-->

Photostream

Tag Cloud

Categories

Social Links

Archives

Statistics

RSS Feed - IT


RSS Feed - EN

Archive for the ‘Technology’ Category

Disassebling my Nokia N80

My mobile phone suddenly died, after 3 years of excellent service, just showing a fixed white screen. The following video explains in great detail (in a way which may even seem ridiculous, as when it indicates carefully the order of the screws which need to be removed..) how to disassembly a Nokia N80, component by component. Then, if you can spot or just think of a fixable damage, you can give it a try and find the broken part. In my case the chief suspect was the flex ribbon cable connecting the display to the motherboard, very common in slide phones. So I bought a new one for just 3 euro, replaced the old one and finally got the phone repaired.

I could not leave my old Nokia as it was, lifeless and with no warranty.. :)

Browser fingerprint

Apparently even the browsers leave a sort of fingerprint during the navigation, page after page, and the one sown by my fox seems to be unique among those so far analyzed by Panopticlick..

Your browser fingerprint appears to be unique among the 741,598 tested so far.

Currently, we estimate that your browser has a fingerprint that conveys at least 19.5 bits of identifying information.

With all the complexity today’s browsers can reach through the integration of various plugins and the configuration of advanced functionalities, of course linked to the preferences of users, each client can easily become unique in the eyes of the servers and identifiable and/or traceable over the Internet, with in theory no protection for the privacy of the user..

Has anyone got a non-unique fingerprint as a result?

Top 25 most dangerous programming errors

On the official website of  Common Weakness Enumeration (CWE) you can freely consult a community developed dictionary of software weakness types. Following below the list of 25 most dangerous programming errors updated to 2010, certainly a valid reference for any developer.

The 2010 CWE/SANS Top 25 Most Dangerous Programming Errors is a list of the most widespread and critical programming errors that can lead to serious software vulnerabilities. They are often easy to find, and easy to exploit. They are dangerous because they will frequently allow attackers to completely take over the software, steal data, or prevent the software from working at all [...]

Rank Score ID Name
[1] 346 CWE-79 Failure to Preserve Web Page Structure (‘Cross-site Scripting’)
[2] 330 CWE-89 Improper Sanitization of Special Elements used in an SQL Command (‘SQL Injection’)
[3] 273 CWE-120 Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’)
[4] 261 CWE-352 Cross-Site Request Forgery (CSRF)
[5] 219 CWE-285 Improper Access Control (Authorization)
[6] 202 CWE-807 Reliance on Untrusted Inputs in a Security Decision
[7] 197 CWE-22 Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)
[8] 194 CWE-434 Unrestricted Upload of File with Dangerous Type
[9] 188 CWE-78 Improper Sanitization of Special Elements used in an OS Command (‘OS Command Injection’)
[10] 188 CWE-311 Missing Encryption of Sensitive Data
[11] 176 CWE-798 Use of Hard-coded Credentials
[12] 158 CWE-805 Buffer Access with Incorrect Length Value
[13] 157 CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP File Inclusion’)
[14] 156 CWE-129 Improper Validation of Array Index
[15] 155 CWE-754 Improper Check for Unusual or Exceptional Conditions
[16] 154 CWE-209 Information Exposure Through an Error Message
[17] 154 CWE-190 Integer Overflow or Wraparound
[18] 153 CWE-131 Incorrect Calculation of Buffer Size
[19] 147 CWE-306 Missing Authentication for Critical Function
[20] 146 CWE-494 Download of Code Without Integrity Check
[21] 145 CWE-732 Incorrect Permission Assignment for Critical Resource
[22] 145 CWE-770 Allocation of Resources Without Limits or Throttling
[23] 142 CWE-601 URL Redirection to Untrusted Site (‘Open Redirect’)
[24] 141 CWE-327 Use of a Broken or Risky Cryptographic Algorithm
[25] 138 CWE-362 Race Condition

And Java eventually became red

I knew about the acquisition of Sun Microsystems recently accomplished by Oracle Corporation but I could not imagine such a strong rebranding, so here is how http://java.sun.com/ looks like now..

Even the address http://www.sun.com/ appears to redirect to http://www.oracle.com/ ..

