Oracle Finalizes Acquisition of Sun

Finally much awaited deal of sun Acquisition by Oracle is done. As per the latest newsletter from sun:

"We are pleased to announce that Oracle has completed its acquisition of Sun Microsystems and Sun is now a wholly owned subsidiary of Oracle. With this news, we want to reiterate our commitment to deliver complete, open and integrated systems that help our customers improve the performance, reliability and security of their IT infrastructure. We would also like to thank the many customers that have supported us throughout the acquisition process.

There is no doubt that this combination transforms the IT industry. With the addition of servers, storage, SPARC processors, the Solaris operating system, Java, and the MySQL database to Oracle’s portfolio of database, middleware, and business and industry applications, we plan to engineer and deliver open and integrated systems - from applications to disk - where all the pieces fit and work together out of the box.

Performance levels will be unmatched. Oracle’s software already runs faster on Sun SPARC/Solaris than on any other server or operating system. With Sun as a part of Oracle, each layer of the stack will be engineered to further improve performance, reliability and manageability so that IT will be more predictable, more supportable, and more secure. Customers will benefit as their system performance goes up and their system integration and management costs go down.

In addition, our open standards-based technology will give customers choice. Customers can purchase our fully integrated systems, or easily integrate our best-of-breed technologies with their existing environments. Our open technology also enables customers to take full advantage of third party innovations. Oracle also plans to extend its partner specialization program to include Sun technologies to better enable partners to deliver differentiated and value-added solutions to customers.

As always, our primary goal is 100% customer satisfaction. We are dedicated to delivering without interruption the quality of support and service that you have come to expect from Oracle and Sun, and more. Oracle plans to enhance Sun customer support by improving support access, offering better interoperability support between Oracle and Sun products and delivering services in more local languages. Support procedures for your existing Sun and Oracle products are unchanged, so for now you should continue to use the same channels you’ve been using. Customers can continue to purchase products from Sun in the same way they did prior to the acquisition. We will communicate any changes to this through regular channels.

We are very excited about this combination and look forward to delivering to you increased innovation through accelerated investment in Sun’s hardware and software technologies such as SPARC, Solaris, Java, and MySQL. If you weren’t able to join the live event on January 27 where we, along with Larry Ellison and other executives from Oracle and Sun outlined how this powerful combination will transform the IT industry, you are welcome to view the replay that can be accessed at oracle.com/sun.

Sincerely,

Charles Phillips President

Safra Catz President"

Techcrunch got hacked again

TechCrunch got hacked 2nd time again within 12 hours. Yesterday TechCrunch itself posted a blog [1] confirming about the hacking, and it got again 30 minutes back as well. Hacker's information is still unknown, and information is still being collected on how the site is compromised.


After realizing that site is hacked, immediately message "We'll be back shortly" put there.

[1] http://www.techcrunch.com/2010/01/26/techcrunch-hacked/

Firefox hacks to make browsing easy

Undoubtedly, Firefox is the best browser available in the market. Virtually there is no limit of customization you can do with Firefox. Most of these comes as extensions (add-ons).
However, settings can also be customized easily by accessing convenient location using Firefox's "about:config" hack, which can be opened by typing it into the address bar. Steps to change settings can be followed as:

• Type "about:config" in the address bar, and press enter
• Search for the setting in the "Filter" bar within that
• If desired search result found, double click to change the value, which can be integer, Boolean or string type
• In case a setting doesn’t show up in the search, just right-click and select New to create it.
• Restart Firefox
  

By following the above steps, different customizations can be done. I'll list a few here which may be useful for you as well.

1. Stop sites to blink the Text : Some websites have blinking text which irritates a lot. It can be stopped as

• In Filter search, type: "browser.blink_allowed"
• Set its the value as "false"
  

2. Open search result in new tab : Search has become the integral part of our net surfing, and while using Firefox, I quickly hit "Ctrl + k" or "Command + k" (mac) to type the keywords to get the results. However, either it will over-write the existing page or I need to open new tab first, which means extra key strokes. The setting to open the search results in new tab can be done as

• In the Filter search, type: "browser.search.openintab"
• Set its value as "true"
  

3. RAM (Memory) optimization when Firefox is minimized (Windows only) : RAM is a precious commodity. All the applications carry out their processing in the RAM. Many applications in some operating systems, returns unused RAM when they are minimized. The problem with Firefox arises in the way it handles RAM - Not releasing it when minimized. It can be handled using config.trim_on_minimize setting. Please note that, it (Windows only) does not reduce the amount of memory used, it just swaps memory from RAM to disk.

