6078 items (0 unread) in 72 feeds
Watchfire Application Security Insider
sirdarckcat
Google Online Security Blog
Switch/Twitch
mybeNi websecurity
cat slave diary
Alex's Corner
Billy (BK) Rios
Chris Shiflett
christian's weblog
GNUCITIZEN
The Spanner
hackademix.net
Ruby on Rails Security Project
It's a shampoo world anyway
ha.ckers.org web application security lab
Yet Another Infosec Blog
PHP Security Blog
Sunnet Beskerming Security Advisories
Disenchant's Blog
Sylvan von Stuppe
Larholm.com
Jeremiah Grossman
Anurag Agarwal - Application Security Evangelist
Ivan Ristic
omg.wtf.bbq.
Tactical Web Application Security
tssci security
Plynt Penetration Testing Blog
Security Retentive
Schneier on Security
Rational Survivability
terminal23
1 Raindrop
hiredhacker.com
Matasano Chargen
Michael on Security - Musings on Information Security
Fortify blog
GDS Security Blog
Vodun.org
Mark Curphey - SecurityBuddha.com
Liminal states
Security Ripcord
IBM Internet Security Systems Frequency X Blog
This blog is finally dead.
Because the domain name limited me to blog about PHP security only I moved to the domain suspekt.org that I own for many years now. Please update all your links and feeds to point to the new URL where I will continue blogging on a regular basis.
PHP Speedy is a PHP script by aciddrop.com that can increase your web site loading time by as much as 500%.
The key to this decrease in loading time is “making fewer HTTP requests, adding a far-future expires header, gzipping your page’s components, and minifying your JavaScript, CSS and HTML”. PHP Speedy accomplishes all of these techniques.
Now, there is also a PHP Speedy Wordpress plugin available. It would be interesting to see a comparison between PHP Speedy and WP Super Cache.
Personally, I haven’t tested PHP Speedy, but it looks promising. Let me know if you have tried PHP Speedy and what your results are.
PHP Speedy [via codefusionlab.co.cc]
![[del.icio.us]](http://images.del.icio.us/static/img/delicious.small.gif)
Update: This seems to have fixed itself one night. Maybe I rebooted? Who knows. Anyway, all seems good now.
So I use SFTPDrive on my Vista workstation at work to mount remote filesystems. It generally works pretty well, and I’ve never had an issue where a program didn’t treat my mount as a local drive — until I decided to give upgrading to Zend Studio for Eclipse a go (licenses for which were generously donated to CERIAS by Zend). For some reason, ZSfE just doesn’t show me my “k:” drive (the SFTP mount) when browsing for a project directory. This throws a real wrench in my usual workflow — ZS 5.5 had built-in SFTP support, and I could also use the local mount if I wanted.
I did look in Zend’s Support KB and the forums, but did not come across anything like this. Have you? Any alternatives for directly connecting and editing over SFTP?
Introduced Clint Ecker to Jason Perkins, both Chicago-based web devs. They discover that they work literally next door from one another.
Had lunch with Jason Perkins and the rest of the Pixish crew. Surprisingly was not mocked incessantly for not using Rails. They’re good peeps, and Pixish is a cool site.
I wonder how far the Zuckerberg “keynote” set back female journalism. That’s a hari-kari situation right there.
If you are unwilling to say to someone’s face what you say in your little gadget (or otherwise) blog, you need to shut up. Stop being a punk.
I was really happy to see ExpressionEngine and CodeIgniter represented as strongly as they were at SXSW. I still feel strongly that EE is the strongest CMS product in its market (which includes Drupal, Joomla, Wordpress and the like), and the improvements in EE2.0’s administration system will increase productivity considerably.
Holy shit, I have never seen as many iPhones as I did there. And it’s taking some effort on my part to not go get one now. I could have left my laptop in the hotel room if I’d had one, which would have reduced my fatigue considerably. Since I am doing about 4 conferences a year, it’s starting to make more sense. I’m making myself wait for a new hardware revision, though (and I really can’t afford one atm).
The panel on the success of icanhascheezburger.com was interesting, and I think underlines that luck is a (the?) key component for almost all of these rags-to-riches stories
Being with someone — or a small group — seems key to me. I think I would have enjoyed SXSWi a lot less if I was not able to always count on the two friends I was with.
Do not be afraid to come up and talk to people. It’s hard for me to do, but I was always glad I did. I got to meet old internet-only friends like Violet Blue because of this (so glad I did!). I also got a hug from Halcyon, which was awesome — more dudes should be down with hugs.
Meeting Alex Payne was another highlight of SXSW for me. What a great guy; I wish we’d had more time to hang and talk. And there were so many others, like Derek Allard, Jonathan Snook, Ken Fisher (thanks again for dinner Monday night), Thomas Myer, C. Eric Smith, Obie Fernandez (I wish he’d written Rails), Stephanie Booth, and many others whom I’m too forgetful to remember at the moment.
