21 juin 2008
New Web Server...
Since yesterday, I am renting a web server on OVH to host my own developments (open-source) and begin to re-construct web sites on my own.
I work as a LAMP Consulant, web developer, mysql admin (specialized on replication and performance-tuning).
I have done many great websites on the past, including motos.com (sold to a swiss company), ibazar (licensed to the iBazar company and sold to eBay), seloger (I was an associate), and many many others... :-)
Since I left France to come to Canada, 2 years ago, I didn't focus on my own web sites (and domains), but on working for companies to earn money and provide stability for my family. (hope a new member will enter our lifes ;-) )
So, I rant this server, and I began yesterday a set-up, a long way to have a strong secure server as I don't plan to put html content on it and let it flow but build a professionnal infrastructure that includes security as a base requirement, both in term of being attack-resistant (no-one is attack-proof) and replicated (locally and on my home).
I will share with you the different step I choose to do, from renting a private server with a GNU/Linux Distribution to having a professionnally working web+email+ftp+bind server.
06 mars 2008
WordPress 2.3.3 empty() bug
PHP4 empty() function consider that the string '0' (a zero in a string) is an empty string.
This is a clear rule, and you should avoid using empty() too extensively, it's relatively easy to end-up with a 0 on a string...
On example of that is WordPress 2.3.3 (current version) that have real ugly code, total lack of engineering and undocumented tricks to "help things".
One of these tricks is to test for an user id or login name to be
"empty" on WP_User()->__construct($id, $name). If both $id and $name
are "empty" the function return without setting anything.
So when this function is called to get user '0' (where it's name is a 0 on a string), nothing will happen...
The code of WordPress is full of shit like that, undocumented buggy "tricks", known, documented and easily exploited security holes (such as using addslahes() instead of mysql_real_escape_string() because the developper doesn't know function_exists() !!!).
Please Open-Source developpers, try to write correct code!
25 février 2008
Rendition movie
I just saw the Rendition movie. That explain why I wont accept to pass someone else's AirMile card when I shop, and more...
Some countries practice torture, on soil or sending people on foreign countries.
Some groups practive terrorism, and torture.
They are not so different!
So it's a new start for the encryption posts, to protect mine privacy and yours.
To protect your IP (Intellectual Property), your privacy, and mine too.
06 février 2008
iStat Pro 4.5 Widget, bundled with sources
This is not open-source, but an error of the iSlayer company, and iStatPro 4.5 is now distributed with all the sources inside, alongside with the UniversalBinary executable!
You could check on "iStat Pro.bundle/Content/Resources/s/" within the iStat Pro Widget (using the terminal, this is easier)
It was probably not intended to be distributed that way (and it wasn't in previous versions!) and I left a message on the company contact form about this problem...
27 janvier 2008
MySQL AES_ENCRYPT error rate on erroneous encryption/decryption key
As stated on MySQL documentation:
"If AES_DECRYPT() detects
invalid data or incorrect padding, it returns
NULL. However, it is possible for AES_DECRYPT() to return a
non-NULL value (possibly garbage) if the
input data or the key is invalid."
In fact if the wrongly decrypted last char is 0F (hexa), all 15 previous characters will be considered as valid, so error is approximately 1/256 (0.4%). There's other cases but they are statistically not signifiants.
On a 1Million user base, AES_DECRYPT() will send back results (invalid) for approximately 4000 accounts, when the encryption/decryption key is erroneous.
26 janvier 2008
MySQL AES_ENCRYPT flaws
MySQL integrate a AES_ENCRYPT function, that should encrypt (128bits encryption) a string with a key. A reversible encryption.
The company that actually hire me use the AES_ENCRYPT function to encrypt user passwords.
There's 3 problems in the way it is done by the company:
- There's no need to reversible encryption, a simple SHA-1 fingerprint should be enough (will be subject to dictionary attack if not properly salted, globally + individually!)
