The din has increased of late over the “need” for AV on all Macs. Historically, there haven’t been a lot of overt malware threats to the platform, and thus it has persisted as a special case, for better or for worse. Commercial solutions have existed for years, and yet in the past few weeks some of those packages have been released for free (presumably because they’re not making much money anyway). Some cite “Boonana” as the latest “big” threat since Koobface… New Mac Trojan uncovered: “Boonana” New Java trojan attacks Mac OS X via social networking sites Of course, then the threat is downplayed… Intego classifies new Mac trojan threat as “minimal” Nonetheless, it seems that there *is* Mac malware…[…]
We know that an 8-character password with upper-case letters, lower-case letters, numbers, and special characters is definitely stronger than a 6-character password with only letters and numbers. But how much stronger is it?
If you haven’t heard of Firesheep yet, I’ll let you go read those details for a bit. When you come back, I want to talk about why SSL is generally not used in these situations – the title gives a hint – it’s all about economics. SSL is still quite expensive in terms of computing power. Sure, not for your computer when you’re browsing, but for a server which is handling thousands if not millions of requests per second? That’s a lot of the CPU (and RAM) being dedicated to just SSL, not counting whatever service the server is providing. There are hardware SSL accelerators, but they are also fairly limited: this one claims up to 14,000 transactions per second.[…]
Back in January, Google announced they would pay between $500 and $1,337 for bugs in their Chromium web browser code, if the discoverer first reported it privately to them and followed certain conditions. Since then, the company has handed out quite a few bounties to security researchers who found problems. Now, Google has expanded the program by offering similar bounties for vulnerabilities in their web-based applications. Hackers who find issues such as HTML injection or cross-site request forgery in important Google services can now report them and possibly qualify for rewards ranging from $500 to $3,133.70. As with the Chromium bounties, bug hunters have to follow a few rules and conditions, such as giving Google some time to fix the[…]
AntiXSS is an open source .NET assembly available for download from Microsoft (source here). This library provides much more flexible XSS protection in .NET applications than the built-in Server.HTMLEncode() approach, as it adds support for XML and LDAP filter encoding in addition to HTML encoding. By allowing flexible and secure encoding and decoding of strings for these types of data, application developers can breathe a little easier when accepting data across trust boundaries. Libraries such as AntiXSS that perform string processing are incredibly useful for developers, for several reasons. First, they are maintained separately from your code base, so any updates to the string processing functions for emerging threats can be applied without much hassle. Second, by using a code[…]
You may have seen Ben’s post earlier this week on Firesheep. I am running a Mac and I use FileVault, as I recommend most people do in order to protect their sensitive files. Unfortunately the current release of Firesheep does not support FileVault. That didn’t stop me, here is what you need to get Firesheep running on Firefox 3.6.x on a Mac running FileVault from start to finish. Download the Firesheep .xpi file here. Drag the .xpi file into your Firefox browser window to install it, then quit Firefox. Move the extension folder from your user account to the application folder. The /Users/[youraccount]/Library/Application Support/Firefox/Profiles/[yourprofile]/extensions/firesheep@codebutler.com folder should be moved into the /Applications/Firefox.app/Contents/MacOS/extensions folder. Relaunch Firefox, and you should be good to go. If[…]