Some thoughts on the mod_security acquisition
295229
And its consequences for Apache Column First, a public service announcement. The next European ApacheCon event will be held in Amsterdam, in the first week of May. The Call for Papers is now open at http://apachecon.com/. There will be a US ApacheCon in November. Now to the column.â¦
654370
Pierre-Alain Joye has a little reminder posted to his blog today about two posts from planet-debian and Apache that refer to clones/references in PHP4 and PHP5 and some of the misconceptions presented there.   Reading planet-debian and Apache (from Sven and David), I catched two posts about clones and references in php4 and php5. I do not think it is worth to explain again everything here as Sara wrote a very good post already, check it out here.   He mentions his annoyance with articles/posts like these and the impact that it has on PHP as well as the person posting.   I wonder when the OS community in general will be mature enough to stop bitching at each other. And that's valid for PHP developers, gnome-kde and other well established wars.
697316
3Com makes a play for security. But is it enough for investors?
40472
In response to this recent article from the Hiveminds website, Marco Tabini has a few choice words about some of the topics they cover in the article, and cover incorrectly.   Over the last few years, I've made it a point of trying to respond to at least some of the "PHP is dead"-type articles that crop up on the Net from time to time. The latest one comes from Hiveminds and reveals a complete misunderstanding of almost every point it covers.   He notes that though the article seems to be a coherent whole for why PHP is dwindling, it's "based on nothing more than a string of misinformed concepts cobbled together to give the appearance that the author knows what he or she is talking about". Marco comes back against each of the points made in the article, setting things right and eliminating some of the FUD (fear, uncertainly, and doubt) that the Hiveminds article spreads.
132922
Open-source spam blocker gets legal makeover with switch to Apache license. Oh, and tech upgrades.
447369
A new key acquisition will bolster its RSA division.
635724
In a new post on his blog, Christian Wenz mentions the latest results of the SANS Institute's Top 20 Internet Security Attack Targets list which both includes a new entry ("Users") and several mentions of PHP and PHP-related applications.   Of course you can debate how such a Top list came together and what the real value behind that is, but there are two specific points in this year's list that I found quite interesting.   There's two targets for the PHP community to worry about - sysadmin/hosting and things developers need to keep in mind. Items on these lists include:  Always test and deploy patches and new versions of PHP as they are released Use Intrusion Prevention/Detection Systems to block/alert on malicious HTTP requests. Consider using Apache's mod_security to block known PHP attacks If you use PHP, migrate your application to PHP 5.2 as a matter of urgency. Encode all output using htmlentities() or a similar mechanism to avoid XSS attacks  You can check out the full information over on the SANS Institute website.
386296
The facts of web servers don't necessarily match the myths when it comes to security.
633805
First, thanks for the great comments on yesterday's post about Apple and the hard disk of my MacBook. People were universally positive and helpful, and I can say I really learned some really important things as a result of the discussion. First, the cost of the data on the hard disk swamps the value of the value of the disk and even the value of the computer. There was source code on the computer, and other information, which if it fell into the wrong hands, could cause some serious problems for me. I have no agreement with Apple that covers the security or privacy of the data. As far as I know they think they own the contents of the disk as well as the disk itself. The experience I had with them actually makes me think they probably do feel its theirs. This from a company that takes the security of its own private information very seriously, they seem to have almost no regard for the security of its customers' information. You have no control over when a hard disk will crash, or any foreknowledge of when it's even likely to crash. So there's no way to protect against this kind of security issue. And that's what it is. What kind of sense does it make to invest in firewalls, and of what value is Apple's claim that Macs are inherently more secure, when all the data on one of my computers is now completely out of my control forever? I'm not so concerned about the privacy issues, but I could imagine that other people might be. And if identity thieves are not aware of this backdoor way to get access to private information, how long before they are? Security experts always warn us that obscurity is not a good strategy for security. So what to do?  Basically I've given up on trying to get Apple to do the right thing and give me my disk back. Some people at the Emeryville store are well-itentioned, and are just naive about the problems that can come when you trust people with all your data. Others just don't care. Either way it seems unlikely that I'm going to get it back, and even if I do, it's been out of my control for too long.  I'm going to go through the tedious job of changing the passwords on all my sensitive online accounts. That was overdue anyway. And next time a laptop blows its hard disk, I'm either going to replace it myself and shred the old disk, the same way I'd shred any sensitive documents before throwing them out, or just throw away the whole computer. I know this isn't green, but there seems to be no other course that's anything close to secure. And always be aware that you could lose a laptop, or it could be stolen. So far it seems that this is not yet an identity theft concern, but you can't be sure, and it won't be long before it is.  Thanks again for all the good info, advice and vibe.
