Comments on: The Almost Hopeless Challenge Of Web Security http://www.techcrunchit.com/2009/08/31/the-almost-hopeless-challenge-of-web-security/ TechCrunching the Enterprise Sat, 13 Mar 2010 19:53:11 -0800 hourly 1 By: sfdghsdfd http://www.techcrunchit.com/2009/08/31/the-almost-hopeless-challenge-of-web-security/comment-page-1/#comment-13418 sfdghsdfd Mon, 28 Sep 2009 02:57:15 +0000 http://www.techcrunchit.com/?p=3459#comment-13418 http://www.voguemalls.com HOT SELL: Ed hardy/ lacoste/ polo/ ca/ A&F Tshirt :$12 coach/ gucci/ lv/ ed hardy/ D&G/ Fendi handbag :$35 nike jordan(1-24)/ jordan ring/ nike shox/ air max/ af1/ Dunk :$32 lv/ ed hardy/ gucci/ coach/ lacoste/ timbland :$35 gucci/ ed hardy/ coogi/ evisu/ prada jeans:$30 New era/ gucci/ ed hardy cap:$13 Okely/ gucci/ D&G/ fendi/ coach/ armani sunglass:$15 nike shoes: 32 $, des jeans: 30 $, ed hardy, t-shirts: 12 $, NLF: 20 $, un entra?neur à main: 35 $, bottes UGG: 50 $ http://www.voguemalls.com
HOT SELL: Ed hardy/ lacoste/ polo/ ca/ A&F Tshirt :$12
coach/ gucci/ lv/ ed hardy/ D&G/ Fendi handbag :$35
nike jordan(1-24)/ jordan ring/ nike shox/ air max/ af1/ Dunk :$32
lv/ ed hardy/ gucci/ coach/ lacoste/ timbland :$35
gucci/ ed hardy/ coogi/ evisu/ prada jeans:$30
New era/ gucci/ ed hardy cap:$13
Okely/ gucci/ D&G/ fendi/ coach/ armani sunglass:$15

nike shoes: 32 $, des jeans: 30 $, ed hardy, t-shirts: 12 $, NLF: 20 $, un entra?neur à main: 35 $, bottes UGG: 50 $

]]> By: RubyOnRails XSS Vulnerability Claims Twitter, Basecamp And My Confidence | Submitter http://www.techcrunchit.com/2009/08/31/the-almost-hopeless-challenge-of-web-security/comment-page-1/#comment-12934 RubyOnRails XSS Vulnerability Claims Twitter, Basecamp And My Confidence | Submitter Tue, 08 Sep 2009 14:35:01 +0000 http://www.techcrunchit.com/?p=3459#comment-12934 [...] was only three days ago that I wrote about the almost hopeless challenge of web security, specifically around new vectors [...] [...] was only three days ago that I wrote about the almost hopeless challenge of web security, specifically around new vectors [...]

]]> By: RubyOnRails XSS Vulnerability Claims Twitter, Basecamp And My Confidence | Codedstyle http://www.techcrunchit.com/2009/08/31/the-almost-hopeless-challenge-of-web-security/comment-page-1/#comment-12881 RubyOnRails XSS Vulnerability Claims Twitter, Basecamp And My Confidence | Codedstyle Sat, 05 Sep 2009 12:01:23 +0000 http://www.techcrunchit.com/?p=3459#comment-12881 [...] was only three days ago that I wrote about the almost hopeless challenge of web security, specifically around new vectors [...] [...] was only three days ago that I wrote about the almost hopeless challenge of web security, specifically around new vectors [...]

]]> By: BlogBuzz September 5, 2009 http://www.techcrunchit.com/2009/08/31/the-almost-hopeless-challenge-of-web-security/comment-page-1/#comment-12880 BlogBuzz September 5, 2009 Sat, 05 Sep 2009 10:24:56 +0000 http://www.techcrunchit.com/?p=3459#comment-12880 [...] The Almost Hopeless Challenge Of Web Security [...] [...] The Almost Hopeless Challenge Of Web Security [...]

