Microsoft Corp may be taking the most heat among software vendors for security problems, but it's not always the one with the worst record.
A comparison of vulnerabilities in Microsoft's SQL Server database with Oracle Corp.'s relational database management products by Next Generation Security Software Ltd. (NGSS) shows that the latter vendor's products to have far more vulnerabilities than do products from Microsoft.
Between December 2000 and November 2006, external researchers discovered 233 vulnerabilities in Oracle's products compared with 59 in Microsoft's SQL Server technology, according to NGSS, which has worked for Microsoft in the past to make its software products more secure. The study looked at vulnerabilities that were reported and fixed in SQL Server 7, 2000 and 2005 and Oracle's database Versions 8, 9 and 10g.
The results show that the reputation that Microsoft SQL Server had back in 2002 for relatively poor security is no longer deserved, said David Litchfield, founder of Surrey, England-based NGSS. And neither is the beating that Microsoft has gotten for security issues, he said.
"I think it's time people got past this, especially security researchers," Litchfield said. "We should be about closing holes and improving a vendor's outlook on security and -- largely -- that battle has been won with Microsoft," he said. The results show that Microsoft's software development life-cycle processes appear to be working, he said.
"There are other battles needing to be fought and won -- Oracle being one of them," Litchfield said.
In an e-mailed comment, an Oracle spokeswoman said the number of reported vulnerabilities in a product alone is not a measure of the overall security of that software.
"Products vary significantly in terms of richness of features and capabilities as well as number of versions and supported platforms," she said. "Measuring security is a very complex process, and customers must take a number of factors into consideration -- including use-case scenarios, default configurations as well as vulnerability remediation and disclosure policies and practices."
Basing a product's security just on the number of vulnerabilities discovered and fixed may not be the best approach, said Pete Lindstrom, an analyst at Midvale, Utah-based Burton Group. "Oracle apparently won an ugly contest," he said. But "there's got to be other criteria other than known vulnerabilities" for measuring software security, Lindstrom said.
Until then, Lindstrom said, "the jury should still be out on what's more or less secure."
The NGSS report comes at a time when security researchers, irked by what they consider to be Oracle's glacial pace of fixing bugs, are increasingly turning their attention to its products. In October, the company announced fixes for over 100 flaws as part of its scheduled quarterly security updates. Many of the flaws were reported to the company by outside researchers.
Just this week, Argeniss Information Security in Buenos Aires announced plans to disclose one zero-day bug every day for a week in December.
In a note posted on the company's site, founder Cesar Cerrudo said the idea is to highlight the current state of Oracle software security. "We want to demonstrate that Oracle isn't getting any better at securing its products" and continues to take a very long time to address bugs, the note said. "We could do the Year of Oracle Database Bugs, but we think a week is enough to show how flawed Oracle software is," the note read.
Source : computerworld.com
Wednesday, November 29, 2006
Monday, November 27, 2006
Digital Camera Vs. Film - Pros And Cons
Consumers have been pretty receptive to the lower priced “point and shoot” models , but there are still some holdouts.
Great strides have been made in digital technology over the past few years, but more sophisticated digital cameras have only recently come down in price enough to attract the “serious amateur” market. In the past, the price of high-end digital camera equipment was more suited to the professional who could turn that investment into an income source.
Even traditional film buffs are slowly coming around to the benefits of digital photography. Among the holdouts, the chief problem seems to be confusion. There are so many choices, with a broad range of options, and just as many price ranges.
It’s cheaper not to make a decision, than to make a mistake.
They get lost in the terminology, and have reservations about the quality of digital photos and about the reliability of the digital cameras. With the whirlwind of innovation flooding our lives everyday, it’s become really difficult to keep up.
Technology advances, prices come down, and a deal today may be obsolete tomorrow. At least that’s what worries many potential digital camera owners.
So let’s look at five of the most common questions about digital camera photography to shed some light on the matter, for those who are hesitant about this new technology, or who have dismissed it as a mere fad.
1. Do digital cameras produce quality photos?
Digital photos can be displayed at very high resolutions, and could easily surpass conventional photographs, but many have seen poorer quality images. Early color printers could be used to print color photos from digital cameras, but the quality just wasn’t there. Blurry images on low-grade computer monitors or on the small LCD screens of the cameras themselves, do nothing to increase your confidence.
But view the high resolution images available from today’s digital cameras on a capable monitor or after being printed on one of the newer photo quality printers (using photo quality paper) and you’ll see the crystal clear quality of what is available today.
2. How durable are digital camera photos?
Digital camera photos are not stored on film. They’re stored on electronic memory devices that actually require much less care than negative film.
As long as reasonable care is taken of the particular storage device, there shouldn’t be any problems with protecting images caught on a digital camera, and you can easily make copies of the digital image files on your computer or even burn them to a CD - an option that isn’t available with film.
3. Are digital camera photos more expensive to process?
Not anymore. First, you can eliminate any poor images before printing and only pay for those that you print. With “easy share” technology and photo quality printers now available, it is both affordable and convenient to print digital camera photos.
