Posts by Adam

Exploit code for Kaminsky DNS bug goes wild

SSL vulnerable

> No way of knowing? Try SSL.

> If your bank is relying on DNS to prove their identity for online banking, then it's

> time to take your cash somewhere else.

Not quite, you need to think bigger.

SSL works by (and forgive me if I oversimplify):

1. Client sends server a list of crypto functions it supports

2. SSL server responds with its digital certificate and the strongest crypto function they have in common.

3. Client validates digital certificate against certificate authority

4. If client satisfied of authenticity, client generates a random number

5. Client encrypts random number (4) using public key inside certificate (2)

6. Client sends encrypted number to server (only server can decrypt)

The question that is really hard to answer is whether step 3 can be reliably done with a compromised DNS server. If they are spoofing the IP address for your banks website, are they able to create a fake certificate and spoof the IP address of the certificate authority?

Google gives GMail always-on encryption

@Lorax

It would be nice but it is impractical. SSL connections can not by definition be cached (caching is also called eavesdropping when you don't want the caching to occur). No ISP has the sort of bandwidth infrastructure to do provide internet without caching. Also, latency is doubly worse for 99% of websites that have no need to secure data.

What is needed is for more providers to do what Google has done here; to redirect users to the secured Login screen and keep communications over SSL for the entire session.

Five misunderstood Vista features

Has anyone actually used it?

I have never had any real problems with Vista. Yes, it was slow in network copies, but that was patched months ago. SP1 dealt with the few other annoyances. It boots up, logs in to usable desktop, and shuts down than it does running XP.

According to extremetech, Vista equals and often outperforms XP SP2 and XP SP3 in PCMark05, 3DMark06, World in Conflict, Supreme Commander, and Crysis.

And anyone who has actually used Vista will know that UAC doesn't really show itself any more often than sudo would be required.

World economy group gives IPv6 big push

Exhausing IPv6

"IPv6 is all well and good but I was at a seminar recently that pointed out the IPv6 will be out of addresses by 2013"

No.

In fact there is about 50,000,000,000,000,000,000,000,000,000 IPv6 addresses per person alive today. I think we will be good for a while yet.

Automated crack for Windows Live captcha goes wild

@Pascal

Your method of sending a flash animation is just as easy to break as any existing solution. Mouse clicks don't get sent over the internet, they are simply messages in a queue on your local machine. When the flash application gets around to polling the message queue, it notes the message and can react to that. At the end of the day, your security model involves you trusting the communications from the flash running on the client when it says the click occurred at the right moment.

The best method I have seen is a combination of some form of captcha and some obscurity techniques. You can create form elements, but use CSS to make sure certain elements are never visible to the user. Most bots will randomly fill in different fields (particularly if they have a common name like Password), but because you know that a user could not have seen that field, anything that filled that field must be a bot. It is not foolproof, someone studying your CSS would discover this trick and could code around it, but it might be sufficiently annoying. You can not outrun a lion, but you can usually outrun the bloke behind you.

Sure it is 'automated'?

One attack vector that has been used is to redirect the image to a user of their own servers.

The spammers host a website usually containing warez or pornographic images, and ask their users to type in a captcha text to get the content. The captcha image however is one they have just grabbed from the whatever services' new account page. When the user types in the captcha, the web server simply passes that on to the spamming bot so it can create the account.

One plug to rule them all

Will not happen

Put simply, wires are deprecated means of transferring data. Wireless (be that Bluetooth, WiFi, or whatever) is the sensible way to transfer data to and from a phone. Even wired hands free kits could disappear except for the FM radio needing the cable to work as an antenna.

They could I suppose agree on a standard power cable, but then how could they charge 10 quid for a charger with their logo on it?

One programmer's unit test is another's integration test

Nice article Kevin,

I would suggest though that the most important point about unit testing is that it formally defines the business rule that is in the original programmers head at the time it is implemented. I have worked on projects with very little documentation and no unit tests which have had few bugs. The bugs were avoided because the original programmer understood their design and made sure not to break any rules. But as the program was enhanced, and other developers who were not intimately involved in the original design started working with the different units, problems start emerging.

I don't see design and unit testing as different entities. I see unit test definition as a design step. If you don't want someone setting a property to a negative value, don't just commit to yourself that you will never do it, write a 5 second unit test that fails in that scenario.

Customer requirements are seldom static easily defined problems. Most of the time, customers themselves do not understand every nuance about what they want, and having good unit test coverage will give you more confidence to remodel your application and data structures when you understand the problem domain better.

The question of scope is to me the most complex side of unit testing, and I believe this to be because there is no simple answer. There is usually no limit to additional test cases that can be created, but there is usually a point of diminishing returns. The real key is knowing what is necessary and when to stop.