Date: 01/13/06 (Security)    Keywords: security

Passengers will test biometric passports in airports worldwide under a Department of Homeland Security test.

Source: http://news.zdnet.com/2100-1009_22-6027090.html

Date: 01/17/06 (PHP Community)    Keywords: security

Greetings.

I've been using $_REQUEST for a few years now instead of $_GET or $_POST. I have yet to find any sort of decent reasoning as to why we should be using one or the other.

Are there any potential security benefits or risks with using $_REQUEST instead?

Source: http://www.livejournal.com/community/php/396705.html

Date: 01/18/06 (Security)    Keywords: software, database, security

Scheduled batch of patches plugs a large number of security holes in many products, including its database and app server software.

Source: http://news.zdnet.com/2100-1009_22-6027847.html

Date: 01/18/06 (Security)    Keywords: security, microsoft

Microsoft confirms a Wi-Fi security flaw in Windows XP, but the wait for a fix may be as long as 18 months.

Source: http://news.zdnet.com/2100-1009_22-6028275.html

Date: 10/10/05 (IT Professionals)    Keywords: security, microsoft

Hi,

As you may know, MSN requires upnp for video chat/voice chat to happen, I'm currently using borderware, almost all (heck, maybe all) eal4+ certified firewalls do not support upnp because its a security loophole.

however, the alternative being to open the entire udp 5004-65535 range according to microsoft's documentation...

does anyone have any suggestions?

either an alternative video conferencing tool or a solution to the firewall problem?

Source: http://community.livejournal.com/itprofessionals/25519.html

Date: 01/03/06 (C Sharp)    Keywords: html, asp, security, web

Heya all, I'm working on a web-based application (using ASP.NET and C# on .NET 1.1.4322, supporting only IE6 for Windows) that allows for file uploads. It seems to be a universally agreed that the file upload control is as ugly as they come, so I want to set its style to "display: none;" and interact only with the standard file upload dialog (which can be summoned by firing the click() method of the control, which is exposed under IE6 but not recent versions of Mozilla).

Attempting programmatic access of a file upload control is generally playing with fire, and this time is apparently no exception. Once I call the click() method, it seems, the page is no longer able to post back. When I attempt to submit the form, the value of the file upload control is cleared and the page just sits there. However, if I make the file upload control visible and manually click its "Browse..." button, the page posts back correctly.

For those of you familiar with Gmail's attachment upload interface, this is very close to the effect I am trying to achieve, but something about ASP.NET is apparently interfering (perhaps for my own protection) with the process. Has anybody experienced similar behavior under the same platform, and if so, explain the behavior or point to a KB article or security documentation that might be enlightening ? Thanks greatly for your time. Toy code can be found after the cut.



Codeahead:

<%@ Page language="c#" Codebehind="Foo.aspx.cs" AutoEventWireup="false" Inherits="FooApp.Foo" %>

















 




Postback info:
 

using System;
using System.Collections;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Web;
using System.Web.SessionState;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Web.UI.HtmlControls;

namespace FooApp
{
	public class Foo : System.Web.UI.Page
	{
		protected HtmlInputFile f;
		protected HtmlGenericControl s;

		private void Page_Load(object sender, System.EventArgs e)
		{
			if (this.IsPostBack)
			{
				s.InnerText = String.Format("{0} file(s) posted", Request.Files.Count);
				if (1 == Request.Files.Count) { s.InnerText += String.Format(", content length: {0}", Request.Files[0].ContentLength); }
			}
		}

		override protected void OnInit(EventArgs e)
		{
			InitializeComponent();
			base.OnInit(e);
		}
	
		private void InitializeComponent()
		{    
			this.Load += new System.EventHandler(this.Page_Load);
		}
	}
}

Source: http://community.livejournal.com/csharp/45787.html

Date: 12/27/05 (C Sharp)    Keywords: security, microsoft

This is a long post about one problem I have with Microsoft Report Viewer reports for .NET 2.0. Please don't skip it :)

ok, I have a simple windows form with report viewer control placed on it. The datasource for my reports is an object described in a class. Most of the fields are pretty simple like:

public string ObjectOperationType
  {
   get
   {
    return ent.Offer.OfferType.ToString();
   }
  }

where "ent" is a business object the application uses.

