Here's the content description for AngularJS page:
AngularJS is what HTML would have been, had it been designed for building web-apps. Declarative templates with data-binding, MVW, MVVM, MVC, dependency injection and great testability story all implemented with pure client-side JavaScript!
...
I am a new bie to Mac world. Recently I was shifted to IOS development project for developing apps for Iphone & Ipad. Apart from working @ office, i am planning to work on Mac in the free time. Can i purchase Mac-mini to do IOS development.
--
Thanks.
@slhck Erm... Actually it's the same as running VS 2012 and SQL 2012. An entry level machine is not necessarily going to cut it, but hey. I will leave it at that. (I only know because I do Apple dev and recently went through the process for 10+ developers)
I guess his question should be more specific to be useful, but then it's too localized
a proper question would be "here are my system specs for a mac mini i want to buy, is this going to be enough to develop XYZ type of apps using XYZ frameworks"
that would be topical and not too broad, but the specificity of it also makes it useful to approximately 1 person in the world
So after deciding to install Xcode 4 on my '09 mac mini because of how useful its instruments feature is (opengl stuff), it turns out that my mac mini only barely manages to run it.
In other words, it's crippled. I'm still here waiting for my program to run on the iPhone, and it's stuck with som...
@Diago An entry machine isn't going to cut it, yeah… for almost anything except for web browsing and looking at cat pictures. That's true in almost every scenario where you want to use a computer seriously.
firefox has a way of ignoring your proxy if it can't connect to it, so maybe the issue is that the other machine can't get through to the proxy (or can't get through to it over https) -- check firewall rules, stateful packet inspection, network reliability, that kinda stuff
worst case, restart FF -- that will make it forget about its ignoring proxies
@Diago and the one that can't connect is on wireless, right? :)
@Diago try a 15 minute continuous ping from the wireless mac to the proxy and record the packet loss -- it should be less than 0.5% for acceptable networking... if you are getting lots of spurious dropped packets, the TCP socket might be getting dropped and causing FF to think the proxy is down
@elcodedocle I just read your question. I'm not sure it's a good idea to set a hard limit anyway. what are you trying to prevent? DDoS? people might get spurious errors with your web app if you set it too low, and attackers can just serialize so that they make one connection at a time if a lot of people start doing this.
I think it's more likely that setting a connections-per-ip limit will cause problems for legitimate users than attackers, because attackers are in control of their end, so if they see the connections getting closed after a certain threshold, they can just reduce the parallelism (there can also be automatic backoff algorithms to detect your threshold automatically)
once the incoming packets hit your NIC, you're already owned -- no amount of software will defend against a DDoS
you can't stop the packets from hitting your NIC with a software firewall. in order for the rules to be applied, the packets have to be deserialized off the network, DMA transferred from the NIC to the CPU, copied into memory, then inspected, then routed/filtered
@elcodedocle if it's one person trying to DoS you with a connection flood, in all likelihood they won't even have enough upstream to do it on their home internet connection
the real conspiracy behind ISPs limiting upstream so severely (cable connections with 100 Mbps downstream, 1 Mbit upstream) is that they want to prevent DoS from being effective, and that's exactly what the net effect is -- in order to successfully execute a DoS, you need loads of boxes, or a few dedicated servers at least
@elcodedocle yeah, because IPv4 is not a very large IP space, it's pretty easy for them to do that -- everyone gets that -- you can't really prevent their connections unless you blacklist huge parts of the world (countries, entire ISPs, etc)
@elcodedocle Been there as well. If they want to check vulnerabilities, they can do it serially or parallely, regardless of how many maximum connections you allow.
proper DDoS defense involves a fairly beefy router with a large pipe and good intrusion detection / packet inspection software... the important part is that the gateway box has a larger pipe than the application server (where your HTTP server is hosted), and that a "clean feed" of legit traffic hits the NIC of your HTTP server, which has a smaller pipe than the gateway box
there are certain hosts that say they are designed to fight against DDoS, but you pay for the additional DDoS-fighting hardware... their methods are effective though
@elcodedocle As a sysadmin you should watch your logs and see what they're trying to do. Is your web app something you wrote yourself or a CMS or something?
I'm running a LAMP stack, with no phpMyAdmin (yes) installed. While poking through my Apache server logs I noticed things like:
66.184.178.58 - - [16/Mar/2010:13:27:59 +0800] "GET / HTTP/1.1" 200 1170 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)"
200.78.247.148 - - [16/Mar/2010:15:26:05 +...
