQL Injection is still the most common attack vector for security breaches on websites. Consider the following cartoon:

Why is it that our websites almost universally use a data access language whose statements can be completely subverted by the parameters fed into the queries? The problem is that Continue reading →

Be Sociable, Share!

ApacheCon New Orleans, day 1

Posted on by

Flew into New Orleans late last night for ApacheCon US 2008. The taxi booth at the airport actually has a flat rate posted: $28 for travel to Downtown or the French Quarter. Our cabbie charged us $30, which is close enough. We went for coffee and beignets at Cafe Du Monde, which is part of New Orleans, The Ride. Beignets are like donuts, except with more powdered sugar and slightly undercooked which may not be intentional.

Be Sociable, Share!

ApacheCon Jack-o-Lantern

Posted on by

ApacheCon2008 Pumpkin

Last night we made an ApacheCon US 2008 Jack-o-Lantern! It projects “ApacheCon 2008” on the wall behind it if there is enough light inside: a Mini-Maglite did the trick, with the lens taken off to make for a nice point source and a crisp image.

Meanwhile, I’ve been working on the slide deck for this week’s presentation at the conference. I think it’s shaping up pretty nicely, although I’m going to have to put a ton of content in the handout. There is simply too much to talk about. However, by putting some of the technical details in the paper handout, I can keep the slides themselves cleaner and improve the flow of the story.

ApacheCon2008 Pumpkin

Be Sociable, Share!

ApacheCon US 2008

Posted on by

Registration is now open for ApacheCon US 2008. There will be an Early Bird discount, so register early and Save! The schedule is up and I’m very happy to see the return of the schedule grid that shows the entire conference on one page. J. Aaron has done a great job on the site.

I will be presenting one session at the conference: Hardening Enterprise Apache Installations Against Attacks will discuss security issues with the Apache Web Server and how the developer team reacts to issues as they are found. We’ll also talk about protecting applications that are served by the Apache server and may be the target of attacks that do not subvert the web server itself, but the code behind it.

The first time I did this talk, at AacheCon EU 2008, I ran out of time. There’s so much to talk about! The feedback forms submitted by the attendees did, however, identify some spots I can tighten up, so I’m looking forward to present a new, updated version of the talk this fall.

Hope to see you, first week of November, in New Orleans!


ApacheCon US 2008

Be Sociable, Share!

Sonoma: Cafe La Haye

Posted on by

Cafe La Haye does not need another write-up. However, I have to mention them because we couldn’t remember when last we had a meal out where every course, every dish, was so on the mark.

From the Grilled Peach and Prosciutto Salad to the Hand-Torn Papardelle, to the Angus Hanger Steak you could cut with a fork, everything was delicious. The desserts were simply to die for: the Blackberry and Raspberry Fruit Crisp was a simple concept, but so, so well executed. The Chocolate Silk Cake was in delightful harmony with its pecan and walnut crust and the salt accent does amazing things to bring out the flavors. We were hard pressed to not lick our plates.

Finally, it was all very reasonably priced. If you plan to hit downtown Sonoma, Cafe La Haye comes warmly recommended.

Be Sociable, Share!