Some fields, though, are bit more complex and return List<> of things, like:

public List ObjectCloseLocations()
  {
   List items = new List();
   foreach (DirectoryEntry de in ent.Attributes[31].AvailableItemsList)
   {
    if (((ListDirectoryEntries)ent.Attributes[31]).Contains(de))
    {
     items.Add(new CloseLocations(de.Term, true));
    }
    else
    {
     items.Add(new CloseLocations(de.Term, false));
    }
   }
   return items;
  }

The CloseLocations type is a class with two public fields (Key and Value) that are filled by my method and then passed into the report as a list and the report will show the list in a table quite happily.

It all works fine, as long as you don't have to include the ListsTypes() on your reports.

Originally, the code to get the proper BindingSource running looked like this:

ViewObject MyData = new ViewObject(vid, HidePD);
   this.ViewObjectBindingSource.DataSource = MyData;
   this.comfortAndSecurityBindingSource.DataSource = MyData.ObjectComfortAndSecurity();
   this.closeLocationsBindingSource.DataSource = MyData.ObjectCloseLocations();
   this.propPhotoBindingSource.DataSource = MyData.PropertyImages();
   reportViewer1.RefreshReport();

Now, when I pass List to my primary BindingSource, the other binding sources have to be List<> or List types.

I tried this:

List myData = new List();
... fill the list...
List> comfort = new List>();
foreach(ViewObject vo in mydata)
{
comfort.Add(vo.Comfort());
}
this.comfortAndSecurityBindingSource.DataSource = comfort();

the problem now is that the comfort List<> is not "bount" to it's parent object that shall be getting data from it. How can I fix this?

Has anyone dealed with this?

Source: http://community.livejournal.com/csharp/44980.html

Date: 09/27/05 (Opera Browser)    Keywords: security

Opera 8.x
Advisories: 8
Highest Criticality: Moderate
Impact: Spoofing, Cross Site Scripting, Security Bypass.
Status: 100% patched

Firefox 1.x
Advisories: 24
Highest Criticality: Extreme
Impact: System access, DoS, Privilege escalation, Exposure sensitive info, Exposure system info, Manipulation of data, Spoofing, Cross Site Scripting, Security bypass, Hijacking.
Status: 83% patched

Internet Explorer 6.x
Advisories: 86
Highest Criticality: Extreme
Impact: System access, DoS, Exposure sensitive info, Exposure system info, Manipulation of data, Spoofing, Cross Site Scripting, Security bypass, Hijacking.
Status: 56% patched

Source: http://community.livejournal.com/opera_browser/44591.html

Date: 10/29/05 (PHP Development)    Keywords: php, security, web

i have a case where i'm trying to provide some unsubscribe functionality via a link to a website in an email. i need to encode some information in the url, specifically a user id and a list so i know who they are and which list they are unsubscribing to. Security is of course important, I don't want anyone to be able to just submit with random user ids and lists so i need to encode it with some sort of obfuscation, but also with a checksum or something that would prevent tampering or at least let me know.

Anyone have any experience with this or ideas? ideally, i'd like to use something readily available in PHP (and also perl if possible since the encrypting part will happen in perl, but presumably i could port easily enough). maybe like generate a url string, such as "user_id=x&list=y", base64 encode it (which also shrinks it and is a plus) and then add a crc byte on the end? then my url would be http://www.example.com/file.php?hash="gobbledygook"

does anyone know of something in PHP that would do this? if not any suggestions for rolling your own (like algorithms, i don't need actual code probably unless you either have it, know of it on a free site, or really feel like writing it ;-) ) maybe using compression utils with a password? that would i think require recompiling php or using external programs which is doable, but not as desireable. plus if someone guessed the password, they could decrypt, but i suppose that is true for any algorithm that's one way. perhaps using ssl or pgp somehow? having 2 keys, then no one could decrypt it without the private key? that might be overkill. or mhash for hashing, but then might that be easy to crack and can it be computed in perl?