@Journeyman, yes port scans too, but it's the service vulnerability scans what worries me most, since the take more resources and also they might find something eventually...
anyway, I think, trying to be "proactive" and setting up some kind of rule is not going to be effective for long, if at all... simultaneous connection type rules are easily defeated by software, even if the attackers aren't specifically aware of your configuration, they wouldn't have to write custom code just for you, they probably already detect simultaneous connection limits and serialize it
@elcodedocle they're going to take significant resources regardless of whether you block them at the IP stack or let them in to your daemon
anything you set up in your firewall is just going to do processing, on the CPU, on a packet that was received by the NIC and transferred into RAM as I described before, and the processing will take place in the kernel rather than in the userspace daemon
the difference in performance is negligible -- the most expensive part of the probe is the packet hitting your hardware, and you can't stop that without a DDoS-preventing router
unless they're getting through and making large pseudo-legitimate file downloads of big EXEs or MP3s or something -- that would make the successful HTTP connection more expensive
but you can write your web app to prevent drive-by downloads of large files
Well I do have a Drupal+PostgreSQL instance running, just a personal homepage nobody cares to visit, but it's up to date (so I lied when I said just one app, I didn't even remembered). My main concern would be the webapp, which doesn't use CMS, just PHP+MySQL (and also is the default virtualhost you are directed to when you just enter the IP).
@JourneymanGeek password brute forces should never even be possible -- any service listening on the public Internet needs to be using public key infrastructure, period
@allquixotic: you can use fail2ban with anything with an error log. If someone tries to bruteforce an webapp more than x times, you can just drop all their packets.
@Journeyman, well yes, but IPs are usually dinamic and I don't like the idea of blacklisting forever. Just a little fair sharing of resources is what I want, instead of having the attacker suck as much as possible..
@JourneymanGeek for authenticated services, my preferred method is to allow a certain number of attempts to login to a specific account regardless of the origin IP and then lock out that account for 24 hours or something
@allquixotic, currently I'm using captcha for the weblogins. But still, if somebody is trying to log like once per second, ignoring captcha request and all, should I be processing that?
@elcodedocle at the application layer you can just prevent login attempts from a certain IP if it fails login after a certain number of tries, and, if it tries to login to a valid account a certain number of times with wrong password, lock out that account for 24 hours
ok, so no iptables and no droping packets. Everything goes through and it's handled by the daemon (which is how I have it right now, and I can't complain: it works, just a little bit slow from time to time)
also if you are writing your own code and aren't experienced with testing for things like CSRF, XSS, etc. I would be happy to look at the app once it's in beta (closed beta would be preferred)
had an incredibly advanced IDS, all kinds of security processes in development, blah blah... even a scanner that can detect SQL injection before it hits the app server
@slhck Most important piece of fail2ban config is adding your IP to ignoreip. I locked myself out of my servers a few times when I started using f2b :P
but it was vulnerable to a CSRF that let a remote attacker invisibly update your direct deposit info without the user's knowledge, all that's required is the user to be logged into the app lol
was - the vuln never made it to production :D thanks to <----------
Thing is, we host a couple of PHP scripts (CMS) on a server that's been attacked twice in the last few weeks, with a successful break in, which lead to all PHP files being deleted. I now managed to update all CMS to their latest version and all… but Apache and PHP itself are a little outdated.
@Hennes If you think WordPress is insecure, you should see Joomla. I've been working on this organization for 4 months now, every f@%$ng day or two I overhear "hey another one of our joomla sites got hacked"
if you're running CentOS 5 or 6, you're receiving Red Hat's security updates stream for 10 years after release, which is a long time, and the packages are extremely well tested before being deployed
either that, or freeze the process, then make its code section read-write, then update its code section, then make it read-only, then update the data in the process image to handle any new data structures, then unfreeze the process
if they can do it for the kernel, they can probably do it for Apache.
@OliverSalzburg At least I managed to audit it using an OWASP tool and it seemed quite secure after patching it to the latest 1.5. stable. But please, never use it :P
@allquixotic Yup. Did a comparison of vulnerabilities before and after patching, also did some changes in htaccess and the file ownership and suddenly the OWASP scanner couldn't even detect the Joomla version anymore :P
we pulled it off so smoothly, too... once I found the vuln, I authored a HTML webpage with iframes for each of the attack steps, and recorded a video of the whole thing, and my manager on the customer side played the video on a projector at a meeting with a bunch of big wigs
Hi all, I'm trying to help the poster of this question in chat but he doesn't have enough rep to talk to me. Could someone give him a couple of upvotes so we don't clutter the comments thread?
