Web Development Bookmarklets

Web Development Bookmarklets:
"These bookmarklets let you see how a web page is coded without digging through the source, debug problems in web pages quickly, and experiment with CSS or JS without editing the actual page."

http://www.squarefree.com/bookmarklets/webdevel.html

Choose Your Camera

Choose Your Camera:
"Like PCs, cell phones, and cars, digital cameras come in many sizes, shapes, and configurations. And your buying decision is likewise one you'll have to live with for a while. So break the decision down into a series of factors, then compare cameras based on how well they meet your needs, factor by factor. To determine which camera is best for you, consider image quality, performance, ergonomics, and style, your level (current or hoped for) of photographic skills, and price."

http://www.pcmag.com/print_article/0,1761,a=135159,00.asp

http://www.pcmag.com/article2/0,1759,1648802,00.asp

Internet Task Force Shuts Down MARID Anti-Spam Working Group

Internet Task Force Shuts Down MARID Anti-Spam Working Group:
"Citing a lack of agreement on basic issues in the discussions of the working group, the IETF (Internet Engineering Task Force) has disbanded the MARID (MTA Authorization Records In DNS) working group. The group had been working to create a standard for mail authentication for the fight against spam, mail worms and other e-mail abuse.

The group's short history has been fraught with controversy. The most recent crisis was over intellectual property claims by Microsoft over technologies in some of standards under consideration, and the Microsoft license to those claims. Open source advocates and many others rejected the terms as burdensome and incompatible with their own licensing practices. "

But there has been more disagreement than consensus in the group in other areas as well. Advocates for similar methods of authentication have continued to argue strenuously for their favorite approaches, many of which may be covered under the claims of Microsoft in their patent applications.

There have been other problems. Recently it was noted that the name "Sender ID," which had been used by the standards documents for many of the proposals, has a trademark claim by a company that does related work.

In an e-mail to the working group, the co-Area Director Ted Hardie said that effort to formulate a single standard was hampered by a lack of real-world experience with the proposals. The directors recommended that the work of the various proponents move forward to Experimental RFC status, and that actual tests of the proposals proceed. They hope this experience will clarify some of the debates in the group.…

Questions may also be raised over potential actions by the US government. In June the FTC rejected calls to create a Do-Not-Spam registry and noted that it couldn't work without a system of authentication. The FTC report actually contemplates mandating a system of authentication if the industry doesn't agree on one after a period of time.

http://www.eweek.com/article2/0,1759,1649763,00.asp?kc=ewnws092304dtx1k0000599

Code to exploit Windows graphics flaw now public | Tech News on ZDNet

Code to exploit Windows graphics flaw now public | Tech News on ZDNet:
"A sample program hit the Internet on Wednesday, showing by example how malicious coders could compromise Windows computers by using a flaw in the handling of a widespread graphics format by Microsoft's software.

Security professionals expect the release of the program to herald a new round of attacks by viruses and Trojan horses incorporating the code to circumvent security on Windows computers that have not been updated. The flaw, in the way Microsoft's software processes JPEG graphics, could allow a program to take control of a victim's computer when the user opens a JPEG file.

'Within days, you'll likely see (attacks) using this code as a basis,' said Vincent Weafer, senior director of security response for antivirus-software company Symantec. 'This is dangerous in a sense that everyone processes JPEG files to some degree.' "

The program is the latest example of "exploit code," a sample that shows others how to create attack programs that can take advantage of a particular flaw. Such code preceded the Sasser worm by two days and the MSBlast worm by nine days.

The critical flaw the program exploits has to do with how Microsoft's operating systems and other software process the widely used JPEG image format. Because the software giant's Internet Explorer browser is vulnerable, Windows users could fall prey to an attack just by visiting a Web site that has JPEG images.