• Create new Boolean variable "New -> Boolean" by doing right click
• Name it as "config.trim_on_minimize" and set the value as "true"

4. Maximum amount of pages to be stored in memory (more) Variable browser.sessionhistory.max_total_viewers can be set to some positive number in about:config to limit the amount of pages to be stored in the memory. Default is -1, which means it automatically determines the maximum number of pages. Users not facing any memory problem may set -1. To change it

• In the Filter search, type: "browser.sessionhistory.max_total_viewers"
• Double click, and change value to some positive number (number of pages allowed to be stored in memory)
  

5. Use Firefox Bookmark Keyword

• http://vishnu-agarwal.blogspot.com/2011/05/firefox-bookmark-keyword-hack.html

Other References:

• http://kb.mozillazine.org/Memory_Leak

Favicon Optimization - Some facts

Every time a page a requested, favicon is also downloaded if present at the server. Though favicon download doesn't affect you page response time directly, but it share the bandwidth. So better to keep favicon small (preferably less than 1 KB) & cacheable.
Favicon can be used in two ways:

• Keeping the favicon.ico file in the server root directory
• favicon.ico using link attribute in the header of the HTML

I consider second approach better for the following reasons

• can be cached with the proper expiry header and can be served from CDN.
• E.g. <link rel="shortcut icon" href="http://in.yahoo.com/favicon.ico" type="image/x-icon" />

Please note that, If favicon is changed, It name cann't be changed to clear the cache, so choose the expiry time wisely.

However there are something more to know about the second approach:

• IE loads favicon before lazy-loaded components.
• It increases the load on your application server.
• Favicon loaded with a <link> are loaded early in the FF waterfall

Thunderbird

After using Evolution & Outlook, I move to Thunderbird. Definitely it is the best mail client I ever used. However, I tried some of it useful configurable options.

A. Modifying Thunderbird's Reply Header [1] : By default while replying, you may want to include the date (timestamp). Go to Edit / Tools => Preferences / Options => Advanced => Config Editor => search for "mailnews.reply_header_type" and set it 3.

[1] http://panicbook.blogspot.com/2006/10/modifying-thunderbirds-reply-header.html

B. Lightning at Thunderbird 3.0
1. Go to 'Tools -> Add-ons'
2. Click 'Get Add-ons' tab
3. Search for "Lightning" here or at https://addons.mozilla.org/en-US/thunderbird/
4. The results will show "Lightning Nightly Updater (Unofficial)"
5. Install it
6. Restart Thunderbird
7. Go to 'Help -> Check for Latest Lightning Nightly Builds...'
8. Pop-up will show the latest Nightly Build of Lightning which is available
9. Click on Install
10. Restart Thunderbird

Top 20 Security Assessment Tools

Nessus
Home Page: http://www.nessus.org/
Description: The premier Open Source vulnerability assessment tool Nessus is a remote security scanner for Linux, BSD, Solaris, and other Unix platforms. It is plug-in-based, has a GTK interface, and performs over 1200 remote security checks.

Ethereal
Home Page: http://www.ethereal.com/
Description: Sniffing the glue that holds the Internet together Ethereal is a free network protocol analyzer for Unix and Windows. You can interactively browse the capture data, viewing summary and detail information for each packet.

Netcat
Home Page: http://netcat.sourceforge.net/
Description: The network swiss army knife. A simple Unix utility which reads and writes data across network connections, using TCP or UDP protocol. It is designed to be a reliable "back-end" tool that can be used directly or easily driven by other programs and scripts.

Libwhisker
Home Page: http://sourceforge.net/projects/whisker/
Description: Rain.Forest.Puppy's CGI vulnerability scanner and libraryWhisker is a scanner which allows you to test HTTP servers for many known security holes, particularly the presence of dangerous CGIs. Libwhisker is a perl library (used by Whisker) which allows for the creation of custom HTTP scanners.

John the Ripper
Home Page: http://www.openwall.com/john/
Description: An extraordinarily powerful, flexible, and fast multi-platform password hash cracker. John the Ripper is a fast password cracker, currently available for many flavors of Unix (11 are officially supported, not counting different architectures), DOS, Win32, BeOS, and OpenVMS. Its primary purpose is to detect weak Unix passwords.

Sam Spade
Home Page: http://www.samspade.org/ssw/
Description: Freeware Windows network query tool. SamSpade provides a consistent GUI and implementation for many handy network query tasks. It was designed with tracking down spammers in mind, but can be useful for many other network exploration, administration, and security tasks. It includes tools such as ping, nslookup, whois, dig, traceroute, finger, raw HTTP web browser, DNS zone transfer, SMTP relay check, website search, and more.

Nikto
Home Page: http://www.cirt.net/code/nikto.shtml
Description: Nikto is a web server scanner which looks for over 2000 potentially dangerous files/CGIs and problems on over 200 servers.

Kismet
Home Page: http://www.kismetwireless.net/
Description: A powerful wireless sniffer. Kismet is an 802.11b network sniffer and network dissector. It is capable of sniffing using most wireless cards, automatic network IP block detection via UDP, ARP, and DHCP packets, Cisco equipment lists via Cisco Discovery Protocol, weak cryptographic packet logging, and Ethereal and tcpdump compatible packet dump files.