]]> By: RubyOnRails XSS Vulnerability Claims Twitter, Basecamp And My Confidence | Technology http://www.techcrunchit.com/2009/08/31/the-almost-hopeless-challenge-of-web-security/comment-page-1/#comment-12872 RubyOnRails XSS Vulnerability Claims Twitter, Basecamp And My Confidence | Technology Sat, 05 Sep 2009 01:01:57 +0000 http://www.techcrunchit.com/?p=3459#comment-12872 [...] was only three days ago that I wrote about the almost hopeless challenge of web security, specifically around new vectors [...] [...] was only three days ago that I wrote about the almost hopeless challenge of web security, specifically around new vectors [...]

]]> By: Techcrunch » Blog Archive » RubyOnRails XSS Vulnerability Claims Twitter, Basecamp And My Confidence http://www.techcrunchit.com/2009/08/31/the-almost-hopeless-challenge-of-web-security/comment-page-1/#comment-12867 Techcrunch » Blog Archive » RubyOnRails XSS Vulnerability Claims Twitter, Basecamp And My Confidence Fri, 04 Sep 2009 22:15:13 +0000 http://www.techcrunchit.com/?p=3459#comment-12867 [...] was only three days ago that I wrote about the almost hopeless challenge of web security, specifically around new vectors [...] [...] was only three days ago that I wrote about the almost hopeless challenge of web security, specifically around new vectors [...]

]]> By: Rick Lebherz http://www.techcrunchit.com/2009/08/31/the-almost-hopeless-challenge-of-web-security/comment-page-1/#comment-12866 Rick Lebherz Fri, 04 Sep 2009 19:14:26 +0000 http://www.techcrunchit.com/?p=3459#comment-12866 Good article. I think the nature of the challenge isnt just with in IT and the Tech world. It comes down to human nature and pushing the limits of what is possible. As long as someone creates something of value, someone else will be there trying to pick it a part and poke holes in it. Hopefully the intention is to improve and alert the community and not leverage this for personal gain. But many people are selfish creatures. All you can do is try and stay ahead of the curve. Also along the same lines in case you missed it, OpSource is improving Cloud Security and performance to meet enterprise expectations and requirements. A multitiered architecture, firewalls and load balancing standard (not an option), dedicated private VLANs, Encryptions, SAS 70...yada yada yada...check it out http://www.techcrunchit.com/2009/08/27/opsource-unveils-hybrid-cloud-solution-for-the-enterprise/ Good article.

I think the nature of the challenge isnt just with in IT and the Tech world. It comes down to human nature and pushing the limits of what is possible.

As long as someone creates something of value, someone else will be there trying to pick it a part and poke holes in it. Hopefully the intention is to improve and alert the community and not leverage this for personal gain. But many people are selfish creatures. All you can do is try and stay ahead of the curve.

Also along the same lines in case you missed it, OpSource is improving Cloud Security and performance to meet enterprise expectations and requirements. A multitiered architecture, firewalls and load balancing standard (not an option), dedicated private VLANs, Encryptions, SAS 70…yada yada yada…check it out

http://www.techcrunchit.com/2009/08/27/opsource-unveils-hybrid-cloud-solution-for-the-enterprise/

]]> By: RubyOnRails XSS Vulnerability Claims Twitter, Basecamp And My Confidence http://www.techcrunchit.com/2009/08/31/the-almost-hopeless-challenge-of-web-security/comment-page-1/#comment-12818 RubyOnRails XSS Vulnerability Claims Twitter, Basecamp And My Confidence Fri, 04 Sep 2009 06:59:52 +0000 http://www.techcrunchit.com/?p=3459#comment-12818 [...] was only three days ago that I wrote about the almost hopeless challenge of web security, specifically around new vectors [...] [...] was only three days ago that I wrote about the almost hopeless challenge of web security, specifically around new vectors [...]

]]> By: SpaceMan http://www.techcrunchit.com/2009/08/31/the-almost-hopeless-challenge-of-web-security/comment-page-1/#comment-12811 SpaceMan Fri, 04 Sep 2009 02:34:53 +0000 http://www.techcrunchit.com/?p=3459#comment-12811 If PHP is the center of Web technology... PHP will stand for Pretty Hopeless PHP If PHP is the center of Web technology… PHP will stand for Pretty Hopeless PHP

]]> By: Today Free Tips http://www.techcrunchit.com/2009/08/31/the-almost-hopeless-challenge-of-web-security/comment-page-1/#comment-12748 Today Free Tips Wed, 02 Sep 2009 16:19:34 +0000 http://www.techcrunchit.com/?p=3459#comment-12748 [...] has dropped over the years as our trust in our favorite services grows Yet all the while the... read more or search more on challenge hopeless web » Other posts in Marketing"TheTime is Now" For [...] [...] has dropped over the years as our trust in our favorite services grows Yet all the while the… read more or search more on challenge hopeless web » Other posts in Marketing”TheTime is Now” For [...]

