Saturday, January 13, 2007

There are a series of 5 webcasts from Microsoft with two of the best counter-hacker guys, discussing AJAX security and how to protect your AJAX applications.

This is a must for anybody doing serious AJAX development.

The announcement came on Joe On .NET and is linked below:

Upcoming AJAX Security Webcasts

 

On the other hand, the ASP.NET team has released a nifty little library called the Microsoft Anti-Cross Site Scripting Library.  Useful for encoding all input other than those specified as OK.  You can learn more about it and download it from http://www.asp.net/downloads/teamprojects/default.aspx?tabid=62#antixss

posted on Saturday, January 13, 2007 1:13:03 AM (India Standard Time, UTC+05:30)  #    Comments [10] Trackback
 Friday, January 12, 2007
posted on Friday, January 12, 2007 6:15:24 PM (India Standard Time, UTC+05:30)  #    Comments [0] Trackback
 Tuesday, January 09, 2007

Microsoft started off CES with a Bill Gates pre-keynote address.  BillG started saying that this is probably the last time he gets to go on the CES stage and talk about technology!  :(  I don't buy that completely though :)

However, the address was very exciting with some of the stuff that was never demo'ed before.

There was Windows DreamScene - something quite amazing spectacular and something that was a hush-hush thing at Microsoft for a while now.  Of course, it is another UI glitz, with playing videos now being able to be set as the desktop background.  I got to install a small internal BETA today and it works great.  Sure looks exciting and I think the Vista Ultimate Edition users will love the feature (that'll ship as a Vista Ultimate Extra).

If you haven't seen DreamScene, you should watch the CES keynote.

One of the biggest announcements yesterday was Windows Home Server.  Windows Home Server is the vision of having a server in every home that takes care of backend infrastructure for the digital home.  In many ways, a "home server" makes perfect sense to orchestrate all the digital devices that make up today's homes.  Hook up your Media Center PC, your laptop, your personal computer, your XBox, your Windows Mobile phone and everything to the backend server and let it manage backups, synchronization, and a lot more for you.  That's the message.  However, to learn more, you can also check out the Center for Digital Amnesia Awareness Web Site. :)

In the meanwhile, Bill Gates has also written this must-read article titled "A Robot In Every Home".  When you read the paper, you realize the real parallel universe between the "origin of the PC" days and today's world.  I played around with Microsoft Robotics Studio v1.0 yesterday and created my first robot in a simulated environment that I could control with a small controller-like Window (called the Direction Dialog).  That was pure thrill!

Exciting times ahead, and with this company - that's a statement that'll always be true!

posted on Tuesday, January 09, 2007 10:33:37 PM (India Standard Time, UTC+05:30)  #    Comments [0] Trackback
 Friday, January 05, 2007

Security on the web has taken a new dimension with AJAX-driven websites.  AJAX-driven websites are more susceptible to cross-site scripting (XSS) attacks and offer easier means of call and logic discovery.

I had covered these in sessions titled "Building Secure Next Generation Web Applicaitons" during the recent Security Yatra and also during some MSDN Days organized in a few SIs in India. 

Some of the really startling attacks I discovered while preparing the content for the demo included the MySpace worm.  The complete details are available at http://namb.la/popular/

Not only did the worm bypass all of Myspace.com's rules, but surprised the author of the malicious code himself by affecting a million users in under 20 hours!

I just also received an email that talks about a very interesting vulnerability in PDF and Adobe Reader that makes it possible to perform serious XSS attacks.  That was quite startling because the avenues are increased not just to AJAX-sites but common technology such as Adobe PDF and OpenOffice.  The article is available at http://www.eweek.com/article2/0,1895,2079201,00.asp?kc=EWEWEMNL010107EP26A

The actual attack instructions are also available here.  But let me warn you not to try this with any site.  Don't mess around - it is a dangerous world out there.

And for all your developers there, if that didn't shake you and say "Take security seriously", I don't know what will.

posted on Friday, January 05, 2007 10:57:51 PM (India Standard Time, UTC+05:30)  #    Comments [0] Trackback