<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: directories]]></title>
    <link>http://securityratty.com/tag/directories</link>
    <description></description>
    <pubDate>Fri, 07 Mar 2008 09:49:00 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Interop NY Keynotes: IBM]]></title>
      <link>http://securityratty.com/article/44ba0e9ad08b54462e9c92a6c54837a5</link>
      <guid>http://securityratty.com/article/44ba0e9ad08b54462e9c92a6c54837a5</guid>
      <description><![CDATA[Day one of Interop NY began with an introduction from Interop Manager Lenny Heymann, then Bob Picciano, General manager Lotus software and WebSpehere Portal IBM took the stage
IBMs presentation was...]]></description>
      <content:encoded><![CDATA[<p>Day one of Interop NY began with an introduction from Interop Manager Lenny Heymann, then Bob Picciano, General manager Lotus software and WebSpehere Portal IBM took the stage.</p>
<p>IBM&#8217;s presentation was cleverly titled <strong>2mor0@Wrk</strong> - Tomororow work and Web 2.0.</p>
<p><strong>Overview</strong></p>
<p>Web 2.0 is delivering a whole different paradigm of communication. The slide is Lotus Symphony - NOT PPT. Over 2 million downloads.</p>
<p>There is an information overload that impacts individual productivity in the workplace. It has a profound effect on organizational productivity. A more complex organization entity provides more pressure and more inefficiencies in workplace. Up to 70% of time can be used looking for the WRONG information.</p>
<p>Collaboration mitigates information overload. It allows you to identify experts and opinions.</p>
<p>The collaboration agenda. Enterprises are at the onset of exploring these features. Web 2.0 is giving us the capacity to do more. Collaboration optimizes business outcomes - global, secure and dynamic.The most progressive companies are looking at UNIFIED COMMUNICATIONS. Making sure that directories and profiles are fully mobile.</p>
<p>Collaboration should be a contextual part of the workflow, going directly into applications.</p>
<p>IBM&#8217;s collaboration strategy is to deliver these services through online or offline services.</p>
<p><strong>Demonstration</strong></p>
<p>Executive IT architect Ron Sebastian provided a demonstration of IBM&#8217;s collaboration strategy. IBM&#8217;s Web 2.0 solutions span delivery platforms:</p>
<ul>
<li>Platform - web as&nbsp; platform</li>
<li>Application - development</li>
<li>People - social computing</li>
</ul>
<p><a href="http://www-01.ibm.com/software/lotus/products/connections/" target="_blank">Lotus Connections</a> - a family of social computing software that provides profile lookup and community capabilities. Think of Facebook, Yahoo Groups, and delicious combined in one portal.</p>
<p>Ron demonstrated these social services embedded into a healthcare provider application. Semantic tagging is available, contact information and commenting. Not only are we providing service to customers, you can integrate sync capability to directly call the person you want.</p>
<p>The biggest aspect of Lotus Connection? It&#8217;s all integrated.</p>
<p>A new service - <a href="https://www.bluehouse.lotus.com/" target="_blank">Project Bluehouse</a>. This is a SaaS delivery of these collaborated capabilities. The store and share can manage and share documents within and outside the company. Access control is no longer an issue.</p>
<p>Collaborative Web 2.0 services available as standalone products that also work in a mobile environment.</p>
<p><strong>Case Study: Natural Disaster Management Mashup</strong></p>
<p>Boeing came up with twenty different scenarios that they could handle through their systems. The problem was the one they didn&#8217;t count on. One example was Katrina - how to deliver supplies to the area: what airports were open? Where could they land? The problem was they could not find one list of public, private and military airports, nor what was open. The mashup took different feeds to allow the deacon maker to make a more rapid and intelligent decision based on information on where they could fly in the appropriate supplies. From open information sites like <a href="http://www.airnav.com/" target="_blank">AirNav.com</a> and personal contacts, users were able to mashup the information to make better decisions.</p>
<p><strong>Conclusion</strong></p>
<p><a href="http://www.eweek.com/c/a/Messaging-and-Collaboration/IBM-to-Unveil-Social-Software-Center-at-Interop/" target="_blank">IBM announced the IBM Center for Social Software</a>, proving their commitment to connect, collaborate, and innovate. Users and academics can work together to how these innovations can be applied to businesses and provide value to the market.</p>
<p>There has been <a href="http://teblog.typepad.com/david_tebbutt/2008/04/ibms-bluehouse.html" target="_blank">some question</a> of whether or not IBM can pull this off and move into the collaborative Web 2.0 market. Despite <a href="http://www.theappgap.com/ibm-bluehouse-organizes-online-meetings-and-the-before-and-after.html" target="_blank">some criticism</a>, it looks like IBM has really taken a step forward in advancing their products and services to meet market needs.</p>
<p>People drive better business outcomes. Connecting, collaboration, and innovation is key. Having the right tools and information to do that eases pressure that many organizations feel and brings Web 2.0 technologies to the heart of businesses.</p>
]]></content:encoded>
      <pubDate>Wed, 17 Sep 2008 09:39:59 +0000</pubDate>
      <category domain="http://securityratty.com/tag/ibm">ibm</category>
      <category domain="http://securityratty.com/tag/information sites">information sites</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/collaboration">collaboration</category>
      <category domain="http://securityratty.com/tag/web">web</category>
      <category domain="http://securityratty.com/tag/social">social</category>
      <category domain="http://securityratty.com/tag/ibms collaboration strategy">ibms collaboration strategy</category>
      <category domain="http://securityratty.com/tag/social services">social services</category>
      <category domain="http://securityratty.com/tag/collaborative web">collaborative web</category>
      <source url="http://blog.sciencelogic.com/interop-ny-keynotes-ibm/09/2008">Interop NY Keynotes: IBM</source>
    </item>
    <item>
      <title><![CDATA[The Not-So-Sweet Life of Supplicants]]></title>
      <link>http://securityratty.com/article/a7513e6c4a71a61081c2aa1aef143439</link>
      <guid>http://securityratty.com/article/a7513e6c4a71a61081c2aa1aef143439</guid>
      <description><![CDATA[There are plenty of integration and configuration challenges when we look at 802.1X , but one of the most notable issues is choosing the right supplicant to best serve your end users
Some of the major...]]></description>
      <content:encoded><![CDATA[<P>There are plenty of integration and configuration challenges when we look at <A title="802.1X Primer" href="http://securityuncorked.squarespace.com/security-uncorked/2008/4/2/what-is-8021x-heres-a-technology-primer-for-you.html">802.1X</A>, but one of the most notable issues is <strong>choosing the right <A title="What is a supplicant?" href="http://securityuncorked.squarespace.com/security-uncorked/2008/6/5/know-the-difference-between-a-nac-client-and-a-1x-supplicant.html">supplicant</A> to best serve your end users</strong>. </P>
<P>Some of the major obstacles we face with 802.1X center around creating a smooth end user experience.&nbsp; We, as integrators, have the distinct ability to make &#8216;whatever&#8217; work- we find a way. But, what I hear most from my customers is &#8220;<em>it has to be easy for the end user.&#8221;</em>&nbsp; (Sometimes they go on a little further, but I&#8217;ll leave it at that.)</P>
<P><strong>Why does it matter?</strong> </P>
<P>Wireless, wireless, wireless. Although&nbsp;wired 1X is&nbsp;popular&nbsp;with our customer-base, the world isn&#8217;t quite flocking to it yet. However, 802.1X is certainly the best way to increase security and ease management of wireless networks. It&#8217;s standard, it&#8217;s flexible, it&#8217;s widely-supported by devices and endpoints and it eliminates the need for pre-shared keys or secondary passwords. It&#8217;s what most enterprises, government&nbsp;and educational organizations are implementing now, so it&#8217;s important. </P>
<P><strong>What are some of the problems?</strong> </P>
<P>The end user will have some adjustments to make, and network admins and support desks aren&#8217;t always thrilled with the propect of re-training users for these expectations.</P><span>
<ul>
<li>First of all, the <span style="TEXT-DECORATION: underline">time to authenticate</span> and connect to the network is going to drastically increase. I say drastically- it&#8217;s only a few seconds- but I&#8217;m sure it feels like minutes to a new 1X end user. 
<li>In addition, we&#8217;re in a transition and growing period where we&#8217;re trying to integrate and authenticate multiple pieces- the machine and/or user as well as any other clients residing on the endpoint, so there can be <span style="TEXT-DECORATION: underline">single-sign-on issues</span>. Not SSO in the traditional sense, but single-1X-sign-on vs logging in to authenticate and open the port, logging in again to get to network resources (such as Novell). 
<li>There may also be issues supporting <span style="TEXT-DECORATION: underline">multiple profiles</span>, so end users may need to understand the concept of enabling 802.1X on an interface at their office, then disabling it when they go home. 
<li>Or perhaps, in a shared or lab-type environment, we may have multiple unique users logging in to the same endpoint device, so we have to make it easy for end users to <span style="TEXT-DECORATION: underline">log off so there&#8217;s a forced re-auth</span> for the next user. </li>
</ul>
<P>There are plenty more, but this hits on the major concerns of most organizations planning to implement 802.1X (wired or wireless).</span></P>
<P><strong>How do we address the issues?</strong></P>
<P>There are different ways to deal with the complexity of supplicant and end-user interactions. First and foremost, a good <span style="TEXT-DECORATION: underline">end user training</span> program will be needed. There&#8217;s a learning curve, but eventually end users will get it- we just have to make sure the transition for &#8216;now&#8217; to &#8216;got it&#8217; is smooth and doesn&#8217;t overwhelm help desk resources. </P>
<P>As the operating systems and clients progress, we&#8217;re seeing <span style="TEXT-DECORATION: underline">more integration</span> and the ability to share 802.1X information between disparate pieces of the endpoint. </P>
<P>In the meantime, there are also <span style="TEXT-DECORATION: underline">3rd-party supplicants</span> that can ease several of the pains. <A class=offsite-link-inline title="Cisco SSC" href="http://www.cisco.com/en/US/products/ps7034/index.html" target=_blank>Cisco&#8217;s&nbsp;Secure Services&nbsp;Client</A>&nbsp; (acquired from Meetinghouse&#8217;s Aegis supplicant) and <A class=offsite-link-inline title="Juniper OAC" href="http://www.juniper.net/products_and_services/aaa_and_802_1x/odyssey/index.html" target=_blank>Juniper&#8217;s Odyssey Access Client</A>&nbsp; (acquired from Funk) both offer options and configurations not currently available in native OS supplicants. (For example, both offer the GINA shim for integrating Windows 1X login with Novell as well as multiple profile support.) Although I haven&#8217;t tried it, my understanding is you can still operate both of these clients independent of the controllers provided from the same vendor. </P>
<P><strong>Is it a deal-killer?</strong> </P>
<P>It can be. The struggle to provide a smooth transition for end users is often a deal-killer for organizations looking at deploying 802.1X. Although there are ways to combat most of these obstacles; often the time, planning and money required to&nbsp;proceed make it unattractive enough to abandon the project. In most cases, the more heterogeneous the endpoint environment is, the less attractive the solution becomes. In an all-Microsoft environment, you can have an 802.1X framework up in a matter of hours. With a mix of authentication directories, endpoint OSs and user expectations, you could spend weeks or&nbsp;months ironing out the details.</P>
<P><strong>The good news.</strong></P>
<P>Yes, there&#8217;s some good news here. The increased adoption of 802.1X is continually leading to increased integration of the software, operating systems and clients on endpoints. While 802.1X may never reach &#8216;plug-and-play&#8217; status, pretty soon the integration will reach a point where configuration is simplified enough for more wide-spread adoption, even in the most diverse environments. </P>
<P>Just hang tight, we&#8217;ll get there!</P>
<P># # #</P>
]]></content:encoded>
      <pubDate>Wed, 23 Jul 2008 11:23:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/user">user</category>
      <category domain="http://securityratty.com/tag/end-user interactions">end-user interactions</category>
      <category domain="http://securityratty.com/tag/user experience">user experience</category>
      <category domain="http://securityratty.com/tag/machine andor user">machine andor user</category>
      <category domain="http://securityratty.com/tag/users">users</category>
      <category domain="http://securityratty.com/tag/multiple unique users">multiple unique users</category>
      <category domain="http://securityratty.com/tag/user expectations">user expectations</category>
      <category domain="http://securityratty.com/tag/endpoint">endpoint</category>
      <category domain="http://securityratty.com/tag/expectations">expectations</category>
      <source url="http://www.securityuncorked.com/security-uncorked/2008/7/23/the-not-so-sweet-life-of-supplicants.html">The Not-So-Sweet Life of Supplicants</source>
    </item>
    <item>
      <title><![CDATA[My Name......is......Neo!]]></title>
      <link>http://securityratty.com/article/2c478999841c979e08f1dd1c0ce66c8a</link>
      <guid>http://securityratty.com/article/2c478999841c979e08f1dd1c0ce66c8a</guid>
      <description><![CDATA[As Keanu would say, &quot;There's a bomb on the bus