xposted to php

Source: http://community.livejournal.com/php_dev/61842.html

Date: 06/07/05 (PHP Development)    Keywords: php, mysql, software, html, xml, database, asp, sql, security, web, apache

Here's what I have
Apache 1.3.33
PHP 5.0.4
MySQL 4.1.12a
Operating System: Windows 98

The error that I got when I tried using mysql_connect() on a php page:

Fatal error: Call to undefined function mysql_connect()

Things that I have done so far:
Apache, mySQL, and PHP are in directories on the C drive, named accordingly

in php.ini, this is what I changed (change in italics)
doc_root = "C:\Apache\htdocs"
extension_dir "C:\php\ext"

Removed the ";" in front of extension = php_mysql.dll (Is there supposed to be quotation marks on this line?)

Saved a copy of php.ini (after these changes) in the C:\Windows directory
Saved copies of c:\php\libmysql.dll & c:\php\ext\php_mysql.dll to the C:\Windows directory


--------------
What else am I missing?


PHP Version 5.0.4

System Windows 9x JESSICA 4.10
Build Date Mar 31 2005 02:44:34
Configure Command cscript /nologo configure.js "--enable-snapshot-build" "--with-gd=shared"
Server API Apache
Virtual Directory Support enabled
Configuration File (php.ini) Path no value
PHP API 20031224
PHP Extension 20041030
Zend Extension 220040412
Debug Build no
Thread Safety enabled
IPv6 Support enabled
Registered PHP Streams php, file, http, ftp, compress.zlib
Registered Stream Socket Transports tcp, udp

This program makes use of the Zend Scripting Language Engine:
Zend Engine v2.0.4-dev, Copyright (c) 1998-2004 Zend Technologies



--------------------------------------------------------------------------------

PHP Credits

--------------------------------------------------------------------------------

Configuration
PHP Core
Directive Local Value Master Value
allow_call_time_pass_reference On On
allow_url_fopen On On
always_populate_raw_post_data Off Off
arg_separator.input & &
arg_separator.output & &
asp_tags Off Off
auto_append_file no value no value
auto_globals_jit On On
auto_prepend_file no value no value
browscap no value no value
default_charset no value no value
default_mimetype text/html text/html
define_syslog_variables Off Off
disable_classes no value no value
disable_functions no value no value
display_errors On On
display_startup_errors Off Off
doc_root no value no value
docref_ext no value no value
docref_root no value no value
enable_dl On On
error_append_string no value no value
error_log no value no value
error_prepend_string no value no value
error_reporting no value no value
expose_php On On
extension_dir C:\php5 C:\php5
file_uploads On On
highlight.bg #FFFFFF #FFFFFF
highlight.comment #FF8000 #FF8000
highlight.default #0000BB #0000BB
highlight.html #000000 #000000
highlight.keyword #007700 #007700
highlight.string #DD0000 #DD0000
html_errors On On
ignore_repeated_errors Off Off
ignore_repeated_source Off Off
ignore_user_abort Off Off
implicit_flush Off Off
include_path .;C:\php5\pear .;C:\php5\pear
log_errors Off Off
log_errors_max_len 1024 1024
magic_quotes_gpc On On
magic_quotes_runtime Off Off
magic_quotes_sybase Off Off
mail.force_extra_parameters no value no value
max_execution_time 30 30
max_input_time -1 -1
open_basedir no value no value
output_buffering 0 0
output_handler no value no value
post_max_size 8M 8M
precision 14 14
register_argc_argv On On
register_globals Off Off
register_long_arrays On On
report_memleaks On On
report_zend_debug On On
safe_mode Off Off
safe_mode_exec_dir no value no value
safe_mode_gid Off Off
safe_mode_include_dir no value no value
sendmail_from no value no value
sendmail_path no value no value
serialize_precision 100 100
short_open_tag On On
SMTP localhost localhost
smtp_port 25 25
sql.safe_mode Off Off
track_errors Off Off
unserialize_callback_func no value no value
upload_max_filesize 2M 2M
upload_tmp_dir no value no value
user_dir no value no value
variables_order EGPCS EGPCS
xmlrpc_error_number 0 0
xmlrpc_errors Off Off
y2k_compliance On On
zend.ze1_compatibility_mode Off Off


apache
Apache for Windows 95/NT

Apache Version Apache/1.3.33 (Win32) PHP/5.0.4
Apache Release 10329100
Apache API Version 19990320
Hostname:Port localhost:80
Timeouts Connection: 300 - Keep-Alive: 15