The flaw affects various versions of at least a dozen Microsoft software applications and operating systems, including Windows XP, Windows Server 2003, Office XP, Office 2003, Internet Explorer 6 Service Pack 1, Project, Visio, Picture It and Digital Image Pro. The software giant has a full list of the applications in the advisory on its Web site. Windows XP Service Pack 2, which is still being distributed to many customers' computers, is not vulnerable to the flaw.…

http://news.zdnet.com/2100-1009_22-5378260.html

Identity Theft and Spyware- The New Threat

Identity Theft and Spyware- The New Threat:
"Obviously one of the latest and most dangerous threats to privacy in the digital age lies at the doorstep of spyware. Spyware can be used to surreptitiously gather all types of confidential information and in most cases the user has no idea the information is being taken. This form of “snoopware” lets the spy access everything you do online including usernames, passwords, online shopping purchases and e-mail or chat correspondence. In the hands of an identity thief this type of information is a deadly treasure trove.

Many of today’s most popular spyware applications promise the ability to execute via “remote installation”. Remote installation is the ability to put a spyware program on a computer without having physical access to the machine. Obviously this is crossing a thin line into illegal behavior and this type of software should be classified as a Trojan horse. Nevertheless, these programs are sold every day to consumers who want to monitor their kids, employees, or spouse and perhaps to people that have more nefarious purposes in mind. While there are certainly legitimate uses for monitoring software we find it hard to believe there is any legitimate scenario where a parent or employer would need to use remote installation to install a monitoring program. Make no mistake that spyware can certainly be used to illegally obtain your personal information"

http://www.spywareguide.com/articles/identity-theft.html

Spyware Guide Database - Spyware, Malware and Adware

Spyware Guide Database - Spyware, Malware and Adware:
"The Spyware Guide was created to provide an all inclusive and updated resource on spy ware applications, what they do and how they’re used. These resources include: which software applications can detect and defeat spyware, an extensive database of all known spy software and adware applications and contact information as well as other privacy related products."

http://www.spywareguide.com/

Spychecker - download spyware removal and Internet privacy tools

Spychecker - download spyware removal and Internet privacy tools:
"Whether you are concerned about your online privacy or have suspicions that someone may be spying on your PC activities, you'll find a solution here that you can download and try, or even use it for free. All software has been downloaded and tested before it was listed."

The Spychecker Web site contains a database of applications known to have spyware attached. If you are considering installing a questionable application, try searching for the application in the Spy Checker database (powered by Spyware-Guide) to see if it contains spyware. http://www.spywareguide.com/

http://www.spychecker.com/home.html

Weekend Project: How to punch up your portable - CNET reviews

Weekend Project: How to punch up your portable - CNET reviews:
"The 20-year reign of sealed, proprietary laptops is nearly over. Today's mobile PCs are well on their way to becoming almost as upgradable as desktop PCs. You can often swap out everything from the memory to the CPU and, in some cases, even the graphics card--pretty much everything under the keyboard, other than the motherboard.

Not all laptop lines are equally upgrade-friendly, though, and most vendors still resist articles encouraging readers to grab their screwdrivers and muck around inside their laptops. (We're not sure whether they're worried about accidental hardware damage or lost service revenue.) In general, you'll have an easier time working on a second-tier brand, or a whitebook, because the internal components in these models are usually easier to reach and replace. "

http://reviews.cnet.com/4520-10163_7-5506183-1.html?tag=bnav

Om Malik on Broadband: The Voice over IP Insurrection

Om Malik on Broadband: The Voice over IP Insurrection:
"The $3 billion dollar budget at Bell Laboratories did not include a single project addressing the use of data networks to transport voice when VocalTec Communications released InternetPhone in February 1995. As of 2004, every project at the post-divestiture AT&T Labs and Lucent Technologies Bell Labs reflects the reality of voice over Internet Protocol. Every major incumbent carrier, and the largest cable television providers, in the United States has announced a VoIP program. And even as some upstart carriers have used VoIP to lower telephony prices dramatically, even more radical innovators threaten to lower the cost of a phone call to zero—to make it free.