I mean, &quot;Whoa&quot;. He might also have said &quot;Excellent&quot;, but that was definitely the wrong film

At any rate, here's an infection from China called...]]></description>
      <content:encoded><![CDATA[
        As Keanu would say, "There's a bomb on the bus".<br /><br />I mean, "Whoa". He might also have said "Excellent", but that was <i>definitely</i> the wrong film.<br /><br />At any rate, here's an infection from China called "Agent.NEO", which probably has some deep seated relevance to the Matrix trilogy. Or maybe not. There aren't tons of screenshots of desktop fireworks, because by and large, this infection doesn't hit you with the pretty whiz-bang effects on your monitor. What it <i>does</i> do, however, is drop a ton of files onto your PC (many of which do <a href="http://www.prevx.com/filenames/X1901356285440341471-0/AVWLAST.EXE.html">strange things</a> - here's a couple from various directories):<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="neo3.jpg" src="http://blog.spywareguide.com/images/neo3.jpg" class="mt-image-none" style="" height="107" width="275" /></span></div>
<br /><br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="neo4.jpg" src="http://blog.spywareguide.com/images/neo4.jpg" class="mt-image-none" style="" height="68" width="270" /></span></div><br /><br />...slows everything down to a crawl, attempts to detect and disable security programs, contact a remote mail server with network sensitive data, hijack your IE:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="neo1.jpg" src="http://blog.spywareguide.com/images/neo1.jpg" class="mt-image-none" style="" height="190" width="298" /></span></div>
<br /><br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/neo2.html" onclick="window.open('http://blog.spywareguide.com/images/neo2.html','popup','width=500,height=363,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/neo2-thumb-300x217.jpg" alt="neo2.jpg" class="mt-image-none" style="" height="217" width="300" /></a></span>
<br />Click to Enlarge<br /></div><br />....and tries to show you a couple of Chinese popup ads (none of those pages were online at time of testing, otherwise there'd be multicoloured screenshots galore below).<br /><br />I'm trying really hard to end this writeup with a really cheesy Matrix reference, but I can't think of any so in conclusion: avoid <a href="http://www.spywareguide.com/product_show.php?id=3503">Agent.NEO</a> at all costs (but watch the films again, they're awesome).<br /><div><br /></div>
        
    ]]></content:encoded>
      <pubDate>Mon, 30 Jun 2008 12:35:39 +0000</pubDate>
      <category domain="http://securityratty.com/tag/neo">neo</category>
      <category domain="http://securityratty.com/tag/pretty whiz-bang effects">pretty whiz-bang effects</category>
      <category domain="http://securityratty.com/tag/chinese popup ads">chinese popup ads</category>
      <category domain="http://securityratty.com/tag/screenshots galore">screenshots galore</category>
      <category domain="http://securityratty.com/tag/avoid agent">avoid agent</category>
      <category domain="http://securityratty.com/tag/cheesy matrix reference">cheesy matrix reference</category>
      <category domain="http://securityratty.com/tag/disable security programs">disable security programs</category>
      <category domain="http://securityratty.com/tag/remote mail server">remote mail server</category>
      <category domain="http://securityratty.com/tag/network sensitive data">network sensitive data</category>
      <source url="http://blog.spywareguide.com/2008/06/my-nameisneo.html">My Name......is......Neo!</source>
    </item>
    <item>
      <title><![CDATA[Mashup of the Titans]]></title>
      <link>http://securityratty.com/article/6289294023616c0d4219941919c976a5</link>
      <guid>http://securityratty.com/article/6289294023616c0d4219941919c976a5</guid>
      <description><![CDATA[Information Security - an Oxymoron for the information age

