character encodings considerations in XML parser implementation

I posted questions regarding character encodings considerations in XML parser implementation in the xml-dev mailing list.

See: http://lists.xml.org/archives/xml-dev/200703/msg00074.html

xsd:any and how to interpret the XML Schema standard with regards to it

I opened a thread on xmlschema-dev mailing list regarding interpretation of how to process xsd:any. See: http://xsd.stylusstudio.com/2007Mar/post03001.htm

Threats on Web applications -- nice summary and introduction

Researchers from the Honeynet Project are monitoring attacks by providing systems on which attackers perform their vulnerability exploits. There is a paper listing their findings and conclusions titled: Know your Enemy:Web Application Threats. Using Honeypots to learn about HTTP-based attacks.

The conclusions and future work is listed below:

Conclusions

Web applications present a very high risk, and an attractive target to attackers for the following reasons: Firstly, the quality of the code is often rather poor and many vulnerabilities of commonly used code are published. Second, attacks can often be performed using PHP and shell scripts, which are much easier to develop and use than buffer-overflow exploits. Thirdly, tools such as search engines provide a very easy way for attackers to locate vulnerable web applications. We believe that web servers present relatively high-value targets for attackers since they are more likely to have higher bandwidth connections than the average desktop computer. They will also typically need to access the organisation's databases and so may provide a stepping stone for an attacker who wishes to recover such data.

Although significant effort is being made to improve code quality in many web applications, the volume of existing code, and the amount of new code being written are causing the number of vulnerabilities being reported to remain quite high. (For example, the number one cross-platform vulnerability listed in the SANS Top 20 Survey is web applications.) Since the other factors - public availability, easy exploitation and web applications being easy to locate via search engines - are not likely to change significantly, we can expect to see these trends carrying on into the future.

Future Work

In order to acquire a greater amount of information the deployment process will be stream-lined. Therefore we plan to develop a live CD or an easy-to-install VMware image of our honeypots. Further, the level of detail of the emulation performed by our honeypots will be increased to improve the realism of the simulation and more accurately mimic a genuinely vulnerable web application. These improvements will enable us to observe a wider range of attack patterns and threats that are launched against today's web applications. Finally it would be very interesting to monitor bogus web spiders. This could be done by setting up a new honeypot that denotes its web pages as not-to-be indexed and logs any access to them.

Search using www.keywop.com/

I came across http://www.keywop.com/ which has an ajax interface for a meta search engine. It searches 3 search engines (Yahoo!, Mojeek and NG-Search), but it appears that all relevant hits are from Yahoo! alone.

I'll keep an eye on it.

This month's israel.pm meeting

The next israel.pm meeting will probably take place this week either on Tuesday or on Thursday. No topics and no speakers yet.

I am thinking about dedicating this meeting to fuzz testing and fuzzers

Hopefully, I can solicit Ran Eilam and Yuval Yaari to talk about them...

Let's see how things work out.

Here's the post on israel.pm: http://perl.org.il/pipermail/perl/2007-March/008492.html

Ra'anana Park

We took the kids today to Ra'anana's park where we met some friends.

A new batch of photos is available at http://yeda.cs.technion.ac.il/~yona/aviv/index.html
which adds a new section at http://yeda.cs.technion.ac.il/~yona/aviv/2007/3.2007/index.html

We saw a swan, the kids played soccer, we sailed in the "lake's ship" and had some ice cream.

Interviews, CVs and integrity

I've been doing quite a lot of interviews of candidates for several development and QA positions, and I'm constantly amazed how some people don't write the truth about their knowledge and experience.

It might be that people think that they are more knowledgeable than they actually are.

I don't know.

I met people who claim to be proficient in algorithms, but cannot describe a sorting algorithm. I met people who claim to be proficient in some programming language, but as soon as you present a simple task to be performed in that programming language it turns out that they actually were only participating in a course where that language was used and don't have any real understanding or proficient of it.

What do these people think? Do they really think that their lies will not be exposed? Even if they fool me and others in the interview, don't they think what will happen when they actually start working and be expected to perform?!

Purim

Sivan dressed up as Snow White.

Aviv dressed up as a Pirate. He was really happy that it included a sword.

The kids were excited from the chance of dressing up in colorful costumes and looked forward to meeting their friends at the kindergarden. Just before we took them to the kindergarden, we took some pictures of them together.

A new batch of photos -- Purim

I put last night a new batch of photos.
You can see the kids with their Purim outfits.
See: http://yeda.cs.technion.ac.il/~yona/aviv/index.html and the March section: http://yeda.cs.technion.ac.il/~yona/aviv/2007/3.2007/index.html

There's a new batch of pictures

There's a new batch of pictures. This batch is with my uncle Sabi and with my cousin Selim. Of course, the kids play a key role in the pictures :-)

See: http://yeda.cs.technion.ac.il/~yona/aviv/2007/2.2007/index.html

Negative Security and Positive Security

I find myself a lot lately explaining the difference between positive security and negative security.

Positive Security: a security policy based on modeling of the application or the system that is being defended. Things that agree with the model are considered legal while all other things are suspicious to be illegal.

Negative Security: a security policy based on modeling of the malicious things (e.g., attacks, worms, viruses, and so on). So that things that agree with the model are considered suspicious to be illegal while all other things are considered as legal.

Warming liquids for babies in a microwave oven

I saw a discussion in a Tapuz forum about heating baby liquid food in a microwave oven.

One person claimed that this is forbidden, and I got curious and started asking questions.

See: http://www.tapuz.co.il/tapuzforum/main/Viewmsg.asp?forum=149&msgid=94429245

Should XML parsers know anything about XML namespaces?

I asked a question about XML namespaces on the xml-dev mailing list

The resulting discussion yields that:

* xml parsers know nothing about namespaces
* namespace processing should be done by the application that uses the XML parser
* a validating XML parser should be namespace aware