Security

Interesting reading about Google Safe-Browsing and Chrome Privacy Leak.
http://ha.ckers.org/blog/20090824/google-safe-browsing-and-chrome-privac...

------------------------------------------------------------------------
Cross-Site Scripting (XSS) in IDLogger website statistics version 7.7
------------------------------------------------------------------------

Author: Audun Larsen (larsen at xqus dot com)
Date: August 13, 2009

--AFFECTED SOFTWARE--------------------------

Name: IDLogger
Version: 7.7
Website: http://www.idlogger.com

Dictionary files are files containing all kinds of words excellent for brute force password attacks.
Here are my collection. Some of them made by me, and other collected around the internett.

Netcraft reports that 14% of SSL Certificates are signed using md5.

A team of researchers (including one Norwegian) has managed to break the technology that issues trusted certificates for secure websites (SSL). As a proof of concept they executed a practical attack scenario and successfully created a rogue Certification Authority (CA) certificate trusted by all common web browsers.
The long, official version and the short version. Happy reading.

I just got to ask you this: Is security bugs just normal bugs? Or should they be treated special?

The reason I ask, is because of a statement made by Linus Torvalds in a discussion on the Linux kernel mailinglist just a few days ago.

So I personally consider security bugs to be just "normal bugs". I don't
cover them up, but I also don't have any reason what-so-ever to think it's
a good idea to track them and announce them as something special.

Today, I released version 0.8-dev of Munin, my PHP application firewall.

Munin 0.8-dev is available for downlod here.

I just posted this to Bugtraq, so I'll post it here to.

------------------------------------------------------------------------
Cross-Site Scripting (XSS) in phpWebSite 1.4.0 search
------------------------------------------------------------------------

Author: Audun Larsen (larsen at xqus dot com)
Date: Dec 29, 2007

--AFFECTED SOFTWARE--------------------------

Name: phpWebSite
Version: 1.4.0
Release date: Dec 11, 2007

Developed by the Web Technology Group at Appalachian State University,
phpWebSite provides a complete web site content management system ( CMS ).

I often find myself in the need to create a md5/sha256 hash for various reasons. Most of the time I use Google to find a javascript tool that i can use. This is fine, but a bit inconvenient, so i decided to create a little script that can create all sorts of hashes from a string.

phpSysInfo 2.5.4 was released yesterday, to fix a security issue.

The latest release of phpSysInfo can be downloaded here.