Always the beautiful answer who asks a more beautiful question. e. e. cummings
or why i am with Gelernter

This is a mashup of Saltzer &amp;...]]></description>
      <content:encoded><![CDATA[<div>Information Security - an Oxymoron for the information age</div><br /><div>“Always the beautiful answer who asks a more beautiful question.” e. e. cummings</div><div>...or why i am with Gelernter</div><br /><div>This is a mashup of Saltzer &amp; Schroeder&#39;s famous <a href="http://www.cs.virginia.edu/~evans/cs551/saltzer/">information security principles</a> with David Gelernter&#39;s <a href="http://www.edge.org/documents/archive/edge70.html">Manifesto</a>.</div><br /><div>The premise of this mashup is to examine the paper by Saltzer and Schroeder which was written in 1975 and serves as the basis for most information security programs against the Gelernter&#39;s manifesto as to where computing is actually going. Each of the eight principles in Saltzer and Schroeder&#39;s paper is listed in order, and followed by select excerpts of Gelernter&#39;s manifesto. This comparison is to examine theoretical information security principles vis a vis the actual utility of modern information systems. I will not make an attempt to reconcile theory and practice, but will point out where the two schools of thought agree. In fairness, Saltzer and Schroeder&#39;s paper was written 25 years before Gelernter&#39;s, however Saltzer and Schroeder&#39;s principles dominate the thinking about information security to this day and so its important to view them side by side with Gelernter&#39;s thinking on the direction of computing.</div><br /><div style="color: #bf5f00; ">Saltzer and Schroeder:</div><div>&quot;a) Economy of mechanism: Keep the design as simple and small as possible. This well-known principle applies to any aspect of a system, but it deserves emphasis for protection mechanisms for this reason: design and implementation errors that result in unwanted access paths will not be noticed during normal use (since normal use usually does not include attempts to exercise improper access paths). As a result, techniques such as line-by-line inspection of software and physical examination of hardware that implements protection mechanisms are necessary. For such techniques to be successful, a small and simple design is essential.&quot;</div><br /><div style="color: #0060bf; ">Gelernter:</div><div>&quot;9. The computing future is based on &quot;cyberbodies&quot; — self-contained, neatly-ordered, beautifully-laid-out collections of information, like immaculate giant gardens.&quot;</div><br /><div><span style="color: #00bf00; ">Conclusion(gp):</span>&#0160;So far, so good</div><br /><div>**</div><br /><div><span style="color: #bf5f00; ">Saltzer and Schroeder:</span><br /></div><div>&quot;b) Fail-safe defaults: Base access decisions on permission rather than exclusion. This principle, suggested by E. Glaser in 1965,8 means that the default situation is lack of access, and the protection scheme identifies conditions under which access is permitted. The alternative, in which mechanisms attempt to identify conditions under which access should be refused, presents the wrong psychological base for secure system design. A conservative design must be based on arguments why objects should be accessible, rather than why they should not. In a large system some objects will be inadequately considered, so a default of lack of permission is safer. A design or implementation mistake in a mechanism that gives explicit permission tends to fail by refusing permission, a safe situation, since it will be quickly detected. On the other hand, a design or implementation mistake in a mechanism that explicitly excludes access tends to fail by allowing access, a failure which may go unnoticed in normal use. This principle applies both to the outward appearance of the protection mechanism and to its underlying implementation.&quot;</div><br /><div><span style="color: #00bf00; ">Conclusion(gp):</span>&#0160;A conservative design principle that puts the object&#39;s owner in control of permissions. This makes a lot of sense from the object point of view, but does little to address the use case in which it executes.</div><br /><div>**</div><br /><div><span style="color: #bf5f00; ">Saltzer and Schroeder:</span><br /></div><div>&quot;c) Complete mediation: Every access to every object must be checked for authority. This principle, when systematically applied, is the primary underpinning of the protection system. It forces a system-wide view of access control, which in addition to normal operation includes initialization, recovery, shutdown, and maintenance. It implies that a foolproof method of identifying the source of every request must be devised. It also requires that proposals to gain performance by remembering the result of an authority check be examined skeptically. If a change in authority occurs, such remembered results must be systematically updated.&quot;</div><br /><div><span style="color: #0060bf; ">Gelernter:</span><br /></div><div>&quot;8. The software systems we depend on most today are operating systems (Unix, the Macintosh OS, Windows et. al.) and browsers (Internet Explorer, Netscape Communicator...). Operating systems are connectors that fasten users to computers; they attach to the computer at one end, the user at the other. Browsers fasten users to remote computers, to &quot;servers&quot; on the internet.</div><br /><div>Today&#39;s operating systems and browsers are obsolete because people no longer want to be connected to computers — near ones OR remote ones. (They probably never did). They want to be connected to information. In the future, people are connected to cyberbodies; cyberbodies drift in the computational cosmos — also known as the Swarm, the Cybersphere.</div><br /><div>13. Any well-designed next-generation electronic gadget will come with a ``Disable Omniscience&#39;&#39; button.</div><br /><div>17. A cyberbody can be replicated or distributed over many computers; can inhabit many computers at the same time. If the Cybersphere&#39;s computers are tiles in a paved courtyard, a cyberbody is a cloud&#39;s drifting shadow covering many tiles simultaneously.</div><br /><div>20. If a million people use a Web site simultaneously, doesn&#39;t that mean that we must have a heavy-duty remote server to keep them all happy? No; we could move the site onto a million desktops and use the internet for coordination. The &quot;site&quot; is like a military unit in the field, the general moving with his troops (or like a hockey team in constant swarming motion). (We used essentially this technique to build the first tuple space implementations. They seemed to depend on a shared server, but the server was an illusion; there was no server, just a swarm of clients.) Could Amazon.com be an itinerant horde instead of a fixed Central Command Post? Yes.&quot;</div><br /><div><span style="color: #00bf00; ">Conclusion(gp):</span>&#0160;Complete mediation provides the underpinning for Saltzer and Schroeder&#39;s system, but does not appear to scale to the desired itinerant horde at least in common interpretation.</div><br /><div>**</div><br /><div><span style="color: #bf5f00; ">Saltzer and Schroeder:</span><br /></div><div>&quot;d) Open design: The design should not be secret. The mechanisms should not depend on the ignorance of potential attackers, but rather on the possession of specific, more easily protected, keys or passwords. This decoupling of protection mechanisms from protection keys permits the mechanisms to be examined by many reviewers without concern that the review may itself compromise the safeguards. In addition, any skeptical user may be allowed to convince himself that the system he is about to use is adequate for his purpose. Finally, it is simply not realistic to attempt to maintain secrecy for any system which receives wide distribution.&quot;</div><br /><div><span style="color: #00bf00; ">Conclusion(gp):</span>&#0160;both seem to agree, hard to get the itinerant horde moving in a swarm without open standards.</div><br /><div>**</div><br /><div><span style="color: #bf5f00; ">Saltzer and Schroeder:</span><br /></div><div>&quot;e) Separation of privilege: Where feasible, a protection mechanism that requires two keys to unlock it is more robust and flexible than one that allows access to the presenter of only a single key. The relevance of this observation to computer systems was pointed out by R. Needham in 1973. The reason is that, once the mechanism is locked, the two keys can be physically separated and distinct programs, organizations, or individuals made responsible for them. From then on, no single accident, deception, or breach of trust is sufficient to compromise the protected information. This principle is often used in bank safe-deposit boxes. It is also at work in the defense system that fires a nuclear weapon only if two different people both give the correct command. In a computer system, separated keys apply to any situation in which two or more conditions must be met before access should be permitted. For example, systems providing user-extendible protected data types usually depend on separation of privilege for their implementation.