- The encryption KEY is common to all the user base (NO SALT), rapidly growing (10K+ each day!), leading to possible search of the encryption key knowing only one account on a test server. So any developer could know any user password and use it's account if it see an encrypted Password ;-)
- Encryption key is in pur ascii, so it's only 112 bits encryption (16 characters x 7bits) instead 128bits Key
And now there's the MySQL part of the bad job, to weaken the encrypted content...
The AES encryption encrypt content using 16-bytes blocks (128bits).
When you encrypt a password (15 chars or less, usually 6-8 chars) with AES_ENCRYPT() on MySQL, MySQL create a block that contain the password followed by it's length repeated on each following Byte.
So a 'toto' password will be transformed to:
74 6F 74 6F 04 04 04 04 04 04 04 04 04 04 04 04
Yes you read it: even if you didn't know the length (given it's on the 6-8 char web account password), the last 8 chars contains less than 2 real bits of informations (6, 7 or 8, encoded and repeated), leading to attack on the AES itself, for example to try to reveal the encryption key!
There's no need to add the length on each remaining byte of the message, once is enough (at the end of the block naturally), and all remaining space should have been filled with truely random information, as they will be discarded on the AES_DECRYPT() function!
Sorry MySQL, but another time, you made it wrong from start!
Worse, as many DB use the AES_ENCRYPT() function, and they could be used to do COMPARE on SELECT(), this wrong behaviour could not be changed without breaking compatibility with installed user-base!
Please! Consider security seriously next time!
31 décembre 2007
TimeMachine RESTORE Tutorial
As you may have experienced it, TimeMachine is the perfect backup solution that I'll be waiting for years, so many...
You'll never lose another file, if you assign enough room for your TimeMachine volume, definitly!
You forget it's working, some user may even use it without knowing it (if setup by an IT-specialist), ...
It backup many Volumes from a Mac, and it even backup asynchronously external Hard Drives (either USB or Firewire) transparently! Purely magical!
But if you want to restore a volume that is not your Startup Volume (usually "Macintosh HD"), this is another story and you'd better read this before trying anything! Even before using TimeMachine at all, cause it may save your day!
USE A TIME MACHINE HARD-DRIVE THAT AS ROOM ENOUGH
Room enough depend on your paranoia level.
TimeMachine will use at least the sum of your actual datasets, but if you RESTORE from TimeMachine, you'll have to add room for each newly restaured Volume as well!
(is it a bug or a "feature" from Apple, restauration on another Volume will ALWAYS be counted as new data being added!)
So better is to sum all the Data Size of al your volumes, and add at least the dataset size of one or two of the largest (yes they will be counted twice). And a work margin of 20-50%.
Example:
Macintosh HD 50GB
Pictures 30GB
Music 15GB
You'll end-up with 30+50+15=95MB as a base line, to which you'll add 50MB (doubling your largest hard-Drive), up to 145MB and add a margin, ending up with 170-220MB.
If you prefer to do it simply, consider doubling the whole dataset, and take the Hard-drive that has enough room to store it! Easy!
CAUTIOUSLY NOTE YOUR VOLUMES NAMES
You have to note IMMEDIATLY all your Volumes names, as they appear in the finder. Store it on a paper on your Vault!
*** I REPEAT : NOTE IMMEDIATLY YOUR VOLUME NAMES ON A PAPER *** DO IT *** NOW!!! ***
To restore a volume, you have to find it's files using the TimeMachine.
But TimeMachine doesn't show unmounted Volumes data, and it will be cumbersome to try to find the exact datas you had on your Volumes, you'll loose Folder Structure, and so on!
In fact, it is practically impossible to restore a Volume without having another disk that has the same EXACT Volume name!
Please! Note all your volumes name! Pleeaaasssseeee...
AFTER DISK CRASH, CREATE A VOLUME WITH THE SAME EXACT NAME
As indicated before, you MUST have a Volume with the same exact name of your old crashed hard-drive.
First use the Disk Utility to reformatte your new volume to HFS+ (or FAT if it will be used with Windows too), and give it THE SAME EXACT NAME THE CRASHED VOLUME HAD.
Once it has been done (2 minutes!), you will be able to restore... but another operation needs to be done before!