Hoping that Duke will survive after all these huge movements (and that our certifications won’t soon “expire” at least, joking of course..), I wish this big business operation won’t result negative for one of the main technologies object of this acquisition, the Java platform, a language which has definitely marked the history of object-oriented programming and third generation programming languages.

Google Buzz vs Twitter

I’ve just come up to use this brand-new service just released by Big G named Google Buzz, so I’m going to report here some first impressions trying to make a quick comparison with Twitter, along with I think Google Buzz is sharing the basic idea (but probably only that). Anyway, I’m not going to talk about FriendFeed (which is probably more similar) but just because I’m not using it, or about Facebook and other popular social networks.

Like Twitter the key concepts are very simple:

  • There are followers and following people
  • You can share short messages

Unlike Twitter:

  • There is no limit to the number of characters you can type in (140 in T.)
  • The service is embedded within a mailbox platform (T. offers integration through its APIs) *
  • Messages are editable after the submission
  • You can post private messages
  • You can insert images from your computer or picasaweb (with T. you need to use additional services like TwitPic)
  • You can share videos and see them from inside the messages (eg. Youtube videos)
  • You can express appreciation through the button like/unlike
  • You can hide a conversation through the option mute/unmute
  • You can continue or just move a conversation to a chat (GTalk) or to emails

Google Buzz confirms again Google’s main goal, gather as many users as possible to enlarge the network and increase the time adopters spend on the offered services. In fact this new service will soon provide Google with more information about users’ behaviors and preferences, obviously resulting in more earnings in terms of advertising (main Google’s business). My only question is: will Google Buzz be used as a “real” social network? It’s not easy to fit into a market already dominated by many other competitors, even though with Gmail I have to admit things have gone pretty well.

* UPDATE - Google Buzz APIs also available.

Social data taxonomy

Interesting this post where Bruce Schneier, the famous security technologist, offers a personal interpretation of a possible social data taxonomy centered on trust level. A valid point of view for both users and administrators. Internet can become very unpredictable, uncontrollable, and then cause unpleasant situations, even dangerous, so it’s always good to have perfectly clear in mind WHAT is going to end into a social network (and not only) and HOW this will be controlled and eventually made available.

  1. Service data. Service data is the data you need to give to a social networking site in order to use it. It might include your legal name, your age, and your credit card number.
  2. Disclosed data. This is what you post on your own pages: blog entries, photographs, messages, comments, and so on.
  3. Entrusted data. This is what you post on other people’s pages. It’s basically the same stuff as disclosed data, but the difference is that you don’t have control over the data — someone else does.
  4. Incidental data. Incidental data is data the other people post about you. Again, it’s basically the same stuff as disclosed data, but the difference is that 1) you don’t have control over it, and 2) you didn’t create it in the first place.
  5. Behavioral data. This is data that the site collects about your habits by recording what you do and who you do it with.

Mechanical Poetry offers here a different classification centered instead on the destination of data.

Creating virtual worlds

[ Source: XKCD ]

Rebuilding the role of the Information Engineer

Sorry, this post is not available in English, but you may want to read this blog in Italian.
Click

Memory leak in Firefox 3.5.5?!

I’m still not sure whether it was a memory leak or just a malfunctioning in the memory deallocation process, the certain thing is that my browser was definitely not behaving as expected. A few days ago my pc was heavily working while I was just visiting a couple of websites at the same time. So I checked the task manager and I noticed that Firefox (version 3.5.5) had allocated something like 700MB of memory and, having many other applications running and “only” 2GB of RAM, the Windows paging had started rearranging the memory making the computer almost unusable.

Yesterday, after an entire working day, I purposely closed all the navigation tabs (leaving the default white page) and double-check again the memory usage. Result? The memory space deallocated during that operation was really little while the allocated space remained around 200 MB:

taskmgr

Eventually I discovered the problem was related to a recently installed plugin, Tree Style Tab, which was mentioned by Enoela here and I’ve found very useful especially at work. So, once deactivated such plugin everything reverted to normality. It’s a pity I can’t hierarchically organize my tabs. I think I will try again with an updated version.. Has anyone ever had a similar problem with that plugin or it is just a sporadic case?

Java updates from London

The conference was very interesting overall, some impressions below ..