&quot;</div><br /><div><span style="color: #0060bf; ">Gelernter:</span><br /></div><div>&quot;37. Elements stored in a mind do not have names and are not organized into folders; are retrieved not by name or folder but by contents. (Hear a voice, think of a face: you&#39;ve retrieved a memory that contains the voice as one component.) You can see everything in your memory from the standpoint of past, present and future. Using a file cabinet, you classify information when you put it in; minds classify information when it is taken out. (Yesterday afternoon at four you stood with Natasha on Fifth Avenue in the rain — as you might recall when you are thinking about &quot;Fifth Avenue,&quot; &quot;rain,&quot; &quot;Natasha&quot; or many other things. But you attached no such labels to the memory when you acquired it. The classification happened retrospectively.)&quot;</div><br /><div><span style="color: #00bf00; ">Conclusion(gp):</span>&#0160;Information Security models tend to look at things statically through information classification lenses, but its how information is used that makes it valuable. In practice this is how information security theory breaks down in the face of reality - what does an access control matrix look like for a mashup? What does it look like for a data mining app?</div><br /><div>**</div><br /><div><span style="color: #bf5f00; ">Saltzer and Schroeder:</span><br /></div><div>&quot;f) Least privilege: Every program and every user of the system should operate using the least set of privileges necessary to complete the job. Primarily, this principle limits the damage that can result from an accident or error. It also reduces the number of potential interactions among privileged programs to the minimum for correct operation, so that unintentional, unwanted, or improper uses of privilege are less likely to occur. Thus, if a question arises related to misuse of a privilege, the number of programs that must be audited is minimized. Put another way, if a mechanism can provide &quot;firewalls,&quot; the principle of least privilege provides a rationale for where to install the firewalls. The military security rule of &quot;need-to-know&quot; is an example of this principle.&quot;</div><br /><div><span style="color: #0060bf; ">Gelernter:</span><br /></div><div>&quot;28. Metaphors have a profound effect on computing: the file-cabinet metaphor traps us in a &quot;passive&quot; instead of &quot;active&quot; view of information management that is fundamentally wrong for computers.</div><br /><div>29. The rigid file and directory system you are stuck with on your Mac or PC was designed by programmers for programmers — and is still a good system for programmers. It is no good for non-programmers. It never was, and was never intended to be.</div><br /><div>30. If you have three pet dogs, give them names. If you have 10,000 head of cattle, don&#39;t bother. Nowadays the idea of giving a name to every file on your computer is ridiculous.&quot;</div><br /><div><span style="color: #00bf00; ">Conclusion(gp):</span>&#0160;Least Privilege is the point where the practical matter of applying Saltzer and Schroeder&#39;s principles breaks down in modern systems. Its a deployment issue, and a matter of insufficient models and modes.</div><br /><div>**</div><br /><div><span style="color: #bf5f00; ">Saltzer and Schroeder:</span><br /></div><div>&quot;g) Least common mechanism: Minimize the amount of mechanism common to more than one user and depended on by all users [28]. Every shared mechanism (especially one involving shared variables) represents a potential information path between users and must be designed with great care to be sure it does not unintentionally compromise security. Further, any mechanism serving all users must be certified to the satisfaction of every user, a job presumably harder than satisfying only one or a few users. For example, given the choice of implementing a new function as a supervisor procedure shared by all users or as a library procedure that can be handled as though it were the user&#39;s own, choose the latter course. Then, if one or a few users are not satisfied with the level of certification of the function, they can provide a substitute or not use it at all. Either way, they can avoid being harmed by a mistake in it.&quot;</div><br /><div><span style="color: #0060bf; ">Gelernter:</span><br /></div><div>&quot;6. Miniaturization was the big theme in the first age of computers: rising power, falling prices, computers for everybody. Theme of the Second Age now approaching: computing transcends computers. Information travels through a sea of anonymous, interchangeable computers like a breeze through tall grass. A dekstop computer is a scooped-out hole in the beach where information from the Cybersphere wells up like seawater.</div><br /><div>16. The future is dense with computers. They will hang around everywhere in lush growths like Spanish moss. They will swarm like locusts. But a swarm is not merely a big crowd. The individuals in the swarm lose their identities. The computers that make up this global swarm will blend together into the seamless substance of the Cybersphere. Within the swarm, individual computers will be as anonymous as molecules of air.</div><br /><div>55. Software can solve hard problems in two ways: by algorithm or by making connections — by delivering the problem to exactly the right human problem-solver. The second technique is just as powerful as the first, but so far we have ignored it.</div><br /><div>56. Lifestreams and microcosms are the two most important cyberbody types; they relate to each other as a single musical line relates to a single chord. The stream is a &quot;moment in space,&quot; the microcosm a moment in time.&quot;</div><br /><div>**</div><br /><div><span style="color: #bf5f00; ">Saltzer and Schroeder:</span><br /></div><div>&quot;h) Psychological acceptability: It is essential that the human interface be designed for ease of use, so that users routinely and automatically apply the protection mechanisms correctly. Also, to the extent that the user&#39;s mental image of his protection goals matches the mechanisms he must use, mistakes will be minimized. If he must translate his image of his protection needs into a radically different specification language, he will make errors.&quot;</div><br /><div><span style="color: #0060bf; ">Gelernter:</span><br /></div><div>&quot;7. &quot;The network is the computer&quot; — yes; but we&#39;re less interested in computers all the time. The real topic in astronomy is the cosmos, not telescopes. The real topic in computing is the Cybersphere and the cyberstructures in it, not the computers we use as telescopes and tuners.</div><br /><div>27. Modern computing is based on an analogy between computers and file cabinets that is fundamentally wrong and affects nearly every move we make. (We store &quot;files&quot; on disks, write &quot;records,&quot; organize files into &quot;folders&quot; — file-cabinet language.) Computers are fundamentally unlike file cabinets because they can take action.</div><br /><div>31. Our standard policy on file names has far-reaching consequences: doesn&#39;t merely force us to make up names where no name is called for; also imposes strong limits on our handling of an important class of documents — ones that arrive from the outside world. A newly-arrived email message (for example) can&#39;t stand on its own as a separate document — can&#39;t show up alongside other files in searches, sit by itself on the desktop, be opened or printed independently; it has no name, so it must be buried on arrival inside some existing file (the mail file) that does have a name. The same holds for incoming photos and faxes, Web bookmarks, scanned images...</div><br /><div>32. You shouldn&#39;t have to put files in directories. The directories should reach out and take them. If a file belongs in six directories, all six should reach out and grab it automatically, simultaneously.</div><br /><div>33. A file should be allowed to have no name, one name or many names. Many files should be allowed to share one name. A file should be allowed to be in no directory, one directory, or many directories. Many files should be allowed to share one directory. Of these eight possibilities, only three are legal and the other five are banned — for no good reason.</div><br /><div>53. Your car, your school, your company and yourself are all one-track vehicles moving forward through time, and they will each leave a stream-shaped cyberbody (like an aircraft&#39;s contrail) behind them as they go. These vapor-trails of crystallized experience will represent our first concrete answer to a hard question: what is a company, a university, any sort of ongoing organization or institution, if its staff and customers and owners can all change, its buildings be bulldozed, its site relocated — what&#39;s left? What is it? The answer: a lifestream in cyberspace.