You can even do the task yourself, in the comfort of your own home - without buying expensive development chemicals that are required for film processing! Or, you can send your images electronically to a professional processor, and receive professionally produced photos back in the mail in just a few days.
4. Can I get different effects with a digital camera?
That depends on the digital camera. High end models have built-in features that allow different kinds of effects. But even if your digital camera doesn’t have these advanced features, you can always manipulate the photographs on your desktop computer, using any image editing software.
5. Are zooming features comparable?
Here digital cameras actually have a distinct advantage over film cameras. While cheaper digital cameras may only have digital zoom (which is really just a form of in-camera enlargement that results in a lower resolution original image), high end models are available with both digital and optical zooming.
When shopping for your digital camera, give priority to the optical zoom capability and buy the highest power optical zoom that fits within your budget. Digital zoom is a nice extra, but the effects can easily be replicated during the “processing” of the image on your computer, prior to printing the images.
Great strides have been made in digital technology over the past few years, but more sophisticated digital cameras have only recently come down in price enough to attract the “serious amateur” market. In the past, the price of high-end digital camera equipment was more suited to the professional who could turn that investment into an income source.
Even traditional film buffs are slowly coming around to the benefits of digital photography. Among the holdouts, the chief problem seems to be confusion. There are so many choices, with a broad range of options, and just as many price ranges.
It’s cheaper not to make a decision, than to make a mistake.
They get lost in the terminology, and have reservations about the quality of digital photos and about the reliability of the digital cameras. With the whirlwind of innovation flooding our lives everyday, it’s become really difficult to keep up.
Technology advances, prices come down, and a deal today may be obsolete tomorrow. At least that’s what worries many potential digital camera owners.
So let’s look at five of the most common questions about digital camera photography to shed some light on the matter, for those who are hesitant about this new technology, or who have dismissed it as a mere fad.
1. Do digital cameras produce quality photos?
Digital photos can be displayed at very high resolutions, and could easily surpass conventional photographs, but many have seen poorer quality images. Early color printers could be used to print color photos from digital cameras, but the quality just wasn’t there. Blurry images on low-grade computer monitors or on the small LCD screens of the cameras themselves, do nothing to increase your confidence.
But view the high resolution images available from today’s digital cameras on a capable monitor or after being printed on one of the newer photo quality printers (using photo quality paper) and you’ll see the crystal clear quality of what is available today.
2. How durable are digital camera photos?
Digital camera photos are not stored on film. They’re stored on electronic memory devices that actually require much less care than negative film.
As long as reasonable care is taken of the particular storage device, there shouldn’t be any problems with protecting images caught on a digital camera, and you can easily make copies of the digital image files on your computer or even burn them to a CD - an option that isn’t available with film.
3. Are digital camera photos more expensive to process?
Not anymore. First, you can eliminate any poor images before printing and only pay for those that you print. With “easy share” technology and photo quality printers now available, it is both affordable and convenient to print digital camera photos.
You can even do the task yourself, in the comfort of your own home - without buying expensive development chemicals that are required for film processing! Or, you can send your images electronically to a professional processor, and receive professionally produced photos back in the mail in just a few days.
4. Can I get different effects with a digital camera?
That depends on the digital camera. High end models have built-in features that allow different kinds of effects. But even if your digital camera doesn’t have these advanced features, you can always manipulate the photographs on your desktop computer, using any image editing software.
5. Are zooming features comparable?
Here digital cameras actually have a distinct advantage over film cameras. While cheaper digital cameras may only have digital zoom (which is really just a form of in-camera enlargement that results in a lower resolution original image), high end models are available with both digital and optical zooming.
When shopping for your digital camera, give priority to the optical zoom capability and buy the highest power optical zoom that fits within your budget. Digital zoom is a nice extra, but the effects can easily be replicated during the “processing” of the image on your computer, prior to printing the images.
Saturday, November 25, 2006
Firefox 2.0 beware of password fishing
"Today, Mozilla made public bug #360493, which exposes Firefox's Password Manager on many public sites. The flaw derives from Firefox's willingness to supply the username and password stored on one page on a domain to another page on a domain. For example, username/password input tags on a Myspace user's site will be unhelpfully propagated with the visitor's Myspace.com credentials. It was first discovered in the wild by Netcraft on Oct. 27. As this proof-of-concept illustrates, because the username/password fields need not be visible on the page, your password can be stolen in an almost completely transparent fashion. Stopgap solutions include avoiding using Password Manager and the Master Password Timeout Firefox extension, which will at least cause a prompt before the fields are filled. However, in the original case detailed in the bug report, the phish mimicked the login.myspace.com site almost perfectly, causing many users to believe they needed to log in. A description of this new type of attack, dubbed the Reverse Cross-Site Request (RCSR) vulnerability, is available from the bug's original author."
Subscribe to:
Posts (Atom)