Directive Local Value Master Value
child_terminate 0 0
engine 1 1
last_modified 0 0
xbithack 0 0


Apache Environment
Variable Value
COMSPEC C:\WINDOWS\COMMAND.COM
DOCUMENT_ROOT c:/apache/htdocs
HTTP________________ ----- -------
HTTP_ACCEPT image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, application/x-shockwave-flash, */*
HTTP_ACCEPT_LANGUAGE en-us
HTTP_CONNECTION Keep-Alive
HTTP_HOST localhost
HTTP_USER_AGENT Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)
PATH C:\WINDOWS;c:\windows;c:\windows\COMMAND
PHPRC C:/php
REMOTE_ADDR 127.0.0.1
REMOTE_PORT 2477
SCRIPT_FILENAME c:/apache/htdocs/phptest.php
SERVER_ADDR 127.0.0.1
SERVER_ADMIN jessica.karels@gmail.com
SERVER_NAME localhost
SERVER_PORT 80
SERVER_SIGNATURE

Date: 11/18/05 (SQL Server)    Keywords: database, sql, security, google

Source: http://community.livejournal.com/sqlserver/37213.html

Date: 01/06/06 (Computer Help)    Keywords: html, security, ebay

I run: windows 98 SE, IE 6.0

For some reason, just today, when I log into sites, I can't STAY logged in, and I get annoying security certifcate prompts everytime I go to ebay and gmail ..

I can't access the 'standard' view of gmail, and the 'html' version of gmail wont let me delete messages.

I looked in my internet options >> advanced tab, and 'warn about invalid site certifates' is UNCHECKED, (I never had it checked in the first place, nor did I change any security settings to make it this way, so I have no idea what is going on.)

I cleared ALL cookies, my cache, my temp internet files, ran hijackthis, and spybot, and nothing showed any problems or fixed anything.

wtf is going on?

thanks alot for your help.

Source: http://community.livejournal.com/computer_help/561595.html

Date: 06/22/05 (Software)    Keywords: php, mysql, sql, security, web, linux, yahoo

I have a group of users (100 or so) that need read/write access to a document (excel) of sensitive information. Since they are all over the place, they requested a web application to be able to access from anywhere whenever they need to modify or look at this document. I'm trying to figure out what is the best way to provide a secure way to only allow these specific users to access this document.
ideas have included:

Plone - complex, looking for simplicity
phpBB - requires me to set up a mysql linux box somewhere which might be possible
Yahoo groups - not very secure but basically what i want

any other ideas? Security of this information is the biggest priority. i currently have both linux/windows available to host.

Source: http://community.livejournal.com/software/54525.html

Date: 01/13/06 (Computer Geeks)    Keywords: asp, security, ebay

So here is the deal. I was selling this laptop on ebay. Retails about $850. So I get an email in ebay from this guy say he needs it right away and it for his son, blah blah blah. I will pay you $4,000 if you can ship it to me right away and if we can do the transaction through western union. So here is the emails. Just be careful, I am very security minded and almost fell for it. If it wasn't for my distrust in most things, I wouldn't of call western union and found out it was fake.


From: "ade taiwo" | Block Address | Add to Contacts

To: lordsaibat

Date: 11 Jan 2006, 05:55:09 AM
Subject: Congratulations Your Payment Is In Progress !!!


--------------------------------------------------------------------------------

Dear Seller,

This is to inform you that your payment has been made and is currently under
processing, I am very sure you are in receipt of the notification of my payment
from Western Union.