&quot;</div><br /><br /><div>**</div><div style="color: #00bf00; ">Conclusion(gp):</div><br /><div>The Saltzer and Schroeder principles of Open Design and Economy of Mechanism hold up well in the face of modern computing realities, and to a certain extent Fail Safe Defaults does as well; however if we information security people are to be effective we need to re-think the other principles.</div><br /><div>**</div><br /><div>Last word:&#0160;<span style="color: #0060bf; ">Gelernter:</span></div><div>We&#39;ll know the system is working when a butterfly wanders into the in-box and (a few wingbeats later) flutters out — and in that brief interval the system has transcribed the creature&#39;s appearance and analyzed its way of moving, and the real butterfly leaves a shadow-butterfly behind. Some time soon afterward you&#39;ll be examining some tedious electronic document and a cyber-butterfly will appear at the bottom left corner of your screen (maybe a Hamearis lucina) and pause there, briefly hiding the text (and showing its neatly-folded rusty-chocolate wings like Victorian paisley, with orange eyespots) — and moments later will have crossed the screen and be gone.</div>]]></content:encoded>
      <pubDate>Wed, 25 Jun 2008 13:29:25 +0000</pubDate>
      <category domain="http://securityratty.com/tag/protection mechanisms">protection mechanisms</category>
      <category domain="http://securityratty.com/tag/protection mechanisms correctly">protection mechanisms correctly</category>
      <category domain="http://securityratty.com/tag/information security">information security</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/implements protection mechanisms">implements protection mechanisms</category>
      <category domain="http://securityratty.com/tag/information travels">information travels</category>
      <category domain="http://securityratty.com/tag/information security people">information security people</category>
      <category domain="http://securityratty.com/tag/protection">protection</category>
      <category domain="http://securityratty.com/tag/potential information path">potential information path</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/06/mashup-of-the-titans.html">Mashup of the Titans</source>
    </item>
    <item>
      <title><![CDATA[BlackBerry Pearl 'Proper' Keypad Cheatsheet]]></title>
      <link>http://securityratty.com/article/d931e85c4fdd8e0c4a6c4b4abee74497</link>
      <guid>http://securityratty.com/article/d931e85c4fdd8e0c4a6c4b4abee74497</guid>
      <description><![CDATA[It wasnt long after I switched from a long history of traditional cell phones to a BB Pearl that I realized there was a big problem. I was up a creek without a paddle or should I say, I was up to...]]></description>
      <content:encoded><![CDATA[<p>It wasn&#8217;t&nbsp;long after I switched from&nbsp;a long history of&nbsp;traditional cell phones to a BB Pearl that I realized there was a big problem. I was up a creek without a paddle&#8230; or should I say, I was up to remote&nbsp;voicemail access without a proper keypad. </p><p>You see, phone systems everywhere- my office, your office, the banks and any alphanumeric-driven automated system- use the letters that correspond to a standard desk set number. The number &#8216;2&#8217; represents &#8216;ABC&#8217;, etc. </p><p><strong><span class="full-image-float-right"><img style="width: 162px; height: 282px" alt="graphic_BBkeypad_hers.gif" src="http://www.securityuncorked.com/storage/graphic_BBkeypad_hers.gif" /></span>The problem is&#8230;</strong> the BlackBerry Pearl keyboard is the bastard child of a standard 9-key cell keypad and a full QWERTY keyboard that BB usually sports&#8230; making it match&#8230; well&#8230; nothing!&nbsp;</p><p>So a &#8216;G&#8217; on my office system to Give it to another user is number key 4, on my Pearl it would be 5, which would be &#8216;K&#8217; to my phone system to save the message and tuck it back in the depths of vm storage never to be found again. Over the past months, I&#8217;ve accidentally erased things I wanted to forward, forward things I wanted to save&#8230; you get the picture. </p><p>It&#8217;s not just voicemail access. I also found I couldn&#8217;t&nbsp;make use of <strong>dial-by-name</strong> directories&nbsp;or even access my&nbsp;<strong>banking</strong> by phone. It gets to be quite frustrating at times, and driving down the road at 70mph is not really a good time to try and work out the mental puzzle of which number &#8216;should&#8217; be what. </p><p><strong>The solution&#8230;</strong> I decided to make a BlackBerry Pearl &#8216;Proper&#8217; Keypad Cheatsheet. It&#8217;s a convenient 2x3.5&#8221; business-card sized piece that you can print and slip right into your wallet, phone holster, or wherever you need it.</p><p>And here it is, available for your enjoyment- in both his and hers colours. </p><p><a href="http://www.securityuncorked.com/storage/graphic_BBkeypad_hers_lg.gif">Her BB Pearl Keypad Cheetsheet</a> (in pink)</p><p><a href="http://www.securityuncorked.com/storage/graphic_BBkeypad_his.gif">His BB Pearl Keypad Cheetsheet </a>(in blue)</p><p># # #</p>
]]></content:encoded>
      <pubDate>Sat, 07 Jun 2008 11:37:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/pearl">pearl</category>
      <category domain="http://securityratty.com/tag/pearl keypad cheetsheet">pearl keypad cheetsheet</category>
      <category domain="http://securityratty.com/tag/remote voicemail access">remote voicemail access</category>
      <category domain="http://securityratty.com/tag/voicemail access">voicemail access</category>
      <category domain="http://securityratty.com/tag/phone systems everywhere-">phone systems everywhere-</category>
      <category domain="http://securityratty.com/tag/phone">phone</category>
      <category domain="http://securityratty.com/tag/access">access</category>
      <category domain="http://securityratty.com/tag/blackberry pearl keyboard">blackberry pearl keyboard</category>
      <category domain="http://securityratty.com/tag/phone holster">phone holster</category>
      <source url="http://www.securityuncorked.com/security-uncorked/2008/6/7/blackberry-pearl-proper-keypad-cheatsheet.html">BlackBerry Pearl 'Proper' Keypad Cheatsheet</source>
    </item>
    <item>
      <title><![CDATA[Its about the kids, stupid]]></title>
      <link>http://securityratty.com/article/05e065f5f851bef336e05ec64ec5642a</link>
      <guid>http://securityratty.com/article/05e065f5f851bef336e05ec64ec5642a</guid>
      <description><![CDATA[Matt Asay has a blog up on &quot; OLPC's capitulation to Windows...&quot;. In it Matt waxes poetic about what a mistake Nicholas Negroponte is making by embracing Windows for the OLPC laptop project. Matt...]]></description>
      <content:encoded><![CDATA[<p>Matt Asay has a blog up on "<a href="http://www.cnet.com/8301-13505_1-9938882-16.html?part=rss&amp;tag=feed&amp;subj=TheOpenRoad">OLPC's capitulation to Windows...".</a> In it Matt waxes poetic about what a mistake Nicholas Negroponte is making by embracing Windows for the OLPC laptop project. Matt points to Groklaw, Richard Stallman and the rest of the Redmond revolutionaries who want to see Negroponte tarred and feathered and question his vision. Hey, lets face it the "m" word is toxic to that crowd. But I really think Matt is just plain twisted about this and about what OLPC is really about. Here is what Matt has to say, "<em>OLPC is rather about liberating developing nations from their vassal status that continually keeps them at the mercy of the pricing and licensing of Microsoft and other proprietary vendors.</em>" No Matt, that is not what OLPC is all about and that is what the problem is! OLPC is about getting a laptop in the hands of every kid in the world. It is about giving these kids a chance to learn and grow up to compete in the global economy with the same tools that kids in this country have. It has nothing to with your views of Microsoft being a 21st century imperialistic empire.<br><br>Matt <a href="http://www.stillsecureafteralltheseyears.com/ashimmy/2008/03/my-kids-get-xos.html">both of my boys have OLPC laptops</a>, I know what it is like using them. The Sugar interface is tough. As Negroponte says, it is a amorphous blob. The command line structure of the laptop made it hard for me to retrieve and install files. File names are truncated and kept in non-standard directories. When kids are learning windows in school, this is difficult for them. The laptops are a tool for them to learn, it shouldn't be about learning the tool. It needs to be more main stream for kids to be able leverage it across the world. It needs to be more standards based. I don't care if it is open source standards or closed source standards but it has to be better. Windows will give it that.<br><br>But ultimately Matt, I feel that the OLPC project was hijacked by the open source movement as a "Trojan horse" to overthrow Windows. If that was your intention great. Me, I was a lot more humble and noble in what I thought it was. I thought was about getting a computer in the kids hands and having them learn and contribute.</p>