Getting more from your existing Java applications
Simon Ritter – Java Evangelist, Sun Microsystems

This part was mainly focused on the tuning of the JVM and in particular on what often results to be a bottleneck for many Java-based applications, the garbage collection (GC). Not all developers know that there are literally hundreds of parameters, some of which only related to specific implementations (IBM, Oracle, BEA and others), through which it is possible to significantly change and adapt the JVM to a particular application. Introduced to us as the “GC Nirvana”, the following are the main optimization goals which need to be considered (compatible in pairs only):

  • low GC overhead
  • low GC pause times
  • good space efficiency

It was clear from the beginning as the GC mechanisms are continuouslyimproved even within the same release through the various updates released by Sun. Therefore, it’s a good thing to use always the latest update, within the limits of the specific project of course.

Java for Business. Getting the best (out of Sun) for your Java applications
Owen Stuart – Java Sustaining, Critical Situation Manager, Europe, Middle East and Africa

This part for me was of little interest. Speaker’s task was to explain the type of support offered to customers.

A look at Java SE embedded and real-time Java
Helen Cullen – Systems Engineer, OEM Software Sales / Andy Gilbert – Systems Engineer, OEM Software Sales

Surprising to see the full range of embedded devices controlled by Java. Among these particular attention was payed on the socket PC, specifically a Linux/Java-based implementation. It was also emphasized the difference between the Embedded version and the Micro Edition (often confused), the first intended for very small devices with less than 32 MB of memory (by now very few), the latter completely compatible with the standard version minus the packets considered optional (eg CORBA) and some not strictly necessary resources (eg javadocs) so removed from the packaging. Very interesting the discussion about Real-Time, on which I was still a little skeptical. With Java you can now easily implement a sort of soft real-time and, with more complexity of course, even a hard real-time. The results are significant as the following video shows:

New Stuff – Java Enterprise Edition 6 and GlassFish 3
Steve Elliott – Technology Evangelist, Sun Microsystems UK

Excellent was the introduction of the Enterprise Edition (J2EE or JEE) through a rapid excursus on its fast evolution happened over the years. Since its birth, the intent has always been to regulate the market in relation to new technologies introduced to improve the development of enterprise solutions. So that was in the past with the introduction of JPA and EJB 3.0 specifications (in response to the success of Hibernate), so that is now with the new JEE 6 which includes the mechanism of inversion of control (characteristic of Spring framework) in addition to other interesting new features. Good also GlassFish, the application server developed by Sun (about which I knew very little), which is going to become a reference implementation of the JEE specifications. Apparently an interesting product, definitely to be tested, also available in a bundle version for Eclipse.

More New Stuff – Java Standard Edition 7 and JavaFX
Simon Ritter – Java Evangelist Sun Microsystems / Simon Cook – Software Architect Sun Microsystems UK

Not very clear how Sun is proceeding with the development of the new JDK 7 (although Simon Ritter tried to make it clear), in fact numerous JSRs still need to be approved. The following is the complete list of what has been proposed so far (have a look at Project Coin as an example):

vm Compressed 64-bit object pointers
Garbage-First GC (G1)
JSR 292: VM support for non-Java languages (InvokeDynamic)
lang JSR 308: Annotations on Java types
JSR TBD: Small language enhancements (Project Coin)
JSR 294: Language and VM support for modular programming
core Modularization (Project Jigsaw)
Upgrade class-loader architecture
Method to close a URLClassLoader
Unicode 5.1
Concurrency and collections updates (jsr166y)
JSR 203: More new I/O APIs for the Java platform (NIO.2)
SCTP (Stream Control Transmission Protocol)
SDP (Sockets Direct Protocol)
Elliptic-curve cryptography (ECC)
client XRender pipeline for Java 2D
Forward-port 6u10 deployment features
Create new platform APIs for 6u10 graphics features
Nimbus look-and-feel for Swing
Swing updates
web Update the XML stack

And to complete this long path, a look at something certainly more stylish, Java FX. In this area Adobe seems to have now a distinct advantage with Flash, but Java FX has an important card to play, the full integration with th huge world of Java technology. We’ll see whether this card will result winning. To read more about this topic you can take a look at these screencasts or test some immediate examples just visiting this gallery.