The VoIP insurrection over the last decade marks a milestone in communication history no less dramatic than the arrival of the telephone in 1876. We know data networks and packetized voice will displace the long standing pre-1995 world rooted in Alexander Graham Bell's invention. It remains uncertain whether telecom's incumbent carriers and equipment makers will continue to dominate or even survive as the information technology industry absorbs voice as a simple application of the Internet.

The roots of the VoIP insurrection trace back to four synchronistic events in 1968. The Federal Communications Commission (FCC) ruled MCI could compete with AT&T using microwave transport on the Chicago to St. Louis route. The same year, the FCC's Carterfone decision forced AT&T to allow customers to attach non-Western Electric equipment, such as new telephones, and modems, to the telephone network. The Department of Defense's Advanced Research Project Agency issued a contract to Bolt Beranek and Newman for a precursor to the Internet. And in July 1968, Andrew Grove and Gordon Moore founded Intel. Innovation in the communication sector remained the proprietary right of AT&T for most the 20th century, but events in 1968 breached the barriers that kept the telecom and information technology industries apart. For the first two-thirds of the 20th century, AT&T had manned Berlin Wall separating telecommunications and computing, but eventually, these two enormous technology tracks would be unified.

Two entrepreneurs barely out of their teens, Lior Haramaty and Alon Cohen, founded VocalTec Communications in 1993 based on the promise of packet voice technology they observed as members of the Israel Defense Force. Most military command and control used the highly survivable TCP/IP distributed data networks since the 1980's. The challenge of transporting voice over the networks arose as an imperative to support certain very sensitive voice commands like "drop the bomb", but the idea of commercializing packet voice did not occur to anyone until the arrival of Lior and Alon. How could slicing voice into 50 millisecond packets improve the telephone business? The tradition bound telephone industry types or "bellheads" spent their time before 1995 improving the Public Switch Telephone Network (PSTN) not replacing it."

http://www.gigaom.com/2004/09/the_voice_over_i.php

RSS Comes with Bandwidth Price Tag

RSS Comes with Bandwidth Price Tag:
"Popularity comes with price, as Web publishers of XML syndication feeds are learning the hard way.

According to feed publishers, as the use of Really Simple Syndication news feeds grows so too does the bandwidth they consume and the demands they put on Web servers. Some Weblogs and technology Web sites are rethinking the way they publish their RSS feeds as they find that frequent requests from newsreaders, the applications that aggregate feeds, can strain their resources."

http://www.eweek.com/article2/0,1759,1648627,00.asp?kc=ewnws092104dtx1k0000599

Overview - Windows NT 4.0 and Windows 98 Threat Mitigation

Overview - Windows NT 4.0 and Windows 98 Threat Mitigation:
"This guide identifies security issues in networks that include computers running the Microsoft® Windows NT® 4.0 and Windows® 98 operating systems, and explains the best hardening strategies that an organization can use until they are able to upgrade these operating systems."

http://www.microsoft.com/technet/security/guidance/threatmi.mspx

Open Source Security: Still a Myth

Open Source Security: Still a Myth:
“by John Viega

Does the open source process guarantee better security than proprietary development methods do? Not necessarily, warns John Viega. There are several security challenges facing open source software that many developers have so far failed to recognize.”

“In the real world, it's rare that someone reviewing code for security will perform a thorough audit. Line-by-line review is often not feasible, simply because the human mind can't retain a detailed understanding of a large code base. Generally, people have tools to support them. Those tools are a starting point for manual inspection, which focuses on the findings of the tool and looks to see whether there's actually anything to the problem.

