MIND|DROPS

Top 25 Most Dangerous Programming Errors

MzC — Sat, 27 Feb 2010 00:57:40 +0000

On the official website of Common Weakness Enumeration (CWE) you can freely consult a community developed dictionary of software weakness types. Following below the list of 25 most dangerous programming errors updated to 2010, certainly a valid reference for any developer.

The 2010 CWE/SANS Top 25 Most Dangerous Programming Errors is a list of the most widespread and critical programming errors that can lead to serious software vulnerabilities. They are often easy to find, and easy to exploit. They are dangerous because they will frequently allow attackers to completely take over the software, steal data, or prevent the software from working at all [...]

Rank	Score	ID	Name
[1]	346	CWE-79	Failure to Preserve Web Page Structure (‘Cross-site Scripting’)
[2]	330	CWE-89	Improper Sanitization of Special Elements used in an SQL Command (‘SQL Injection’)
[3]	273	CWE-120	Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’)
[4]	261	CWE-352	Cross-Site Request Forgery (CSRF)
[5]	219	CWE-285	Improper Access Control (Authorization)
[6]	202	CWE-807	Reliance on Untrusted Inputs in a Security Decision
[7]	197	CWE-22	Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)
[8]	194	CWE-434	Unrestricted Upload of File with Dangerous Type
[9]	188	CWE-78	Improper Sanitization of Special Elements used in an OS Command (‘OS Command Injection’)
[10]	188	CWE-311	Missing Encryption of Sensitive Data
[11]	176	CWE-798	Use of Hard-coded Credentials
[12]	158	CWE-805	Buffer Access with Incorrect Length Value
[13]	157	CWE-98	Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP File Inclusion’)
[14]	156	CWE-129	Improper Validation of Array Index
[15]	155	CWE-754	Improper Check for Unusual or Exceptional Conditions
[16]	154	CWE-209	Information Exposure Through an Error Message
[17]	154	CWE-190	Integer Overflow or Wraparound
[18]	153	CWE-131	Incorrect Calculation of Buffer Size
[19]	147	CWE-306	Missing Authentication for Critical Function
[20]	146	CWE-494	Download of Code Without Integrity Check
[21]	145	CWE-732	Incorrect Permission Assignment for Critical Resource
[22]	145	CWE-770	Allocation of Resources Without Limits or Throttling
[23]	142	CWE-601	URL Redirection to Untrusted Site (‘Open Redirect’)
[24]	141	CWE-327	Use of a Broken or Risky Cryptographic Algorithm
[25]	138	CWE-362	Race Condition

Landing in Ireland

MzC — Fri, 26 Feb 2010 01:10:12 +0000

Well. I think they really do..

And Java eventually became “red”

MzC — Mon, 22 Feb 2010 19:31:48 +0000

I knew about the acquisition of Sun Microsystems recently accomplished by Oracle Corporation but I could not imagine such a strong rebranding, so here is how http://java.sun.com/ looks like now..

Even the address http://www.sun.com/ appears to redirect to http://www.oracle.com/ ..

Hoping that Duke will survive after all these huge movements (and that our certifications won’t soon “expire” at least, joking of course..), I wish this big business operation won’t result negative for one of the main technologies object of this acquisition, the Java platform, a language which has definitely marked the history of object-oriented programming and third generation programming languages.

Google Buzz vs Twitter

MzC — Wed, 10 Feb 2010 01:42:03 +0000

I’ve just come up to use this brand-new service just released by Big G named Google Buzz, so I’m going to report here some first impressions trying to make a quick comparison with Twitter, along with I think Google Buzz is sharing the basic idea (but probably only that). Anyway, I’m not going to talk about FriendFeed (which is probably more similar) but just because I’m not using it, or about Facebook and other popular social networks.

Like Twitter the key concepts are very simple:

There are followers and following people
You can share short messages

Unlike Twitter:

There is no limit to the number of characters you can type in (140 in T.)
The service is embedded within a mailbox platform (T. offers integration through its APIs) *
Messages are editable even after the submission
You can post private messages
You can insert images from your computer or picasaweb (with T. you need to use additional services like TwitPic)
You can share videos and see them from inside the messages (eg. Youtube videos)
You can express appreciation through the button like/unlike
You can hide a conversation through the option mute/unmute
You can continue or just move a conversation to a chat (GTalk) or to emails

Google Buzz confirms again Google’s main goal, gather as many users as possible to enlarge the network and increase the time adopters spend on the offered services. In fact this new service will soon provide Google with more information about users’ behaviors and preferences, obviously resulting in more earnings in terms of advertising (main Google’s business). My only question is: will Google Buzz be used as a “real” social network? It’s not easy to fit into a market already dominated by many other competitors, even though with Gmail I have to admit things have gone pretty well.

* UPDATE - Google Buzz APIs also available.

Ireland vs Italy at Croke Park

MzC — Mon, 08 Feb 2010 12:42:26 +0000

It looks like we still have a lot to learn.. Great atmosphere anyway, unfortunately I could not watch the match.