]]> By: The Almost Hopeless Challenge Of Web Security « Jared Rimer’s Technology blog and podcast http://www.techcrunchit.com/2009/08/31/the-almost-hopeless-challenge-of-web-security/comment-page-1/#comment-12709 The Almost Hopeless Challenge Of Web Security « Jared Rimer’s Technology blog and podcast Wed, 02 Sep 2009 05:51:23 +0000 http://www.techcrunchit.com/?p=3459#comment-12709 [...] The Almost Hopeless Challenge Of Web Security. [...] [...] The Almost Hopeless Challenge Of Web Security. [...]

]]> By: David Koretz http://www.techcrunchit.com/2009/08/31/the-almost-hopeless-challenge-of-web-security/comment-page-1/#comment-12692 David Koretz Wed, 02 Sep 2009 03:14:44 +0000 http://www.techcrunchit.com/?p=3459#comment-12692 There are a lot of smart people working on this problem such as White Hat Security, Mykonos Software, Fortify, and others. The end result is going to be a strategy that attacks multiple layers via code scanning, code-level protection, intrusion detection, etc. It's no different than physical security: you lock your doors, and buy an alarm system. The real problem is that the average developer is not trained on application security, and under the pressure of corporate deadlines builds features, not security. There are a lot of smart people working on this problem such as White Hat Security, Mykonos Software, Fortify, and others.

The end result is going to be a strategy that attacks multiple layers via code scanning, code-level protection, intrusion detection, etc.

It’s no different than physical security: you lock your doors, and buy an alarm system.

The real problem is that the average developer is not trained on application security, and under the pressure of corporate deadlines builds features, not security.

]]> By: sh http://www.techcrunchit.com/2009/08/31/the-almost-hopeless-challenge-of-web-security/comment-page-1/#comment-12684 sh Tue, 01 Sep 2009 21:23:26 +0000 http://www.techcrunchit.com/?p=3459#comment-12684 Federal Authority Over the Internet? The Cybersecurity Act of 2009 http://www.eff.org/deeplinks/2009/04/cybersecurity-act Federal Authority Over the Internet? The Cybersecurity Act of 2009

http://www.eff.org/deeplinks/2009/04/cybersecurity-act

]]> By: sh http://www.techcrunchit.com/2009/08/31/the-almost-hopeless-challenge-of-web-security/comment-page-1/#comment-12683 sh Tue, 01 Sep 2009 21:20:03 +0000 http://www.techcrunchit.com/?p=3459#comment-12683 Read this about another security issue: http://www.eff.org/deeplinks/2009/04/cybersecurity-act Federal Authority Over the Internet? The Cybersecurity Act of 2009 Read this about another security issue:

http://www.eff.org/deeplinks/2009/04/cybersecurity-act

Federal Authority Over the Internet? The Cybersecurity Act of 2009

]]> By: Hristo Bojinov http://www.techcrunchit.com/2009/08/31/the-almost-hopeless-challenge-of-web-security/comment-page-1/#comment-12681 Hristo Bojinov Tue, 01 Sep 2009 19:22:07 +0000 http://www.techcrunchit.com/?p=3459#comment-12681 To add to the problem, many devices now feature multiple interfaces that can be used as alternative injection points into the browser. We call this cross-channel scripting (XCS) in a recent talk: http://bojinov.org/professional/BH09_EMI.pdf http://seclab.stanford.edu/websec/embedded/ To add to the problem, many devices now feature multiple interfaces that can be used as alternative injection points into the browser. We call this cross-channel scripting (XCS) in a recent talk:

http://bojinov.org/professional/BH09_EMI.pdf
http://seclab.stanford.edu/websec/embedded/