Anyway, I want the package to be shipped out as soon as you received the
approval of your money order from Western Union so that my Son can be able
meet up with the need for this package .

Kindly get back to me with the shipment tracking number immediately you
shipped my package.

I WANT THIS PACKAGE TO BE SHIPPED AS SOON AS THE PAYMENT APPROVED FROM Western
Union AND SHIPPED IT THROUGH Global Express mail 3-5days USPS POST ONLY PLS.

I will be looking forward to hearing from you soonest because the Package is
urgently needed.

Regards,
Ade

--
_______________________________________________
Get your free email from http://fastermail.com


From: "Western Union Transfer" | Block Address | Add to Contacts

To: lordsaibat@gawab.com

Date: 11 Jan 2006, 05:54:36 AM
Subject: MONEY ORDER PENDING (7650980937)***DO NOT REPLY***


--------------------------------------------------------------------------------

==========================================================================================================
==========================================================================================================
THIS IS AN AUTOMATED MESSAGE, PLEASE DO NOT REPLY
==========================================================================================================
==========================================================================================================
*AUCTION PAYMENT NOTIFICATION*

Western Union ® Order Number: 7650980937

Dear Tobias Mccurry,

This is to notify you that Western Union® Accounts Payments has
received an order placed by Mr.Ade Tawio, of your auction item to
have a Western Union® branded Money OrderSM sent to you as
payment for the auction item. The order is currently being processed.

The details of the transaction are stated below:
----------------------------------------------------------------------------------------------------
*AUCTION DETAILS*
AUCTION SITE : Ebay Inc.
AUCTION ITEM : HP PAVILION Laptop
----------------------------------------------------------------------------------------------------
*FINANCIAL DETAILS*
----------------------------------------
AUCTION AMOUNT : $ 3,800.00
SHIPPING AMOUNT : $ 200.00
----------------------------------------
TOTAL : $ 4,000.00
----------------------------------------
Once the order is processed successfully, you will receive another
email from Western Union ® informing you that the money order has been
approved.The Money OrderSM will be delivered to the address below,
Please verify that the name and address (As entered by the buyer)are
correct:
-------------------------------------------------------------------------------------------------------
NAME : Tobias Mccurry
ADDRESS : 7101 C Mcnickle
CITY : TAFB
STATE : Ok
POST CODE : 73145
COUNTRY : USA
EMAIL : lordsaibat@gawab.com
-------------------------------------------------------------------------------------------------------
Seller Should Not ship until you recieve another email
informing you that your money order has been APPROVED, also seller
must ship the item upon receipt of the confirmation email that your
money order has been APPROVED in other not to delay your money
order from being shipped to the designated address provided by the
buyer.

Seller must ship the item to the buyer when the money order has been
approved and send the tracking number to our agent email
address:(helpdesks@consultant.com) DO NOT forget to include
Order number,your full name and address.
--------------------------------------------------------------------------------------------------------
PLEASE NOTE: This is only a notification informing you that the
buyer Has made payment to Western Union®, The payment is currently being
processed and is regarded as PENDING as it is still subject to APPROVAL
after being successfully processed.Western Union® hereby advises
you NOT to ship the item until you have received another message from
Western Union® stating that, the order has been APPROVED.Please
exercise some patience as the process usually approved within 1 to 24 hours.
--------------------------------------------------------------------------------------------------------
Thank you for using Western Union® Accounts Payments. We look
forward to serving your online auction payment needs better in the
future.

Western Union Team,
Accounts Payments.