Frank Warren’s keynote on his PostSecret project was the highlight of SXSW for me. It was funny, tragic, inspiring, and compelling. One could not help but be inspired, as exemplified by the man who asked his love to marry him in front of the entire audience. Technology empowering us to express ourselves, communicate, and aid one another is so much of what the last few years in web dev has been about, and we would do well to follow the example set by Frank Warren.
Oh hell yes I’m coming back next year
Introduced Clint Ecker to Jason Perkins, both Chicago-based web devs. They discover that they work literally next door from one another.
Had lunch with Jason Perkins and the rest of the Pixish crew. Surprisingly was not mocked incessantly for not using Rails. They’re good peeps, and Pixish is a cool site.
I wonder how far the Zuckerberg “keynote” set back female journalism. That’s a hari-kari situation right there.
If you are unwilling to say to someone’s face what you say in your little gadget (or otherwise) blog, you need to shut up. Stop being a punk.
I was really happy to see ExpressionEngine and CodeIgniter represented as strongly as they were at SXSW. I still feel strongly that EE is the strongest CMS product in its market (which includes Drupal, Joomla, Wordpress and the like), and the improvements in EE2.0’s administration system will increase productivity considerably.
Holy shit, I have never seen as many iPhones as I did there. And it’s taking some effort on my part to not go get one now. I could have left my laptop in the hotel room if I’d had one, which would have reduced my fatigue considerably. Since I am doing about 4 conferences a year, it’s starting to make more sense. I’m making myself wait for a new hardware revision, though (and I really can’t afford one atm).
The panel on the success of icanhascheezburger.com was interesting, and I think underlines that luck is a (the?) key component for almost all of these rags-to-riches stories
Being with someone — or a small group — seems key to me. I think I would have enjoyed SXSWi a lot less if I was not able to always count on the two friends I was with.
Do not be afraid to come up and talk to people. It’s hard for me to do, but I was always glad I did. I got to meet old internet-only friends like Violet Blue because of this (so glad I did!). I also got a hug from Halcyon, which was awesome — more dudes should be down with hugs.
Meeting Alex Payne was another highlight of SXSW for me. What a great guy; I wish we’d had more time to hang and talk. And there were so many others, like Derek Allard, Jonathan Snook, Ken Fisher (thanks again for dinner Monday night), Thomas Myer, C. Eric Smith, Obie Fernandez (I wish he’d written Rails), Stephanie Booth, and many others whom I’m too forgetful to remember at the moment.
Frank Warren’s keynote on his PostSecret project was the highlight of SXSW for me. It was funny, tragic, inspiring, and compelling. One could not help but be inspired, as exemplified by the man who asked his love to marry him in front of the entire audience. Technology empowering us to express ourselves, communicate, and aid one another is so much of what the last few years in web dev has been about, and we would do well to follow the example set by Frank Warren.
Oh hell yes I’m coming back next year
jQuery built into EE now
Basically, if EE needs something, CI gets new feature
jQuery built into EE now
Basically, if EE needs something, CI gets new feature
Just a quick note that I wrote an article for the new C7Y PHP community site on Inspekt:
If you’re interested in Inspekt and have questions or would like to contribute, please check out the Inspekt user group.
Just a quick note that I wrote an article for the new C7Y PHP community site on Inspekt:
If you’re interested in Inspekt and have questions or would like to contribute, please check out the Inspekt user group.
$_FUCKO
$_FUCKO
I was interviewed for a piece on odinjobs.com (“Odin Jobs?”) about “Why PHP Rocks”. Other, smarter people who were also interviewed include:
I was interviewed for a piece on odinjobs.com (“Odin Jobs?”) about “Why PHP Rocks”. Other, smarter people who were also interviewed include:
Paul Reinheimer 8:43
did you plug funcaday yet?funka7ron 8:53
*hides* I need to get on datPaul Reinheimer 8:54
Here’s what I’m going to do: I’m going to bring a few copies of my book, see
They roll up nice and tight
I’m going to beat you with them
then shove them a few places, and light them on fire
I’m super excited about Funcaday, the brainchild of Paul Reinheimer and Courtney Wilson. What a cool concept - basically an electronic daily calendar for PHP functions.
The RSS feed delivery is just begging for little desktop apps and widgets. Ben Ramsey has already made one for the OS X dashboard.
Kudos to Paul and Courtney!
Paul Reinheimer 8:43
did you plug funcaday yet?funka7ron 8:53
*hides* I need to get on datPaul Reinheimer 8:54
Here’s what I’m going to do: I’m going to bring a few copies of my book, see
They roll up nice and tight
I’m going to beat you with them
then shove them a few places, and light them on fire
I’m super excited about Funcaday, the brainchild of Paul Reinheimer and Courtney Wilson. What a cool concept - basically an electronic daily calendar for PHP functions.