673641
Plus: More DRM standards, and a self-encrypting hard drive.
42444
PÃ¡draic Brady has a quick update today pertaining to the PHPSecInfo project - a new manual (currently in development).   I'll keep adding to it over the days, weeks and months ahead. The current form is going to be mainly a draft. When it's done, I'll go through it and do some serious editing. Next priority is getting in the material on actually using and implementing PHPSpec...   You can find the manual at http://dev.phpspec.org/manual/ with quite a bit of content already filled out. Topics currently covered include installation guides, your "first steps", testing the code and some examples of it in use.
387344
On 20 November 2004, a major malicious-code attack emerged targeting European Web sites via banner ads. This two-step attack exploits two previously identified security vulnerabilities: the Bofra (or IFRAME
347402
In this new post on the PHP Security Blog, Stefan Esser brings up an interesting issue when dealing with web applications - being able to bind a script/application to a different port on the local machine.   Unfortunately the ability to bind yourself to a port and receive connections is a threat to webapplications installed on different virtual hosts on the same IP, even if other security measures in place, like tight filesystem permissions or executing PHP script with the permission of the owner.   He gives an example in PHP of how this can happen and one of the scary side effects of having it in the same domain - the cookie information is passed in. It's a simple concept that could have very bad consequences in the wrong hands.    Additionally, you don't even have to create it in PHP either. As cyberlot mentions, it could be created in any language that has socket functions. Be sure to check out the comments for more thoughts and comments on the post.
4497
Within days of the release of the security bulletin, there was proof of concept code available on the web. As the exploit was analyzed by various security groups, it was found that it was similar
465789
(InfoWorld) - Breach Security will acquire Thinking Stone, which develops and provides support for an open-source Web application firewall called ModSecurity, the companies announced Monday. Thinking Stone, based in London, is run by Ivan Ristic, the primary developer of ModSecurity. Ristic will become chief evangelist for Breach while continuing to work on ModSecurity. Financial terms of the deal were not released. "It has been clear to me for some time now that I've done all I could working on ModSecurity on my own," Ristic wrote in his blog. "The limited resources available to me have become the main bottleneck." Web application firewalls lock down Web application servers, which can be used to run e-commerce sites that handle credit card and customer information, making them fertile targets for hackers. ModSecurity monitors and logs HTTP (HyperText Transfer Protocol) traffic in real time going to Web applications. It also monitors networks for unusual behavior and common attacks on Web applications. ModSecurity is strong on its technical merits but weak on its user interface, wrote Michael Gavin of Forrester Researchin a June 2006 report. But the open-source project has built a strong user community, and more than 10,000 modules are in use in production environments, he wrote. Breach Security was one of ModSecurity's competitors. Other rivals include market leader NetContinuum, Citrix Systems, Imperva, and F5 Networks, Gavin wrote. Thinking Stone offers a free version of ModSecurity and licenses versions with more advanced features, as well as offering customer support services. Breach Security plans to release several products based on ModSecurity over the next few weeks. They will include an upgrade to ModSecurity 2.0, a Web-based console to monitor the application's sensors, and a Web application security hardware appliance.
582154
The new native IPsec implementation for 2.6.x kernels greatly improves the security of Linux systems.
366947
Lukas Smith is sending a wakeup call to the internet providers and web hosters out there - get involved in the PHP community!   We do not seem to have any ISP's active inside the PHP community. This is kind of odd, considering that PHP seems to be driving the business of hosters quite a bit. Why have none of them decided that PHP is important enough for their business that its worthwhile to ensure that their interests are taken into account?   He makes the suggestion of passing along the suggestion to bosses/co-workers/anyone who'll listen about getting involved. Suggested places to start would be as a part of the testers group or even contributing to the migration guide.