<p><a href="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?a=sGlham"><img src="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?i=sGlham" border="0"></img></a></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=jervBH"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=jervBH" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=pYbJRH"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=pYbJRH" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=efyN9H"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=efyN9H" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=O4NqCH"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=O4NqCH" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=3YiFOh"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=3YiFOh" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=uburHh"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=uburHh" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~4/286338789" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 08 May 2008 11:52:44 +0000</pubDate>
      <category domain="http://securityratty.com/tag/olpc">olpc</category>
      <category domain="http://securityratty.com/tag/olpc laptop project">olpc laptop project</category>
      <category domain="http://securityratty.com/tag/kids">kids</category>
      <category domain="http://securityratty.com/tag/matt">matt</category>
      <category domain="http://securityratty.com/tag/ultimately matt">ultimately matt</category>
      <category domain="http://securityratty.com/tag/olpc laptops">olpc laptops</category>
      <category domain="http://securityratty.com/tag/matt waxes poetic">matt waxes poetic</category>
      <category domain="http://securityratty.com/tag/laptops">laptops</category>
      <category domain="http://securityratty.com/tag/olpc project">olpc project</category>
      <source url="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~3/286338789/its-about-the-k.html">Its about the kids, stupid</source>
    </item>
    <item>
      <title><![CDATA[ICQ Messenger Controlled Malware]]></title>
      <link>http://securityratty.com/article/a55745a0da0235599279e2bcdaedc1be</link>
      <guid>http://securityratty.com/article/a55745a0da0235599279e2bcdaedc1be</guid>
      <description><![CDATA[IM me a command, master - part two . Diversifying the command and control channels of malware is always in a permanent development phrase, with malware authors trying to adapt their releases in order...]]></description>
      <content:encoded><![CDATA[<a href="http://bp0.blogger.com/_wICHhTiQmrA/R_of5F281UI/AAAAAAAABiw/IJEJ5vsrp2Y/s1600-h/ICQ_malware_commands.jpg"><img id="BLOGGER_PHOTO_ID_5186492986556208450" style="FLOAT: left; MARGIN: 0px 10px 10px 0px" alt="" src="http://bp0.blogger.com/_wICHhTiQmrA/R_of5F281UI/AAAAAAAABiw/IJEJ5vsrp2Y/s200/ICQ_malware_commands.jpg" border="0" /></a>IM me a command, master - <a href="http://ddanchev.blogspot.com/2007/11/yahoo-messenger-controlled-malware.html">part two</a>. Diversifying the command and control channels of malware is always in a permanent development phrase, with malware authors trying to adapt their releases in order for them to bypass popular detection mechanisms. IM controlled malware is a great example of such a development, and now that I've already covered a Yahoo Messenger controlled malware in previous post, it would be logical to come up with more evidence on alternative IM networks used as a main C&amp;C interface, such as ICQ in this case. The ICQ controlled malware's pitch :<br /><br /><br /><a href="http://bp2.blogger.com/_wICHhTiQmrA/SANJpGORGPI/AAAAAAAABjI/KqFmQEs68I4/s1600-h/ICQ_messenger_malware_2.jpg"><img id="BLOGGER_PHOTO_ID_5189072166054861042" style="FLOAT: left; MARGIN: 0px 10px 10px 0px; CURSOR: hand" alt="" src="http://bp2.blogger.com/_wICHhTiQmrA/SANJpGORGPI/AAAAAAAABjI/KqFmQEs68I4/s200/ICQ_messenger_malware_2.jpg" border="0" /></a>"<em>With this program, you will always be able to access the necessary functions of your computer using ordinary ICQ. It has the opportunity to add their scripts and commands, thus becoming a universal tool for controlling the computer - it all depends on your imagination and skills. Through the program operations like the following can be run by default - viewing directories, displaying messages, lauching programs, killing processes, shutdown, view active windows, and much more.</em>"<br /><br /><br />Released primarily as a Proof of Concept, its source code is freely available which as <a href="http://ddanchev.blogspot.com/2007/09/localizing-open-source-malware.html">we've already seen</a> in the past results in <a href="http://ddanchev.blogspot.com/2007/09/custom-ddos-capabilities-within-malware.html">more innovation added</a> on behalf of those using the idea as a foundation for achieving their own malicious purposes.<br /><br /><br /><a href="http://bp1.blogger.com/_wICHhTiQmrA/SANNd2ORGQI/AAAAAAAABjQ/tgENYVbBzDY/s1600-h/ICQ_malware_commands_1.jpg"><img id="BLOGGER_PHOTO_ID_5189076370827843842" style="FLOAT: left; MARGIN: 0px 10px 10px 0px; CURSOR: hand" alt="" src="http://bp1.blogger.com/_wICHhTiQmrA/SANNd2ORGQI/AAAAAAAABjQ/tgENYVbBzDY/s200/ICQ_malware_commands_1.jpg" border="0" /></a>The whole concept of abusing third-party communication applications for malware purposes, has always been there, in fact two years ago, there were even speculations that <a href="http://ddanchev.blogspot.com/2006/01/skype-to-control-botnets.html">Skype could be used to control botnets</a>. A fad or a trend? The lone malware author who's not embracing malicious economies of scale and looking for reliable and efficient ways to infect and control as many hosts as possible, is taking advantage of this, the rest are always looking for ways to port their botnets to a different C&amp;C without loosing a single host in order to benefit from what a web application C&amp;C can provide in respect to the old-fashioned IRCd command line commands.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=2ciRazG"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=2ciRazG" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=N8Nn30G"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=N8Nn30G" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=esBrypg"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=esBrypg" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=MvOCzGg"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=MvOCzGg" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=RQZV6RG"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=RQZV6RG" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=EI2OOTG"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=EI2OOTG" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=6VM2UBg"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=6VM2UBg" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/269982804" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 14 Apr 2008 03:28:05 +0000</pubDate>
      <category domain="http://securityratty.com/tag/malware">malware</category>
      <category domain="http://securityratty.com/tag/malware authors">malware authors</category>
      <category domain="http://securityratty.com/tag/lone malware author">lone malware author</category>
      <category domain="http://securityratty.com/tag/icq">icq</category>
      <category domain="http://securityratty.com/tag/malware purposes">malware purposes</category>
      <category domain="http://securityratty.com/tag/control">control</category>
      <category domain="http://securityratty.com/tag/control botnets">control botnets</category>
      <category domain="http://securityratty.com/tag/ordinary icq">ordinary icq</category>
      <category domain="http://securityratty.com/tag/permanent development phrase">permanent development phrase</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/269982804/icq-messenger-controlled-malware.html">ICQ Messenger Controlled Malware</source>
    </item>
    <item>
      <title><![CDATA[Identity vendor Ping adds to wares to support SaaS]]></title>
      <link>http://securityratty.com/article/96dddf1f584976e553e1b2dd183398c9</link>
      <guid>http://securityratty.com/article/96dddf1f584976e553e1b2dd183398c9</guid>
      <description><![CDATA[Ping Identity Tuesday added to its tools for supporting single sign-on to online services by acquiring appliance-based technology from Sxip Identity for integrating hosted applications and corporate...]]></description>
      <content:encoded><![CDATA[Ping Identity Tuesday added to its tools for supporting single sign-on to online services by acquiring appliance-based technology from Sxip Identity for integrating hosted applications and corporate directories.
			