IRELAND 29 – ITALY 11

Dante’s Internet (Hell)

MzC — Thu, 04 Feb 2010 17:04:05 +0000

Nice this one..

Just click on the links if you want to know more about Dante Alighieri and the Divine Comedy ..

[ Source: foomandoonian.net ]

My bad experience with Ryanair

MzC — Mon, 01 Feb 2010 17:28:22 +0000

I arrived at Frankfurt Hanh Airport (in the middle of nowhere) to take a Ryanair plane to Pescara, destination Christmas holidays. I had one handbag with me with the right size, I didn’t know its weight but I thought it was approximately right. I successfully passed through the security check with my handbag arriving at the gate more than one hour earlier, then I remained in the boarding area awaiting for the beginning of the boarding procedure. When this procedure began I joined the queue along with all the other passengers, I was almost at its end. Once at the desk I was told to stop by a Ryanair officer who wanted to check my handbag. I was very surprised by the extremely late check. Anyway, I reported I had checked the dimensions already so the man decided to verify also the weight. My handbag was exceeding the limit of 10 kgs, so the man asked me to pay a 35€ fine and to do this just there at the exit (yes, at the gate!?!).

After a couple of minutes (while I unsuccessfully tried to get rid of some weight) I decided to accept the fine. I didn’t have cash in my wallet so I asked if I could pay with my credit card (VISA Electron) or with a laser card (Maestro) but this was not possible since no machines were available for this type of payment. So I was asked to run outside and get some money at the ATM while another Ryanair’s officer offered to hold my handbag and wait for me (“Run! Run!”). So I went out and got some cash, I passed through the security check again (skipping the queue to hurry up, not more than 10 mins had passed in total) to arrive again at the gate. There, I sadly saw my handbag left unattended and the gate closed. I can’t describe my disappointment, I started to swear in Italian but probably I should have known some German.. That night I had to pay for a double room (thank God I was not alone) in a hotel just outside the airport. I also needed to buy another ticket for the same route Hanh-Pescara luckily still available for the day after.

I wonder.. why don’t continue to let people pay at the destination as it has always been? Why should I be forced to pay with cash at the boarding gate where there’s no ATM? Why are they running such checks at the very last moment? These things are all against the same customers, but for what purpose? Please correct me if I’m wrong, all this crap looks to me as a way to “legally steal” money from the customers.. Do you think I’m exaggerating a bit? I can’t refrain myself from sending a complaint to Ryanair and ask for a refund. Since I’m sure most of you have experienced problems with this company (who hasn’t?), in case you like the idea you can join me and send your own complaints to the address below. I’ll keep you updated anyway..

EU PASSENGER
COMPENSATION DEPT.
PO BOX 11451
SWORDS, CO. DUBLIN
IRELAND

Avatar – The movie

MzC — Fri, 15 Jan 2010 11:41:55 +0000

Great movie, especially for the computer graphics effects. You must go and watch it, but don’t forget the 3D glasses!

Christmas food market at Farmleigh

MzC — Tue, 22 Dec 2009 11:59:47 +0000

Farmleigh seems to be one of those places where the Dubliners love to spend their Sundays and bank holidays. Parks, lakes and botanical gardens replace maybe what for us are the squares and the main streets. In the green spaces of this estate, where a magnificent Georgian building stands, previously belonged to the Guinness family and now owned by the Irish Government, various cultural events get organized during the year including art exhibitions and activities, concerts (mostly classical music, gospel choirs in this period), but also some less cultural event as the September Fest, inspired by the famous German festival but with local beer brands.

Certainly to not miss is the typical food market where you can sample and buy several typical products like muffins, fudges, cookies, whiskey cakes, Irish cheeses, burgers, mulled wine, many of them organic and locally produced. Foreign influences are not missing too, for instance German with the famous hotdogs, Italian with coffee and various preserves, or French with the typical quiches.

Below a little “taste” from last weekend, but just for your eyes ..

Social data taxonomy

MzC — Mon, 21 Dec 2009 01:04:09 +0000

Interesting this post where Bruce Schneier, the famous security technologist, offers a personal interpretation of a possible social data taxonomy centered on trust level. A valid point of view for both users and administrators. Internet can become very unpredictable, uncontrollable, and then cause unpleasant situations, even dangerous, so it’s always good to have perfectly clear in mind WHAT is going to end into a social network (and not only) and HOW this will be controlled and eventually made available.

Service data. Service data is the data you need to give to a social networking site in order to use it. It might include your legal name, your age, and your credit card number.

Disclosed data. This is what you post on your own pages: blog entries, photographs, messages, comments, and so on.

Entrusted data. This is what you post on other people’s pages. It’s basically the same stuff as disclosed data, but the difference is that you don’t have control over the data — someone else does.

Incidental data. Incidental data is data the other people post about you. Again, it’s basically the same stuff as disclosed data, but the difference is that 1) you don’t have control over it, and 2) you didn’t create it in the first place.

Behavioral data. This is data that the site collects about your habits by recording what you do and who you do it with.

Mechanical Poetry offers here a different classification centered instead on the destination of data.