McAfee SiteAdvisor

This is a great free plugin for Firefox and MSIE. After installation of the plugin, web links particularly in search engines like Google will contain an image/icon displaying a level of trust as well as some basic information about the website.

As a website owner, it is recommended that you add your site. To do so, you must first prove that you can publish content on the website. This is accomplished by submitting a form, after which you are given a filename (typically the domain with a ‘randomized’ hashcode) to create on your website.

NOTE: when doing this you must also insure that your website generates proper “404 Not Found” HTTP errors for non-existent files, as the verification process also tests that scenario.

Once listed, McAfee will scan your website for vulnerable downloads, reviews, related (linked) websites, as well as track outbound email (possible SPAM) generating from your domain.

References:

Here’s to a safer online experience.

MSIE6 javascript memory leaks

Argh…. yet again, this crappy product has another bug that developers must work around!

It seems that Microsoft doesn’t release memory to javascript objects from memory when created on a page… even when the page is unloaded.

Let’s think about this one for a second, why would you want to keep a javascript variable or DOM reference in memory after the user has navigated away from that page? This violates the stateless paradigm that web applications generally work with, besides… how would a developer be able to get that information (memory) back on the next page anyways? Perhaps, it was some genious that tried to keep state in javascript when the ‘BACK’ button was pressed… we’ll probably never know.

There’s a great quote I found while researching this…

“IE has an issue where it leaks memory when a circular reference is created between a COM object and a javascript object. In IE, the DOM is implemented via COM ….. This memory is not reclaimed until the browser closes. The simplest solution is to pretend there is no garbage collector for objects and make sure you always clean-up after yourself.”

References:

Microsoft ‘chimes in’:

Tools to help:

Cheers!

Automated Java code review tools

I recently found out about ‘static analysis’ of Java code. I’ve found two of these tools that are both free and easy to use. Both provide review of java bytecode and look for common development errors and inefficiencies…
FindBugs is based on the concept of bug patterns. A bug pattern is a code idiom that is often an error. Bug patterns arise for a variety of reasons:

  • Difficult language features
  • Misunderstood API methods
  • Misunderstood invariants when code is modified during maintenance
  • Garden variety mistakes: typos, use of the wrong boolean operator

PMD scans Java source code and looks for potential problems like:

  • Possible bugs – empty try/catch/finally/switch statements
  • Dead code – unused local variables, parameters and private methods
  • Suboptimal code – wasteful String/StringBuffer usage
  • Overcomplicated expressions – unnecessary if statements, for loops that could be while loops
  • Duplicate code – copied/pasted code means copied/pasted bugs

Both integrate easily within Eclipse based (and other IDE’s) is typically done with the use of a simple plugin.

FindBugs can also run as a Java WebStart (JNLP) application, however a different UI is shown for JRE 1.4 vs. 1.5 and above (look out!).
More information:

While no tool can identify all problems, these will help you find some troublesome problems and give you areas to take a deeper look at.

Happy reviewing and fixing.

Installing Perl CGI on Apache (for Windows)

Installing Perl on a Win32 installation of Apache is trivial. Just a few short years ago (roughly the year 2000) most commercial website still ran large amounts of Perl code. Several open-source projects like BugZilla still rely on this powerful scripting language.

Here’s a few simple steps and advice to consider when the need comes to add this feature to your installation.

  1. Download Perl for Win32 – ActiveState Perl is the standard distribution to use, and installation is a snap.URL = http://www.activestate.com/Products/ActivePerl/a) Get the MSI file version as it’s executable (the AS version is a ZIP file for manual installs)

    b) The default path it chooses is “C:\Perl”, I advise that you use “c:\usr” instead as it makes it easier to port programs to and from UNIX/LINUX.

    c) The MSI installer takes care of the PATH file settings, so you should have no other work for installation.

  2. Modify the Apache httpd.conf file to enable (uncomment or add the following lines).

    AddHandler cgi-script .cgi
    AddHandler cgi-script .pl

  3. Restart Windows to ensure that the new configuration is available to the operating system.
  4. Test your install…a) Create a new file on the server named /cgi-bin/hello.pl with the following content:

    #!/usr/bin/perl
    print “Content-type:text/html\n\n”;
    print “hello world”;

    b) Start (or restart) the Apache service.

    c) Access the file in the browser, example:

    URL = http://localhost/cgi-bin/hello.pl

    d) If everything works, you should see the words “hello world”, otherwise, if you see the source code or ‘500 Server Error’ then the config has a problem.

Happy Scripting.

Custom JavaScript error notification

Debugging JavaScript errors is a time-consuming effort requiring keen eyes and a sharp mind.

MSIE typically only gives a cryptic ‘Object Expected’ error message and little more (even with the Microsoft Script Debugger installed!).

Some tools like FireBug and the Venkman debugger (both for Mozilla/Firefox) help in this matter, but often it helps to have an alert when an issue occurs.

Here’s a simple implementation that I’ve found useful…

[script type=”text/javascript”]
window.onerror=myErrorHandler;

function myErrorHandler(msg,url,l){
var txt=”There was an error on this page.\n”;
txt+=”Error: ” + msg + “\n”;
txt+=”URL: ” + url + “\n”;
txt+=”Line: ” + l + “\n\n”;
txt+=”Click OK to continue.\n\n”;
alert(txt); return true; }
[/script]

REFERENCES:

That’s it….

java.policy file

While it’s not preferred or even ‘secure’, sometimes the need arises to ‘open’ up the Java security model.   Fortunately this is an easy task.