SuperScan
Home Page: http://www.foundstone.com/index.htm?subnav=resources/navigation.htm&subcontent=/resources/proddesc/superscan.htm
Description: Foundstone's Windows TCP port scanner. A connect-based TCP port scanner, pinger and hostname resolver. No source code is provided. It can handle ping scans and port scans using specified IP ranges.

L0phtCrack 4 (now called "LC4")
Download Location: http://www.net-security.org/software.php?id=17
Description: Windows password auditing and recovery application L0phtCrack attempts to crack Windows passwords from hashes which it can obtain (given proper access) from stand-alone Windows NT/2000 workstations, networked servers, primary domain controllers, or Active Directory. In some cases it can sniff the hashes off the wire. It also has numerous methods of generating password guesses (dictionary, brute force, etc).

Retina
Home Page: http://www.eeye.com/html/Products/Retina/index.html
Description: Commercial vulnerability assessment scanner by eEye. Like Nessus and ISS Internet Scanner mentioned previously, Retina's function is to scan all the hosts on a network and report on any vulnerabilities found.

Nmap
Home Page: http://www.insecure.org/
Description: Open source scanning tool for Windows and Linux.

Network Stumbler
Download Location: http://www.stumbler.net/
Description: Free Windows 802.11 Sniffer. Netstumbler is the best known Windows tool for finding open wireless access points ("wardriving"). They also distribute a WinCE version for PDAs and such called Ministumbler. The tool is currently free but Windows-only and no source code is provided.

SARA
Home Page: http://www-arc.com/sara/
Description: Security Auditor's Research Assistant. SARA is a vulnerability assessment tool that was derived from the infamous SATAN scanner.

N-Stealth
Home Page: http://www.nstalker.com/eng/products/nstealth/
Description: Web server scanner. N-Stealth is a commercial web server security scanner. It is generally updated more frequently than free web scanners such as whisker and nikto, but do take their web site with a grain of salt. The claims of "30,000 vulnerabilities and exploits" and "Dozens of vulnerability checks are added every day" are highly questionable.

Cain & Abel
Download Location: http://www.oxid.it/cain.html
Description: The poor man's L0phtcrack. Cain & Abel is a free password recovery tool for Microsoft Operating Systems. It allows easy recovery of various kind of passwords by sniffing the network, cracking encrypted passwords using Dictionary & Brute-Force attacks, decoding scrambled passwords, revealing password boxes, uncovering cached passwords and analyzing routing protocols.

XProbe2
Home Page: http://www.sys-security.com/index.php?page=xprobe
Description: Active OS fingerprinting tool. XProbe is a tool for determining the operating system of a remote host. They do this using some of the same techniques as Nmap as well as many different ideas.

SolarWinds Toolsets
Download Location: http://www.solarwinds.net/
Description: A plethora of network discovery/monitoring/attack tools. SolarWinds has created and sells dozens of special-purpose tools targetted at systems administrators. Security related tools include many network discovery scanners and an SNMP brute-force cracker.

Brutus
Download Location: http://www.hoobie.net/brutus/
Description: A network brute-force authentication cracker. This Windows-only cracker bangs against network services of remote systems trying to guess passwords by using a dictionary and permutations thereof. It supports HTTP, POP3, FTP, SMB, TELNET, IMAP, NTP, and more. No source code is available.

Paketto Keiretsu
Home Page: http://www.doxpara.com/read.php/code/paketto.html
Description: Extreme TCP/IP. The Paketto Keiretsu is a collection of tools that use new and unusual strategies for manipulating TCP/IP networks. They tap functionality within existing infrastructure and stretch protocols beyond what they were originally intended for.

onError: Handling "Image Not Found" in JavaScript

HTTP requests are expensive, so making an HTTP request and getting a useless response (ie. 404 Not Found) is totally unnecessary and will slow down the user experience without any benefit. Even worse is when the link to an external JavaScript is wrong and the result is a 404. First, this download will block parallel downloads. Next the browser may try to parse the 404 response body as if it were JavaScript code, trying to find something usable in it.

Although, we cann't reduce the http requests if image is not found, but error can be handled resulting in showing some other appropriate image to the user.
We can use "try... catch" statement to catch the error in a web page. Alternatively, we can use the onerror event as well for the same purpose.
The onerror event is fired whenever there is a script error in the page.

Example use:
To use the onerror event, you must create a function to handle the errors. Then you call the function with the onerror event handler. The event handler is called with three arguments: msg (error message), url (the url of the page that caused the error) and line (the line where the error occurred).

onerror = handleErr

function handleErr(msg,url,l) {
//Handle the error here
return true or false
}

An another example for handling it, another image can we shown if image is not found
eg. <img src="http://www.yahoo.com/badimage.gif" alt="Bad Image" onError="this.src='http://l.yimg.com/a/i/ww/beta/y3.gif';" />