=============================================================================================================
THIS IS AN AUTOMATED MESSAGE, PLEASE DO NOT REPLY
=============================================================================================================


From: "Western Union Transfer" | Block Address | Add to Contacts

To: lordsaibat@gawab.com

Date: 11 Jan 2006, 01:09:31 PM
Subject: MONEY ORDER HAS BEEN APPROVED***(7650980937)***DO NOT REPLY


--------------------------------------------------------------------------------

==========================================================================================================
==========================================================================================================
THIS IS AN AUTOMATED MESSAGE, PLEASE DO NOT REPLY
==========================================================================================================
==========================================================================================================
*AUCTION PAYMENT NOTIFICATION*

Western Union® Order Number: 7650980937


Dear Tobias Mccurry,


Congratulations! The order placed by Mr.Ade Tawio, of your auction
item to have a Western Union Accounts® branded Money OrderSM
sent to you as payment for the item has been successfully processed
and has consequently been APPROVED. The financial details of the
transaction are stated below:
---------------------------------------------------------------------------------------
*FINANCIAL DETAILS*
----------------------------------------
AUCTION AMOUNT : $ 3,800.00
SHIPPING AMOUNT : $ 200.00
----------------------------------------
TOTAL : $ 4,000.00
----------------------------------------
--------------------------------------------------------------------
***PLEASE NOTE***
The Money OrderSM will be delivered to the address below, Please verify
if the name and address (As entered by the buyer)are correct:
-----------------------------------------------------------------------------------------------------------------------------
NAME : Tobias Mccurry
ADDRESS : 7101 C Mcnickle
CITY : TAFB
STATE : Ok
POST CODE : 73145
COUNTRY : USA
EMAIL : lordsaibat@gawab.com
-----------------------------------------------------------------------------------------------------------------------------
***ATTENTION**
The order has been APPROVED, you CAN NOW ship the Item to the buyer
shipping address. You are expected to make the shipment within 48 hours
of receiving this Payment Approval Notification.
This is the buyer shipping information:
-----------------------------------------------------------------------------------------------------------------------------
Name : Mr. Ade Tawio
Address : 40 queen cinema street
City : IBADAN
State : OYO STATE
Zip : 20001
Country : NIGERIA
-----------------------------------------------------------------------------------------------------------------------------
If the buyer has requested that the item be sent to any address other
than the one provided above, please ship the item OUT and notify us
immediately. Go to http://www.Westernunion.com
Be sure to include the Western Union Accounts Payments order number and the
change of address the buyer has requested. Also, include the change of
address as the subject of your mail.
-----------------------------------------------------------------------------------------------------------------------------
***PLEASE NOTE***
The Money OrderSM will NOT be dispatched until shipment has been
verified. This measure is taken in order to protect both seller and
buyer interests and to reduce the occurrence of fraudulent activities.
-----------------------------------------------------------------------------------------------------------------------------
*SHIPMENT VERIFICATION*
You can have the shipment confirmed/verified in any of the following
ways:

1. Shipment should be made to the buyer and the TRACKING NUMBER of the
shipment should be sent to our agent email address :
helpdesks@consultant.com
Once the verification of shipment is confirmed, you will be notified
and your money order will be shipped out to your designated address
immediately.

2. Your money order will be delayed until you send the SHIPMENT
TRACKING NUMBER of the item been shipped to our agent as a Confirmation.

3. Your money order will be shipped out immediately you send the
shipment notification to our agent.
PLEASE ON NO ACCOUNT MUST YOU ALLOW THE BUYER GAIN ACCESS TO THIS MAIL.

Thanks for using Western Union. Looking forward to serve your
future Online needs.

Western Union Team,
Accounts Payments.

=============================================================================================================
THIS IS AN AUTOMATED MESSAGE, PLEASE DO NOT REPLY
=============================================================================================================

Source: http://community.livejournal.com/computergeeks/859697.html

Date: 01/19/06 (PHP Community)    Keywords: php, mysql, sql, security

Hello all,

I am working on a project to create highly customizable live cds mainly for my peronal use and for friends to try diffrent OSs. At the moment I have several shell scripts that I am looking at converting over to PHP if possiable. The bulk of it i know can be ported easily enough but I have never attempted to call other programs besides MySQL in PHP so I am not quite sure if it is feasable. The server will be located all inhouse with no outside access untill i can be sure of the security implcations involved in the procedure and lower the risks. Can I access other programs through php, spefically can I run "/usr/local/bin/mkisofs -b boot/cdboot -no-emul-boot -c boot/boot.catalog -r -l -L -V LiveCD -o $LIVEISODIR/LiveCD.iso ." and get the intended result? Any thoughts would be appreciated.