This is located in a file named ‘java.policy’ in the “JRE/lib/security” folder.

Default file (from JRE 1.5.0.x) resembles the following…

// Standard extensions get all permissions by default

grant codeBase “file:${{java.ext.dirs}}/*” {
permission java.security.AllPermission;
};

// default permissions granted to all domains

grant {
// Allows any thread to stop itself using the java.lang.Thread.stop()
// method that takes no argument.
// Note that this permission is granted by default only to remain
// backwards compatible.
// It is strongly recommended that you either remove this permission
// from this policy file or further restrict it to code sources
// that you specify, because Thread.stop() is potentially unsafe.
// See “http://java.sun.com/notes” for more information.
permission java.lang.RuntimePermission “stopThread”;

// allows anyone to listen on un-privileged ports
permission java.net.SocketPermission “localhost:1024-“, “listen”;

// “standard” properies that can be read by anyone

permission java.util.PropertyPermission “java.version”, “read”;
permission java.util.PropertyPermission “java.vendor”, “read”;
permission java.util.PropertyPermission “java.vendor.url”, “read”;
permission java.util.PropertyPermission “java.class.version”, “read”;
permission java.util.PropertyPermission “os.name”, “read”;
permission java.util.PropertyPermission “os.version”, “read”;
permission java.util.PropertyPermission “os.arch”, “read”;
permission java.util.PropertyPermission “file.separator”, “read”;
permission java.util.PropertyPermission “path.separator”, “read”;
permission java.util.PropertyPermission “line.separator”, “read”;

permission java.util.PropertyPermission “java.specification.version”, “read”;
permission java.util.PropertyPermission “java.specification.vendor”, “read”;
permission java.util.PropertyPermission “java.specification.name”, “read”;

permission java.util.PropertyPermission “java.vm.specification.version”, “read”;
permission java.util.PropertyPermission “java.vm.specification.vendor”, “read”;
permission java.util.PropertyPermission “java.vm.specification.name”, “read”;
permission java.util.PropertyPermission “java.vm.version”, “read”;
permission java.util.PropertyPermission “java.vm.vendor”, “read”;
permission java.util.PropertyPermission “java.vm.name”, “read”;
};

The replacement to remove all restrictions…

grant {
permission java.security.AllPermission;
};

Just be sure to restore your settings back to ‘normal’ before visiting any untrusted websites or java applications.

Online backups

We all occasionally suffer lost of vital documents, or entire hard-drives full of them. Backups are an essential tool in preventing most loss…. but performing them is often a tedious task. Copying files and/or burning them to disk is time consuming and easily overlooked when you are overwhelmed. A few months ago I found Mozy, it provides a free, and simple interface that schedules and backs up your files online…. as such all you need to do it schedule it and forget it (of course your computer also needs to be online).

Restoring files is done through their web interface, and while it sometimes takes a few hours, you get an email notification that it’s available for download as a ZIP file.

You get 2GB for free and can purchase more… referrals get you (me in this case) an additional 256MB… please check it out at: https://mozy.com/?ref=3UEYUK

OpenDNS

I’ve used EveryDNS (free service) for years to host my DNS services.    Recently I found that they now offer public DNS service for lookups as OpenDNS.   While I still run my own private DNS server for caching and various private addresses.  I now do a simple forward lookup to their servers to gain the extra services they provide… notably Phishing  and typo protection.

Setup is very simple for most users, and even a non-technical person should have no problems following their installation instructions for a single computer/device or an entire network.
Happy networking!!!

Mozilla cache folder

Due to my UNIX background,  I’ve found it helpful, for both security and performance reasons to relocate your ‘cache’ or temporary files to a new location (Unix/Linux gurus may prefer /tmp/) here’s the simple process for doing this on a Windows machine using Firefox.

This is useful for several reasons:

* Moving many of your ‘tmp’ files/folders to a single location makes it easier to “clean house”.
* If you move ‘tmp’ to a separate drive or partition (like in UNIX), your primary drive will be less fragmented and may even show increased performance.

Firefox didn’t make this as easy to change as MSIE, but it’s a trivial matter. Find and edit the prefs.js file in your Profile directory and add the following…

user_pref(“browser.cache.disk.parent_directory”, “C:\\temp\\Mozilla”);

Alternately, you can type “about:config” in the URL/address line of the browser and add the String…

browser.cache.disk.parent_directory with a value of “C:\\temp\\Mozilla”

If you want to keep your existing cached files, you can always copy them over from the old location.

For Windows XP with MSIE6/7, the disk cache location is easily changed in the Internet Control Panel, on the General tab, Settings button. Microsoft seems to change that control panel with every new OS/browser version, but it’s generally named similarly on different configurations.

Good luck !

Windows Remote Desktop (aka Terminal Services) Port Change

There often becomes a need to remotely access/administer a Windows machine.   While I’d normally recommend using a different method such as an VNC connection over a VPN or a SSH Tunnel, you MAY get away with using the built in services.   Even so, using the default port 3389 may prove troublesome with some security mechanisms such as firewalls and proxy servers.   Here’s a simple way around it all…To change the default port for all new connections created on the Terminal Server:

  1. Run Regedt32 and go to this key:
    • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
  2. Find the “PortNumber” subkey and notice the value of 00000D3D, hex for (3389). Modify the port number in Hex and save the new value.
    • NOTE: Ports 80 and 443 are recommended because they route well across various networks.

Good luck… now go out and find a “safer” method!