STOP THE TIMEMACHINE!!!
You have to stop the TimeMachine, using Apple->Preference Panel->Time Machine->OFF!
If you don't stop the TimeMachine you could end with both your restore operation failed and the last TimeMachine backup failed too!
(Yes I am on Leopard 10.5.1)
RESTORE NOW USING THE TIME MACHINE
Open the TimeMachine, click on your new Volume at left (that has the same exact name as the crashed one), it will appear empty (that's good).
Click on the upper arrow at right, the TimeMachine will expose the main folders of the crashed disk within seconds. Select All (Apple-A) and clique on the RESTORE button!
Finder will reappear with the copy taking place.
Wait for the copy to be done (it will take minutes or hours depending on dataset to copy!).
Check that all your subfolders are copied too, using the Finder.
REACTIVATE THE TIME MACHINE AUTOMATIC BACKUP
Got to the Preference Panel (Apple->Preference Panel->Time Machine->ON), and backup manually the new disque (Clt-Click on the Docked TimeMachine, choose Backup Now).
TimeMachine will backup the new Hard-drive separately from the dataset of the crashed one, it's unavoidable at this time (Apple has to fix it!), so be sure you have enough room on the TimeMachine hard drive to backup both (the old backup will stay for long ;-), perhaps for ever until Apple fix that!).
Now you are up and running! Enjoy!
Happy New Year to all!
29 décembre 2007
WebDesigner needed!
To develop new MAIL3/Leopard Templates, I need a webdesigner who like to create for Open-Source or Copyleft movements (Creative Commons, free use even commercial, attribution).
His/her role will be to design templates, mine will be to transform them to the Stationnery package format used by Apple. No retribution other than faith and fame ;-)
All the work will be distributed under Creative Commons free use (even commercial) with attribution.
Thanks by advance!
28 décembre 2007
MAIL3 Templates (Mac OS X 10.5 Leopard)
I am on vacation these days, so I created some MAIL3 Templates, free to use (as in free beer), free to be modified (as in free thinking)...
Naturally you must have Mac OS X 10.5 Leopard to use them with MAIL3!!!
Installation:
- You should do it from an administrator account
- Close MAIL3 (your Mail client), using "Quit"
- Download the iAPX-en.zip file
- Open the finder on the startup Disk root. (may be "Macintosh HD")
- Go to the Folder "Library/Application Support/Apple/Mail/Stationery" (you must see an Apple sub-folder)
- Copy here the iAPX-en.zip file.
- Do right-click or ctl-click on the iAPX-en.zip file, and Open With -> Archive Tool (default)
- The iAPX Folder must appear (all is right!)
- Remove the .zip file, it is useless by now!
- Reopen MAIL3
- Do "New Message " (File->New Message)
- Click on "Show Stationery" Icon.
- Go down on the stationery categories list, you will find "iAPX -2008" and if you click on it you will see 6 Stationery (New York, Montreal, Paris, Amsterdam, Canada and a Generic one).
Usage:
You could use them the same way you use Apple Stationeries, you could freely modify the text over the pictures (including font, font size, font color) and the example text.
They work the same way the Appl Stationneries works.
PS: The picture could not be changed on these stationnery (Generic template only wallow this), it is purely intentional. I will release some picture-modifiable Stationneries on January.
License:
All this work has been done under the Creative Commons Attribution-Non Commercial 3.0 United States License. Feel free to use it, to remix or modify it, to redistribute it (original or modified) with correct Philippe Vigier / iAPX.info author information.
Enjoy and I wish you an happy new year!
07 décembre 2007
Symfony PHP5 Framework
I am actually working on a migration from a procedural+object PHP5 application to the Symfony framework model, and it is a pleasure to discover: Symfony seems to be modern, simple, elegant and goal-oriented, far from theorical model that didn't work on the real world or pieces of spaghetti-code that work but is ugly and unmaintenable!
They learn from Java, Ruby on Rails, and many others, and they do their own mix that is a real pleasure to discover. Symfony is probably the framework to try, if you have full control of your server (including php.ini INCLUDE_PATH variable).