Source: http://community.livejournal.com/php/398676.html

Date: 01/17/06 (PHP Community)    Keywords: security

Greetings.

I've been using $_REQUEST for a few years now instead of $_GET or $_POST. I have yet to find any sort of decent reasoning as to why we should be using one or the other.

Are there any potential security benefits or risks with using $_REQUEST instead?

Source: http://community.livejournal.com/php/396705.html

Date: 01/09/06 (PHP Community)    Keywords: cms, php, html, database, security, web

Hey all,

I know there's been a couple posts about this recently, so if I'm asking redundant questions, sorry.

A friend of mine has come up with a pretty novel idea for a MySpace-ish site, but for a specific niche market (kind of like those CatSpace and DogSpaces that exist) - users will have profiles, photos, a blog, message boards, send friend requests, yadda yadda yadda, you've seen it all before. I'm going to be developing the initial setup myself (since we have no money), and this is a somewhat long term project that I'll be picking at casually for a little while.

Right now I'm trying to figure out if I should give this a go coding from scratch, or use an existing CMS type solution (like Mambo, Joomla, Drupal, etc). I'd really like to code it myself, as I think it could be a fun project to work on. I'm a pretty solid PHP programmer, but as I have a feeling that this idea could jump in popularity pretty quick, I really want to make sure I keep this thing as efficient as possible for a large user base. For instance, I don't want to go making another MySpace which I think runs horribly as a web app compared to even LiveJournal.

Currently I use PEAR's DB_DataObject or my database interactions and I've just gotten into Smarty for templating, though I'm sure I'm not using either to their fullest potential. I saw mention of a couple of development environments and frameworks in someone's recent post looking for a visual studio-esque PHP environment - http://www.livejournal.com/community/php/388602.html but I've never used any of these.

I'm not really concerned here with using a "rapid development" framework - I don't mind coding, I like it - but what I'm really concerned with is stability, efficiency and security - I know of course that these also rely heavily on how well I code, and using a good coding environment or framework won't do the coding for me, but there have to be some tools/frameworks/etc out there that pros are using that I just haven't moved onto yet, and I wanted to see what you guys (and gals) are using on some of your bigger projects.


- I know this comes up a bunch, but does anyone else think would it be handy at all for us as a community to maybe organize some of the more useful threads and frequently asked (and answered) questions in the php community at a separate location? Doing just a search on the community doesn't necessarily give you anything about the quality of the responses, and it may even be nice to be able to 'browse' solutions/posts by categories or something; maybe we could have some sort of quality ranking on posts, or some way to identify posts that contain questions that get asked all the time. I don't think this would be too tricky to put together, and I'd be willing to work on it, but I don't know if anyone would even use it?

Source: http://community.livejournal.com/php/392457.html

Date: 01/11/06 (Mozilla)    Keywords: java, security, web

After switching to FF 1.5, iam facing these annoying problems.

1) Most times when i load web pages, most placeholders like image links, thumbs, even smaller icons etc simply dont load. All are blank. Reloading doesnt really help much, still many places are blank. Its a big annoyance seeing blank even after successive reloads.
when only the image resource is loaded, that single thing loads perfectly.
bloody flash objects, adds all load, images,thumbnails dont.

2) Not a big annoyance, still some pages fail giving the error message,
'unable load could not connect'.. when i reload it problem is solved. Its annoyance at times to keep reloading.

Regard to first problem, I use a laptop, in it all pages load perfectly with IE. Also both IE,FF work perfect in a desktop(same connection). So it should not be a problem with the connection.

Also i tried in another user, another profile, a completely new profile all these with no extensions, the same problem persists there also. So its not because of extensions either.

info : options->contents-> all image settings are correct with no filters. javascript, java enabled.

I run windows XP (with all latest security).

Can anybody help.. its big big nuisance.

Thanks in advance

cross posted to firefoxusers

Source: http://community.livejournal.com/mozilla/347293.html

Date: 12/10/05 (Mozilla)    Keywords: java, security

.. or has anyone else who upgraded to Firefox 1.5 last week found it buggy and bloated?