			<div style="margin-top:20" />
			<table border="1" BORDERCOLOR="#0033CC" cellspacing="0" cellpadding="2">
				<tr valign="top" align="left">
					<td>
						<table border="0" cellspacing="3" cellpadding="2" width="100%">
			
			
		  
		<tr> 
		<tr>
      <td width="*">
				<font face="Arial,Helvetica,Geneva,Sans-serif,sans-serif" size="-1">
				<p>	
			
			<a href="http://rsslinks.industrybrains.com/click?sid=93&scid=10069&rqctid=589&lid=477320&cid=134559&pr=2&tstamp=20080312000000&url=http://clk.atdmt.com/CNT/go/ndstrwir0090000139cnt/direct/01/" target=_blank><strong>Protecting the Enterprise Network Through Web Security</strong></a></p>
				<td align="right">
					<font face="Arial,Helvetica,Geneva,Sans-serif,sans-serif" COLOR="#0033CC" size="-1"><p>Advertisement</p></font>
				</td>
				</tr>
				<tr><td colspan="2"><font face="Arial,Helvetica,Geneva,Sans-serif,sans-serif" size="-1"><p>New focus is being placed on securing Web-based threats.
			
				</p>
				</font>
		 	</td>
     </tr>
		 
		 
			
						</table>
					</td>
				</tr>
			</table>
			<div style="margin-top:20" />
			
			]]></content:encoded>
      <pubDate>Mon, 10 Mar 2008 21:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/enterprise network">enterprise network</category>
      <category domain="http://securityratty.com/tag/sxip identity">sxip identity</category>
      <category domain="http://securityratty.com/tag/web security">web security</category>
      <category domain="http://securityratty.com/tag/single sign-on">single sign-on</category>
      <category domain="http://securityratty.com/tag/identity tuesday">identity tuesday</category>
      <category domain="http://securityratty.com/tag/online services">online services</category>
      <category domain="http://securityratty.com/tag/advertisement">advertisement</category>
      <category domain="http://securityratty.com/tag/directories">directories</category>
      <category domain="http://securityratty.com/tag/tools">tools</category>
      <source url="http://www.networkworld.com/news/2008/031108-pingid-sxip.html?fsrc=rss-security">Identity vendor Ping adds to wares to support SaaS</source>
    </item>
    <item>
      <title><![CDATA[Enabling hierarchical nant builds]]></title>
      <link>http://securityratty.com/article/6d991aa98c59ab5248eca3f43819fd48</link>
      <guid>http://securityratty.com/article/6d991aa98c59ab5248eca3f43819fd48</guid>
      <description><![CDATA[In a recent post , I talked about my experience enabling continuous integration for the internal builds here at Pluralsight. I recently worked with Craig to restructure our nant build. As part of...]]></description>
      <content:encoded><![CDATA[<p>In a <a href="http://www.pluralsight.com/blogs/keith/archive/2008/01/18/49967.aspx" target="_blank">recent post</a>, I talked about my experience enabling continuous integration for the internal builds here at Pluralsight. I recently worked with Craig to restructure our nant build. As part of that, I wanted to ensure that I could run the build from anywhere in the source tree. We use a typical hierarchical build where each project has a build script that knows how to compile, test, deploy, etc. based on the specified target. Then at the top of the tree, there's a build script that runs all the other ones. That root build script is what gets run automatically by <a href="http://ccnet.thoughtworks.com/" target="_blank">Cruise Control</a>.</p>
<p>My root script defines a bunch of properties, like where the output directories for the overall build live, where the tools live, and so on. And that works fine when I run the build from the root. The properties get defined, all the child scripts are run with &lt;nant/&gt; tasks, and they see those properties. But if I want to drill down into the tree and run one of the build scripts lower down, suddenly there's problems because it depends on properties that are only defined in the root script. I really like being able to run builds from anywhere in the tree for perf - if I'm trying to fix a particular project, I don't necessarily want to wait for unit tests on the entire tree to run in order to see if mine passed.</p>
<p>Craig made a great suggestion. Put the properties into a separate script (we named it properties.nant) and &lt;include/&gt; that script. Then to enable hierarchical builds, we'd create a properties.nant file for each folder in the tree, which would &lt;include/&gt; its parent. That way I could define properties anywhere in the tree, and they would be "inherited" by anything below it.</p>
<p>I took that idea one step further, because I didn't want to maintain a bunch of property scripts with nothing in them but an &lt;include/&gt; for the parent. I wrote an &lt;includefromparent/&gt; nant task that walks up the directory tree looking for the target file. So now I can do this:</p>
<p><tt>&lt;includefromparent buildfile="properties.nant"/&gt;</tt></p>
<p>This worked great! But now I ran into a problem. Many of my properties are defined like so in the root properties.nant file:</p>
<p><tt>&lt;property name="libraryOutputDir" value="${project::get-base-directory()}\artifacts\libraries"/&gt;</tt></p>
<p>Do you see the issue? If I run the build with the root script, everything works fine, because it's the root nant project I'm building, and get-base-directory() refers to the root of the project, where the artifacts folder lives. But if I run from lower in the tree, it's a different project, and get-base-directory() refers to a subfolder, where the artifacts folder definitely should NOT be.</p>
<p>I needed a way to find the root of the project tree. So I build a second really simple nant task:</p>
<p><tt>&lt;findmarkeddir markerfile="filetolookfor.txt" property="root"/&gt;</tt></p>
<p>This task simply looks up the directory hierarchy until it finds the specified marker file, then puts the name of that directory (the "marked" directory) into a designated property (here I've called it root). With that in place, I rewrote my property definitions in terms of the base directory:</p>
<p><tt>&lt;property name="libraryOutputDir" value="${root}\artifacts\libraries"/&gt;</tt></p>
<p>Voilà! I can now run builds from any of my build scripts. They inherit properties hierarchically like you'd expect, and the system is quite easy to maintain. If you'd like to use these tasks, I've included the code for them below (not much code, really). And if you've never written a nant task yourself before, here's <a href="http://blogs.geekdojo.net/rcase/archive/2005/01/06/5971.aspx" target="_blank">the article</a> I used to figure out how it's done (it's super easy). <a href="http://nant.sourceforge.net/release/latest/help/fundamentals/tasks.html#taskloader" target="_blank">Here's</a> what you should read to learn about the various options for deploying your custom task assembly so nant recognizes it.</p>
<p>Enjoy!</p>
<p>Here is <b>FindMarkedDirTask.cs</b></p><pre>using System;
using System.Collections.Generic;
using System.Text;
using NAnt.Core;
using NAnt.Core.Attributes;
using System.IO;

namespace PluralsightNantTasks {

[TaskName("findmarkeddir")]
public class FindMarkedDirTask : Task {

  [TaskAttribute("markerfile", Required = true)]
  [StringValidator(AllowEmpty = false)]
  public string MarkerFileName { get; set; }

  [TaskAttribute("property", Required = true)]
  [StringValidator(AllowEmpty = false)]
  public string PropertyName { get; set; }

  protected override void ExecuteTask() {
    string searchDir = this.Project.BaseDirectory;
    do {
      if (MarkerFileExistsIn(searchDir)) {
        this.Project.Properties[PropertyName] = searchDir;
        return;
      }
      searchDir = ParentOf(searchDir);
    } while (!IsRootDirectory(searchDir));
  }

  private bool IsRootDirectory(string path) {
    return Path.GetPathRoot(path) == Path.GetFullPath(path);
  }

  private string ParentOf(string directory) {
    return Path.GetFullPath(Path.Combine(directory, ".."));
  }

  private bool MarkerFileExistsIn(string directory) {
    return File.Exists(Path.Combine(directory, MarkerFileName));
  }
}
}
</pre>
<p>And here is <b>IncludeFromParentTask.cs</b> (note I derive from the built-in include task):</p><pre>using System;
using System.Collections.Generic;
using System.Text;
using NAnt.Core;
using NAnt.Core.Attributes;
using NAnt.Core.Tasks;
using System.IO;
using System.Globalization;

namespace PluralsightNantTasks {

[TaskName("includefromparent")]
public class IncludeFromParentTask : IncludeTask {

  protected override void Initialize() {
    string fileName = BuildFileName;
    if (fileName.Contains("/") || fileName.Contains(@"\\"))
      throw new BuildException(string.Format(
        CultureInfo.CurrentCulture,
        "buildfile attribute must only be a filename"));

    string relativePathToFoundFile = SearchParentDirectory(
      Project.BaseDirectory, fileName, 0);
      
    if (null == relativePathToFoundFile)
      throw new BuildException(string.Format(
        CultureInfo.CurrentCulture,
        "Couldn't find a file named {0}" +
        " in a parent directory of {1}",
        fileName, Project.BaseDirectory));

    // have to use a relative path here
    // because <include /> task uses
    // Path.Combine(projectDir, BuildFileName)
    // to get the full path
    BuildFileName = relativePathToFoundFile;

    base.Initialize();
  }

  private string SearchParentDirectory(string directory,
                        string fileName, int searchDepth) {
    ++searchDepth;
  
    // see if we've traversed all the way to the root
    string currentPath = Path.GetFullPath(directory);
    if (currentPath == Path.GetPathRoot(currentPath))
      return null;