"Real" analysis tools are just starting to hit the market. The tools people use tend to be simple ones that don't do sophisticated analysis--grep-like tools such as RATS and flawfinder. A few commercial companies offer "web scanners" that look for common vulnerabilities in an application using a fuzz-like approach (you pick the inputs you think might exercise a common problem, give it a go, and see what happens). The problem with black-box testing for security is that most programs are complex and have states that an automated crawler isn't likely to find. Security problems are often buried in complex systems. Finding them with such an approach would require heavy user interaction to put the system into a large number of different states.

With both the grep-like tools and the black-box testing tools, you will almost always have a large number of false positives to sift through. Most potential auditors throw up their hands in frustration pretty quickly. Those who don't will usually focus on only a few of the reported issues. Even research tools such as BOON tend to have incredibly high false-positive rates.”

The Myth of Open Source Security , http://www.developer.com/tech/article.php/626641

Why Open Source Software/Free Software? Look at the Numbers! , http://www.dwheeler.com/oss_fs_why.html

http://www.onlamp.com/pub/a/security/2004/09/16/open_source_security_myths.html

Download details: Application Compatibility Guide for Windows XP SP 2

Download details: Application Compatibility Guide for Windows XP SP 2:
"Windows® XP SP2 introduces new security technologies to better enable Windows XP computers to withstand viruses, worms and other kinds of attacks. This guide will assist IT Professionals to test and mitigate application compatibility issues arising from these more stringent security technologies."

Microsoft® Windows® XP Service Pack 2 (SP2) introduces a set of security technologies that improve the ability of Windows XP systems to withstand malicious attacks, and provides the IT administrator with system wide security configuration capabilities.

SP2 is more secure by default, and thus automatically provides Windows XP systems with improved protection. However, because system security becomes more restrictive upon initial installation, SP2 may also expose application compatibility issues. It is important that an investigation into possible application compatibility issues takes place prior to full deployment.

This guidance discusses the security technologies, an application testing process, incompatibility symptoms, mitigation techniques, and deployment scenarios. It makes no assumption about the size or complexity of the network, and is as relevant to peer-to-peer environments as it is to Active Directory environments.

File Name:	AppCompat-XPSP2.msi
Download Size:	2956 KB
Date Published:	8/25/2004
Version:	1.0

http://www.microsoft.com/downloads/details.aspx?familyid=9300becf-2dee-4772-add9-ad0eaf89c4a7&displaylang=en

Visual Web Developer 2005 Express Edition Beta

Visual Web Developer 2005 Express Edition Beta:
"Visual Web Developer 2005 Express Edition is a lightweight, easy-to-use and easy-to-learn development tool focused exclusively on Web development. Inside, you will find everything you need to begin building exciting, dynamic Web applications with ASP.NET 2.0. "

Visual Web Developer 2005 Express Edition provides everything you need to begin building Web applications with ASP.NET 2.0. It provides:

• Visual designers that make creating Web applications easy via an easy-to-use drag-and-drop interface
• Powerful code editor with rich functionality such as IntelliSense that makes writing code and HTML faster
• Quickly create data-driven Web applications using the built-in data controls and integrated access to Microsoft SQL Server 2005 Express
• Support for multiple languages, including Visual Basic, C#, and J#
• Get started using the built-in, fully functional starter kits like the Personal Web Starter Kit

Simple management

Create your applications in Visual Web Developer 2005 Express Edition, and then easily deploy using the built-in Copy Web tool that streamlines the process. Visual Web Developer 2005 Express Edition includes support for creating and consuming Web services, validating applications across multiple browsers, and easily running and debugging your code using the built-in test Web server, without having to have access to IIS.

Personal Web Starter Kit
Inside Visual Web Developer 2005 Express Edition is the Personal Web Starter Kit , a fully functional sample application that will help you get up and running quickly. This Starter Kit provides all the basic functionality you need to build your own personal Web site, including a balanced and customizable look and feel, a Web-based administration system, rich photo gallery, membership, role management, and more.
http://lab.msdn.microsoft.com/express/vwd/starterkit/default.aspx

http://lab.msdn.microsoft.com/express/vwd/default.aspx