]]> By: ambert ho http://www.techcrunchit.com/2009/08/31/the-almost-hopeless-challenge-of-web-security/comment-page-1/#comment-12678 ambert ho Tue, 01 Sep 2009 17:48:47 +0000 http://www.techcrunchit.com/?p=3459#comment-12678 "browser manufacturers themselves do not completely understand the issues involved, and in some cases are moving backwards (ie. the new IE8 is now allowing XmlHttpRequest across-ports)" Curious, what's the big deal with allowing XHRs to any port? The API only allows you to initialize the xhr to make HTTP requests with HTTP headers (so it's not like I can open an FTP request, or start arbitrarily talking SQL to port 3306) and even with the IE8 change it's not like you can open connections to other servers - Same-Origin-Policy is still enforced, just not to the same port. So I don't really see how this makes the browser less secure - seems like it was just a feature added to better support SOAP, REST, etc. since some people are going to have their web services listening on nonstandard ports. “browser manufacturers themselves do not completely understand the issues involved, and in some cases are moving backwards (ie. the new IE8 is now allowing XmlHttpRequest across-ports)”

Curious, what’s the big deal with allowing XHRs to any port?

The API only allows you to initialize the xhr to make HTTP requests with HTTP headers (so it’s not like I can open an FTP request, or start arbitrarily talking SQL to port 3306) and even with the IE8 change it’s not like you can open connections to other servers – Same-Origin-Policy is still enforced, just not to the same port.

So I don’t really see how this makes the browser less secure – seems like it was just a feature added to better support SOAP, REST, etc. since some people are going to have their web services listening on nonstandard ports.

]]> By: <fb:name linked="false" useyou="false" uid="507212615">Angela Hayden</fb:name> http://www.techcrunchit.com/2009/08/31/the-almost-hopeless-challenge-of-web-security/comment-page-1/#comment-12677 Angela Hayden Tue, 01 Sep 2009 17:44:04 +0000 http://www.techcrunchit.com/?p=3459#comment-12677 I'm just a simple graphic designer trying to start an online audio tour business and it has been HELL! I can't express in words how much I hate Dreamweaver, Notepad++, CSS, PHP, etc. I'm a starving artist so I have to do everything myself and I also wanted to host everything myself. Instead I'm having to pay E-Junkie to host my mp3 files. My hosting company can't even send me instructions on how to stop someone from sending emails from my business account. My head is spinning from all the e-cart solutions. AnyHoo, thanks for listening. I have to go produce 100 images in photoshop for another project. Oh yea, my shitty site is http://www.hereandthereaudiotours.com I'm editing the page now with a set-up css template using notepad++. I have much work to do. Okay, now I'm crying. Damn it. And another thing, in the last year and a half I've lost data on 3 external hard drives. I'm going to bomb my office. I really have to go now. I’m just a simple graphic designer trying to start an online audio tour business and it has been HELL! I can’t express in words how much I hate Dreamweaver, Notepad++, CSS, PHP, etc. I’m a starving artist so I have to do everything myself and I also wanted to host everything myself. Instead I’m having to pay E-Junkie to host my mp3 files. My hosting company can’t even send me instructions on how to stop someone from sending emails from my business account. My head is spinning from all the e-cart solutions.

AnyHoo, thanks for listening. I have to go produce 100 images in photoshop for another project. Oh yea, my shitty site is http://www.hereandthereaudiotours.com I’m editing the page now with a set-up css template using notepad++. I have much work to do.

Okay, now I’m crying. Damn it. And another thing, in the last year and a half I’ve lost data on 3 external hard drives. I’m going to bomb my office. I really have to go now.

]]> By: The Almost Hopeless Challenge Of Web Security | BIT Blog http://www.techcrunchit.com/2009/08/31/the-almost-hopeless-challenge-of-web-security/comment-page-1/#comment-12667 The Almost Hopeless Challenge Of Web Security | BIT Blog Tue, 01 Sep 2009 14:19:22 +0000 http://www.techcrunchit.com/?p=3459#comment-12667 [...] at ‘cross-site scripting’ one of the latest ‘online security can-of-worms’. Click here to read the original [...] [...] at ‘cross-site scripting’ one of the latest ‘online security can-of-worms’. Click here to read the original [...]

]]> By: ScriptBasic http://www.techcrunchit.com/2009/08/31/the-almost-hopeless-challenge-of-web-security/comment-page-1/#comment-12665 ScriptBasic Tue, 01 Sep 2009 12:00:04 +0000 http://www.techcrunchit.com/?p=3459#comment-12665 It is when you use something BCX Basic to C or BaCon Basic to C to produce fast, small CGI (compiled) scripts. It is when you use something BCX Basic to C or BaCon Basic to C to produce fast, small CGI (compiled) scripts.