    // recurse until we find the file
    string parentDir = Path.GetFullPath(
      Path.Combine(currentPath, ".."));
    string path = Path.Combine(parentDir, fileName);
    if (File.Exists(path)) {
      StringBuilder sb = new StringBuilder();
      for (int i = 0; i &lt; searchDepth; ++i)
        sb.Append(@"..\");
      return Path.Combine(sb.ToString(), fileName);
    }
    else return SearchParentDirectory(parentDir,
                          fileName, searchDepth);
  }
}
}
</pre><div style="clear:both;"></div><img src="http://pluralsight.com/community/aggbug.aspx?PostID=50388" width="1" height="1">]]></content:encoded>
      <pubDate>Fri, 07 Mar 2008 09:49:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/nant">nant</category>
      <category domain="http://securityratty.com/tag/root script defines">root script defines</category>
      <category domain="http://securityratty.com/tag/script">script</category>
      <category domain="http://securityratty.com/tag/root">root</category>
      <category domain="http://securityratty.com/tag/task">task</category>
      <category domain="http://securityratty.com/tag/simple nant task">simple nant task</category>
      <category domain="http://securityratty.com/tag/root nant project">root nant project</category>
      <category domain="http://securityratty.com/tag/return path">return path</category>
      <category domain="http://securityratty.com/tag/return">return</category>
      <source url="http://pluralsight.com/community/blogs/keith/archive/2008/03/07/50388.aspx">Enabling hierarchical nant builds</source>
    </item>
    <item>
      <title><![CDATA[Enabling hierarchical nant builds]]></title>
      <link>http://securityratty.com/article/83d94a82ba041a457afd0b8abf809cf5</link>
      <guid>http://securityratty.com/article/83d94a82ba041a457afd0b8abf809cf5</guid>
      <description><![CDATA[In a recent post , I talked about my experience enabling continuous integration for the internal builds here at Pluralsight. I recently worked with Craig to restructure our nant build. As part of...]]></description>
      <content:encoded><![CDATA[<p>In a <a href="http://www.pluralsight.com/blogs/keith/archive/2008/01/18/49967.aspx" target="_blank">recent post</a>, I talked about my experience enabling continuous integration for the internal builds here at Pluralsight. I recently worked with Craig to restructure our nant build. As part of that, I wanted to ensure that I could run the build from anywhere in the source tree. We use a typical hierarchical build where each project has a build script that knows how to compile, test, deploy, etc. based on the specified target. Then at the top of the tree, there's a build script that runs all the other ones. That root build script is what gets run automatically by <a href="http://ccnet.thoughtworks.com/" target="_blank">Cruise Control</a>.</p>
<p>My root script defines a bunch of properties, like where the output directories for the overall build live, where the tools live, and so on. And that works fine when I run the build from the root. The properties get defined, all the child scripts are run with &lt;nant/&gt; tasks, and they see those properties. But if I want to drill down into the tree and run one of the build scripts lower down, suddenly there's problems because it depends on properties that are only defined in the root script. I really like being able to run builds from anywhere in the tree for perf - if I'm trying to fix a particular project, I don't necessarily want to wait for unit tests on the entire tree to run in order to see if mine passed.</p>
<p>Craig made a great suggestion. Put the properties into a separate script (we named it properties.nant) and &lt;include/&gt; that script. Then to enable hierarchical builds, we'd create a properties.nant file for each folder in the tree, which would &lt;include/&gt; its parent. That way I could define properties anywhere in the tree, and they would be "inherited" by anything below it.</p>
<p>I took that idea one step further, because I didn't want to maintain a bunch of property scripts with nothing in them but an &lt;include/&gt; for the parent. I wrote an &lt;includefromparent/&gt; nant task that walks up the directory tree looking for the target file. So now I can do this:</p>
<p><tt>&lt;includefromparent buildfile="properties.nant"/&gt;</tt></p>
<p>This worked great! But now I ran into a problem. Many of my properties are defined like so in the root properties.nant file:</p>
<p><tt>&lt;property name="libraryOutputDir" value="${project::get-base-directory()}\artifacts\libraries"/&gt;</tt></p>
<p>Do you see the issue? If I run the build with the root script, everything works fine, because it's the root nant project I'm building, and get-base-directory() refers to the root of the project, where the artifacts folder lives. But if I run from lower in the tree, it's a different project, and get-base-directory() refers to a subfolder, where the artifacts folder definitely should NOT be.</p>
<p>I needed a way to find the root of the project tree. So I build a second really simple nant task:</p>
<p><tt>&lt;findmarkeddir markerfile="filetolookfor.txt" property="root"/&gt;</tt></p>
<p>This task simply looks up the directory hierarchy until it finds the specified marker file, then puts the name of that directory (the "marked" directory) into a designated property (here I've called it root). With that in place, I rewrote my property definitions in terms of the base directory:</p>
<p><tt>&lt;property name="libraryOutputDir" value="${root}\artifacts\libraries"/&gt;</tt></p>
<p>Voilà! I can now run builds from any of my build scripts. They inherit properties hierarchically like you'd expect, and the system is quite easy to maintain. If you'd like to use these tasks, I've included the code for them below (not much code, really). And if you've never written a nant task yourself before, here's <a href="http://blogs.geekdojo.net/rcase/archive/2005/01/06/5971.aspx" target="_blank">the article</a> I used to figure out how it's done (it's super easy). <a href="http://nant.sourceforge.net/release/latest/help/fundamentals/tasks.html#taskloader" target="_blank">Here's</a> what you should read to learn about the various options for deploying your custom task assembly so nant recognizes it.</p>
<p>Enjoy!</p>
<p>Here is <b>FindMarkedDirTask.cs</b></p><pre>using System;
using System.Collections.Generic;
using System.Text;
using NAnt.Core;
using NAnt.Core.Attributes;
using System.IO;

namespace PluralsightNantTasks {

[TaskName("findmarkeddir")]
public class FindMarkedDirTask : Task {

  [TaskAttribute("markerfile", Required = true)]
  [StringValidator(AllowEmpty = false)]
  public string MarkerFileName { get; set; }

  [TaskAttribute("property", Required = true)]
  [StringValidator(AllowEmpty = false)]
  public string PropertyName { get; set; }

  protected override void ExecuteTask() {
    string searchDir = this.Project.BaseDirectory;
    do {
      if (MarkerFileExistsIn(searchDir)) {
        this.Project.Properties[PropertyName] = searchDir;
        return;
      }
      searchDir = ParentOf(searchDir);
    } while (!IsRootDirectory(searchDir));
  }

  private bool IsRootDirectory(string path) {
    return Path.GetPathRoot(path) == Path.GetFullPath(path);
  }

  private string ParentOf(string directory) {
    return Path.GetFullPath(Path.Combine(directory, ".."));
  }

  private bool MarkerFileExistsIn(string directory) {
    return File.Exists(Path.Combine(directory, MarkerFileName));
  }
}
}
</pre>
<p>And here is <b>IncludeFromParentTask.cs</b> (note I derive from the built-in include task):</p><pre>using System;
using System.Collections.Generic;
using System.Text;
using NAnt.Core;
using NAnt.Core.Attributes;
using NAnt.Core.Tasks;
using System.IO;
using System.Globalization;

namespace PluralsightNantTasks {

[TaskName("includefromparent")]
public class IncludeFromParentTask : IncludeTask {

  protected override void Initialize() {
    string fileName = BuildFileName;
    if (fileName.Contains("/") || fileName.Contains(@"\\"))
      throw new BuildException(string.Format(
        CultureInfo.CurrentCulture,
        "buildfile attribute must only be a filename"));

    string relativePathToFoundFile = SearchParentDirectory(
      Project.BaseDirectory, fileName, 0);
      
    if (null == relativePathToFoundFile)
      throw new BuildException(string.Format(
        CultureInfo.CurrentCulture,
        "Couldn't find a file named {0}" +
        " in a parent directory of {1}",
        fileName, Project.BaseDirectory));

    // have to use a relative path here
    // because <include /> task uses
    // Path.Combine(projectDir, BuildFileName)
    // to get the full path
    BuildFileName = relativePathToFoundFile;

    base.Initialize();
  }

  private string SearchParentDirectory(string directory,
                        string fileName, int searchDepth) {
    ++searchDepth;
  
    // see if we've traversed all the way to the root
    string currentPath = Path.GetFullPath(directory);
    if (currentPath == Path.GetPathRoot(currentPath))
      return null;

    // recurse until we find the file
    string parentDir = Path.GetFullPath(
      Path.Combine(currentPath, ".."));
    string path = Path.Combine(parentDir, fileName);
    if (File.Exists(path)) {
      StringBuilder sb = new StringBuilder();
      for (int i = 0; i &lt; searchDepth; ++i)
        sb.Append(@"..\");
      return Path.Combine(sb.ToString(), fileName);
    }
    else return SearchParentDirectory(parentDir,
                          fileName, searchDepth);
  }
}
}
</pre><div style="clear:both;"></div><img src="http://www.pluralsight.com/community/aggbug.aspx?PostID=50388" width="1" height="1">]]></content:encoded>
      <pubDate>Fri, 07 Mar 2008 09:49:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/nant">nant</category>
      <category domain="http://securityratty.com/tag/root script defines">root script defines</category>
      <category domain="http://securityratty.com/tag/script">script</category>
      <category domain="http://securityratty.com/tag/root">root</category>
      <category domain="http://securityratty.com/tag/task">task</category>
      <category domain="http://securityratty.com/tag/simple nant task">simple nant task</category>
      <category domain="http://securityratty.com/tag/root nant project">root nant project</category>
      <category domain="http://securityratty.com/tag/return path">return path</category>
      <category domain="http://securityratty.com/tag/return">return</category>
      <source url="http://www.pluralsight.com/community/blogs/keith/archive/2008/03/07/50388.aspx">Enabling hierarchical nant builds</source>
    </item>
  </channel>
</rss>