@OliverSalzburg use their testing guide -- develop a formal test plan that basically involves going through the testing guide step by step and doing their black box testing examples, translating whatever it says into your own web app's logic
@OliverSalzburg no no -- OWASP is a meta-project or umbrella that encompasses many different techniques and tactics for protecting web apps or attempting to intrude on them (for testing purposes of course)
@slhck right, but in my 2 years of experience doing full time security testing on the job, our extremely expensive, highly-touted automated security testing tools have only ever uncovered one vulnerability that was even a little interesting; the rest (several dozen vulns) were discovered manually
one thing that is useful is developing pointed, application-specific security testing tools that automate certain processes that you think need to be repeatedly tested with your app
imagine a 2D graph/plot with "specificity" (how specific is the code to your particular application) on the X axis, and the "effectiveness" (how likely it is to detect a vuln) on the Y axis. the graph I envision is roughly logistic -- increases slowly, then hits a hump and takes off at exponential pace
I'm not in favor of upvoting posts I don't consider good just to get someone to chat. There's always a way to constructively get more info from the OP if they want to cooperate.
The problem I would like to solve is this. I browse to a website that contains ordered blocks of text one after another. I would like to run a script on this page that goes into the webpages source, extracts these blobs of text, and then outputs each blob into a file.
How do I do something like...
@r.tanner.f for a job I'd be fine with it, but when it's a hobby project and I have to choose between that and doing something else like programming or gaming, I choose the latter... :P
I thought I'd drop by here before asking a question on the site proper, since I'm occasionally bad at terminology so I'd like to clarify things to make my "Search for existing content" attempts more successful.
A family friend's hard drive crashed. Apparently pretty hard. Her company IT person says he can't do anywhat about it, unless she had a "hard drive retrieval machine". A search for that exact term turns up little on the site as far as information on them, though.
@GraceNote: 1) Do not attempt any further writes. 2) Run it through professionals which can use careful and precise tools to inspect and if possible recover it, although that this costs a lot of money. 3) If you don't want to pay a lot of money, attempt to do recovery yourself by means of TestDisk and similar tools, but that won't work if the hard drive is physically damaged though...
testdisk is an application that works well if the disk is physically fine, but the filesystem is messed up
there's apparently devices on the market specifically for imaging drives with damaged data (though I'm told gddrescue does fine - its a linux software for imaging drives with bad sectors)
From your analysis here, the information I have is insufficient to formulate a constructive question on data recovery (way too many factors needed for specification). But the links you gave should be helpful to at least look into. THank you much!
@GraceNote Yeah, start at the basis: See whether the drive is still detected in the device manager. See whether it has any partitions in Disk Management. See whether you can still see things on a partition in Windows Explorer. If so, back up what you can (roadkil.net/program.php?ProgramID=29). If not, go trough TestDisk to see if you can get a partition to show that way and try to recover from there. Alternatively try tools like PhotoRec which try to attempt to find files.
@r.tanner.f We have one, but might need some update to make it more "analysis" based like in my previous message.
What steps can I take to try to recover lost or inaccessible data from any storage device?
Answers:
This applies to any main storage devices; eg. internal/external hard drive, USB stick, Flash memory.
The most important thing is to STOP using it, any type of I/O can ruin your chances of a reco...
@TomWijsman Gonna definitely keep that link handy to send off. Unfortunately she didn't pick up her cell so I'm going to have to wait a bit to relay my findings. Thanks, everyone, for your help!
Recovering a hard drive can be easy, tricky, hard or impossible; depends on its damage. It gets fun if files fail to copy because the drive becomes inaccessible for some time to randomly work again a moment later...
Here's the content description for AngularJS page:
AngularJS is what HTML would have been, had it been designed for building web-apps. Declarative templates with data-binding, MVW, MVVM, MVC, dependency injection and great testability story all implemented with pure client-side JavaScript!
...
I am a new bie to Mac world. Recently I was shifted to IOS development project for developing apps for Iphone & Ipad. Apart from working @ office, i am planning to work on Mac in the free time. Can i purchase Mac-mini to do IOS development.
--
Thanks.
The problem I would like to solve is this. I browse to a website that contains ordered blocks of text one after another. I would like to run a script on this page that goes into the webpages source, extracts these blobs of text, and then outputs each blob into a file.
How do I do something like...
What steps can I take to try to recover lost or inaccessible data from any storage device?
Answers:
This applies to any main storage devices; eg. internal/external hard drive, USB stick, Flash memory.
The most important thing is to STOP using it, any type of I/O can ruin your chances of a reco...