]]> By: Mike http://www.techcrunchit.com/2009/08/31/the-almost-hopeless-challenge-of-web-security/comment-page-1/#comment-12664 Mike Tue, 01 Sep 2009 11:57:21 +0000 http://www.techcrunchit.com/?p=3459#comment-12664 C is not a scripting solution. C is not a scripting solution.

]]> By: ScriptBasic http://www.techcrunchit.com/2009/08/31/the-almost-hopeless-challenge-of-web-security/comment-page-1/#comment-12663 ScriptBasic Tue, 01 Sep 2009 11:19:59 +0000 http://www.techcrunchit.com/?p=3459#comment-12663 Or use a non-html parsing scripting solution. I remember when php would parse fake gif files and execute embed code skipping the binary headers. Your much safer using something like C, Python, Perl or my favorite ScriptBasic. These scripting solutions are real programs that do what they are intended to do instead of parsing /executing whatever is passed their way. Or use a non-html parsing scripting solution. I remember when php would parse fake gif files and execute embed code skipping the binary headers.

Your much safer using something like C, Python, Perl or my favorite ScriptBasic. These scripting solutions are real programs that do what they are intended to do instead of parsing /executing whatever is passed their way.

]]> By: James Grinter http://www.techcrunchit.com/2009/08/31/the-almost-hopeless-challenge-of-web-security/comment-page-1/#comment-12662 James Grinter Tue, 01 Sep 2009 10:08:10 +0000 http://www.techcrunchit.com/?p=3459#comment-12662 Even if you don't "trust the web", someone else probably is on your behalf. Or, someone else you've had contact with will do something stupid that has an impact upon you. That's the power of computer networks. (Cross-site scripting attacks are, of course, merely attacks of the defensive programming stratagem "sanitise your input". Just rather a sneaky one, where some thought they could safely sanitise all HTML.) Even if you don’t “trust the web”, someone else probably is on your behalf. Or, someone else you’ve had contact with will do something stupid that has an impact upon you. That’s the power of computer networks.

(Cross-site scripting attacks are, of course, merely attacks of the defensive programming stratagem “sanitise your input”. Just rather a sneaky one, where some thought they could safely sanitise all HTML.)

]]> By: Jonathan http://www.techcrunchit.com/2009/08/31/the-almost-hopeless-challenge-of-web-security/comment-page-1/#comment-12659 Jonathan Tue, 01 Sep 2009 09:25:58 +0000 http://www.techcrunchit.com/?p=3459#comment-12659 I also do not. I also do not.

]]> By: @Nope http://www.techcrunchit.com/2009/08/31/the-almost-hopeless-challenge-of-web-security/comment-page-1/#comment-12658 @Nope Tue, 01 Sep 2009 09:25:04 +0000 http://www.techcrunchit.com/?p=3459#comment-12658 This problem is not about you or me Nope. It's about the safety of the majority. Cloud computing is THE solution for it makes problems the size that can't be ignored ;-) Asking individuals to accepts responsibility is a losing strategy at this point. We need collective solutions so developers & start-ups can start using cloud based services that are safe. This problem is not about you or me Nope. It’s about the safety of the majority. Cloud computing is THE solution for it makes problems the size that can’t be ignored ;-)
Asking individuals to accepts responsibility is a losing strategy at this point. We need collective solutions so developers & start-ups can start using cloud based services that are safe.

]]> By: Dog Training Issues – Refusing to Come When Called Pets http://www.techcrunchit.com/2009/08/31/the-almost-hopeless-challenge-of-web-security/comment-page-1/#comment-12656 Dog Training Issues – Refusing to Come When Called Pets Tue, 01 Sep 2009 05:32:59 +0000 http://www.techcrunchit.com/?p=3459#comment-12656 [...] Today we are trusting the web with our most personal and important data, from private photos and social graphs to finances and key work documents. Our hesitation to share such information has dropped over the years as our trust in our favorite services grows. Yet all the while, the web is actually growing less secure, as sites are left open to new attacks that can spread easily and leave users…Read more » [...] [...] Today we are trusting the web with our most personal and important data, from private photos and social graphs to finances and key work documents. Our hesitation to share such information has dropped over the years as our trust in our favorite services grows. Yet all the while, the web is actually growing less secure, as sites are left open to new attacks that can spread easily and leave users…Read more » [...]

]]>