The RSS feed delivery is just begging for little desktop apps and widgets. Ben Ramsey has already made one for the OS X dashboard.
Kudos to Paul and Courtney!
A friend of mine just sent me the URL to a flash game (for obvious reasons I will not share the link) which is part of a number of games with a price of 10.000 EUR in the end. One would believe that a game with such a price money is secure. Especially when the organising party is an internet provider.
But guess what... At the end of the flash game you can optionally submit your score to the highscore server, which results in a POST to the file submithigh.php with several parameters, one parameter saying score=XXXX. And of course you can submit whatever score you want. So now I lead the highscore with 10000 of about 900 possible points. I set it that high to ensure that the guys at the ISP will realize that this is faked, but imagine I had just increased the current highscore by 10. I seriously doubt anyone would have noticed and I would have won the competition without even decompiling the flash.
Alex Payne did a much better job expressing this that I could in my slightly addled state:
I enjoy programming in Ruby, but it doesn’t have the crisp simplicity that I prefer. Syntactical shortcuts inherited from Perl combined with upteen different ways to write a given expression make the language extremely flexible, but also extremely complex. It’s possible to write clean, minimal Ruby, but such code rarely takes full advantage of the language. Idiomatic Ruby is powerful but complicated. While Ruby programs are often shorter than their equivalents in other languages, line density frequently offsets length for rapid comprehension.
That’s always something I’ve noticed with Ruby - that it borrows too many “magic symbols” from Perl for my liking. I strongly dislike idiomatic code because reading it is too much like parsing hieroglyphics. To some extent you’re gonna get that with any computer language, and a lot of it is dependent on what you’re used to syntactically, but I do think there are tendencies for some languages to be more or less “readable.” PHP does a pretty decent job of it; I think Python is even better in this regard, and probably why I dig the language a lot.
Clearly the free booze and other gifts provided to the php|arch team is paying off, as two of my talks have been accepted for php|tek 2008 in Chicago. I’ll be speaking on desktop app development with AIR, and the PHPSecInfo project. The full schedule of talks will help you plan on how best to avoid me.
Desktop app dev with AIR has been something near and dear to my heart lately, as I’ve spent a lot of time in the past several months developing Spaz, a Twitter client based on AIR. In the process I’ve learned a whole heck of a lot about Javascript development, and learned intimately what works well in AIR and what doesn’t. Combining PHP on the server side and Javascript/HTML on the client side makes a lot of sense for me, then. Getting the two sides to work together has gotten a fair bit easier with the JSON extension that was added in PHP 5.2.0. With that, exchange of data structures carries a lot less overhead.
PHPSecInfo has been quiet for a while on the development side, but I’m hoping things will pick up a bit with the introduction of public SVN access to the project. The trunk version has some extra stuff in it, like the beginnings of a new view system to output results in various formats. I’ve also added Paul Reinheimer as a contributor, so feel free to guilt him into making updates as well. If you’re interested in contributing patches or updates to PHPSecInfo, drop me a line and we’ll chat.
Maintaining focus has never been one of my strong suits, but I’ve been doing a fairly bad job of it lately even for me. So, I’m finally posting the slides from my two talks a DC PHP:
I think my talks went okay, but not great. Definitely could have been more prepared and presented more useful information, especially in the Inspekt talk. It’s the first time I’ve done a talk on that project, so I still am feeling that one out a bit, whereas I’ve talked about PHPSecInfo a few times before this.
The DC PHP Conference was a nice surprise. It was clearly still in the learning stages, but everyone was friendly and happy to help, and the organizers definitely seemed interested in sorting out what worked and what didn’t. I believe they said the next one will be in July 2008; I hope to be there!
My friend Derek Allard, of CodeIgniter fame, is concerned about the GPL licensing he chose for his open-source web application BambooInvoice:
Around February of this year, a CodeIgniter user contacted me privately to point out that someone was re-distributing BambooInvoice as their own work. I’m not going to use any names or URLs (no point in adding any publicity to them), but they essentially called it “their business”-Invoice. So they offered it for download under a different name, and claimed it was their invoicing software. They offered a “demo” (identical in every way to Bamboo) and it was apparent to me that all they really did was a giant search and replace of the word “Bamboo” with “their business”. No credit to me. No mention of Bamboo, no CodeIgniter license (that was visible), nothing - just a wholesale search and replace.
Derek has clearly thought about this issue a lot, but I bet he could use some sage advice from people who have been through similar situations. If you have, please consider reading his post and offering some input. Derek’s given a lot to the OSS community via CodeIgniter, and I think we should help him out here.