It crashes every once in a while (not related to the recent security hole) and java 5.0 is really bad. I installed it and it makes my computer unresponsive requiring a reboot sometimes. Firefox will make my computer unresponsive to a ctrl+alt+del for 2-3 minutes until its closed if I leave my computer on all night. Normally when a process in WIndows2000 is using %100 of the cpu it should at least remain responsive.


I hope some bug fixes come soon. Its that or my registry is corrupt perhaps? Anyone else have the same problems?

Source: http://community.livejournal.com/mozilla/341918.html

Date: 12/08/05 (Mozilla)    Keywords: browser, asp, java, security, virus, linux

News of a new security vulnerability has been posted for Firefox 1.5 (my own testing confirms it also affects Firefox 1.0.7, Mozilla 1.7.12, and Camino 1.0b1) that allows for Denial of Service or potentially arbitrary code execution. It has to do with a buffer overflow in the parsing of history.dat, which stores browser history.

Basically, if you visit a malcious site using this vulnerability, the next time you try to start Firefox it will run the malicious code, which could be as minor as causing Firefox not to work (such as the Proof of Concept) or as serious as executing arbitrary code (i.e. it could install a virus or other malware). Fortunately, there is a simple workaround: just set Firefox to keep browser history for 0 (zero) days, essentially setting it not to keep history, and then restart Firefox to make the change take effect. Note that disabling JavaScript DOES NOT mitigate this vulnerability; only disabling browser history does, since that prevents the creation of history.dat. Also note that the malcious code would run each time you attempt to start Firefox, until you delete history.dat from your profile folder.

I don't believe Mozilla has announced anything about this yet, but proof of concept code is available, and I confirmed with my own testing that it works as I described on both Mac OS X and Windows, using both Firefox 1.5 and Firefox 1.0.7, meaning that all versions are probably affected (or at least all recent versions).

Here are the steps to mitigate this vulnerability until a patch is released (for Firefox 1.5):

1. Open Firefox Options (Tools->Options on Windows) or Preferences (Edit->Preferences on Linux, Firefox->Preferences on Mac OS X).
2. Choose "Privacy" from the top button bar, and choose the "History" tab.
3. Set "Remember visited pages for the last ____ days." to 0 (zero).
4. On Windows, click OK to close the Options window. On Linux or Mac, simply close the Preferences window.
5. Restart Firefox to make sure the setting takes effect.

The same steps apply to Firefox 1.0.x, it's just that the options/preferences window is different. Basically, for step 2 the "Privacy" button is on the left side button bar, and history is the top section on that pane.

More details for the technically minded...

X-posted to mozilla

Update 1: My own testing confirms that other Mozilla-based browsers are affected by this vulnerability as well, including Mozilla Suite and Camino. I've also confirmed that this can be exploited without JavaScript (which I already suspected), and it has the same effect as the original PoC. All users of Gecko-based browsers should disable browser history.

Also, Secunia has released an advisory on the issue, but they only mention the DoS aspect, not the possibility of code execution that the original researchers claim is possible. While I can't confirm myself whether or not that is true, it is still certainly a nuisance to have Firefox become unusable, so you should all still protect yourselves.

Update 2: Mozilla has released a statement, claiming that the flaw only causes Firefox and Mozilla to hang for a long time when starting, but that they eventually do start. They also say that they don't think code execution is possible, since the original researchers present no proof of it other than claiming its possible. Though they don't state it, it doesn't sound like they're planning to release a patch anytime soon...

Also, testing confirms that this affects Linux, though depending on the distribution it seems to affect it differently. For example, on Gentoo using the twm window manager, accessing the test case caused the window manager to completely lock up, and then after restarting Firefox wouldn't work. On Fedora Core 4, however, after restarting Gnome (which locked up for me similarly to twm) Firefox did seem to keep working normally. Perhaps the fact that the window managers are locking up is a sign that they can't handle extremely long window titles...

Source: http://community.livejournal.com/mozilla/341566.html