Tuesday, May 23, 2006
The Second Half of Buffer Overflows
LINUX NEWS FROM O'REILLY NETWORK
----------------------------------------
The Latest from http://www.linuxdevcenter.com and http://ONLamp.com
=================================================================
Sponsored by thawte:
Be the first to crack thawte's Crypto Challenge IX and you win a new Nokia
770 Internet Tablet, supporting Google Talk, wifi and Bluetooth
connectivity. It's not just a brainteaser for geeks--it's THE challenge
for skilled code-breakers.
http://www.oreilly.com/go/thawte_lnx52306
=================================================================
Welcome to the Linux newsletter. Just as Linux is the heart of the
GNU/Linux operating system, so is the term "Linux" a stand-in for the
huge, multi-decade corpus of free and open source software. Here's what
ONLamp.com and the other O'Reilly Network sites had to say about it this
week.
HTTP is a stateless protocol, much to the chagrin of everyone who's ever
written a web application. There are ways to get around this, however.
There are also at least two different places where you need different
behavior: sessions and state. This week, WASP's Brian Fioca explains the
differences between the two and shows good ways to handle both, using PHP
as his example:
<http://www.onlamp.com/pub/a/php/2006/05/18/managing-sessions-and-state.html>
By now, plenty of people understand the particular security hole known as
a buffer overflow. Certain C-level programming constructs make it
possible for an attacker to trick a remote computer into executing
arbitrary code. Yet do you understand what that arbitrary code is and how
it works? Peter Mikhalenko walks through the creation of a shellcode used
to demonstrate a vulnerability. With this knowledge, you can prove
security problems on your own machines with code much more trustworthy
than a binary downloaded from a very shady place online:
<http://www.linuxdevcenter.com/pub/a/linux/2006/05/18/how-shellcodes-work.html>
In weblogs this week, your editor spent yet more time refactoring an aging
Perl web application. At last, he finally finished fixing the node tests
and has started to manipulate the code itself:
<http://www.oreillynet.com/onlamp/blog/2006/05/refactoring_everything_day_19.html>
<http://www.oreillynet.com/onlamp/blog/2006/05/refactoring_everything_day_20.html>
<http://www.oreillynet.com/onlamp/blog/2006/05/refactoring_everything_day_21.html>
Robert Pratte considered the serious business use of Perl:
<http://www.oreillynet.com/onlamp/blog/2006/05/of_oysters_and_perls_or_perl_i.html>
Steve Mallett decided to become a Japanese schoolgirl (or at least an
alpha technology junkie):
<http://www.oreillynet.com/onlamp/blog/2006/05/were_all_japanese_schoolgirls.html>
Your editor revealed how to befriend an open source project on MySpace:
<http://www.oreillynet.com/onlamp/blog/2006/05/befriend_a_floss_project_on_my.html>
Curtis Poe resurrected Sapir-Whorf to discuss features missing from
programming languages:
<http://www.oreillynet.com/onlamp/blog/2006/05/sapirwhorf_is_not_a_klingon.html>
Andy Oram visited Jitterbit, a free software business bringing integration
to medium-sized companies:
<http://www.oreillynet.com/onlamp/blog/2006/05/jitterbit_userdriven_integrati.html>
Dave Cross found an auction for the most offensive Perl t-shirt ever:
<http://www.oreillynet.com/onlamp/blog/2006/05/perl_is_my_tshirt.html>
Caitlyn Martin opined that she really wanted to like Gnome, but just
can't. Then the commenters weighed in:
<http://www.oreillynet.com/linux/blog/2006/05/taking_a_linuslike_attitude_to.html>
Carla Schroder found a great article about a great-grandmother becoming an
enthusiastic music sharer:
<http://www.oreillynet.com/linux/blog/2006/05/greatgrandmother_hoists_the_jo.html>
Tony Stubblebine started to invent a new Ruby gem search tool:
<http://www.oreillynet.com/ruby/blog/2006/05/what_do_you_want_from_your_rub.html>
Pat Eyler raved about using rcov to verify test coverage on Ruby
projects:
<http://www.oreillynet.com/ruby/blog/2006/05/eating_your_own_dogfood_1.html>
Brian Jones argued that LDAP is not a relational database:
<http://www.oreillynet.com/sysadmin/blog/2006/05/ldap_is_not_a_database.html>
That's it for this week.
Please note that the Linux newsletter is going on hiatus for two weeks
while your editor strenuously avoids work. In the meantime, console
yourself with the tips, tricks, and opinions of everyone else on ORN,
including the revitalized O'Reilly Radar:
<http://radar.oreilly.com/>
Not heading to the beach,
- c
chromatic
chromatic@oreilly.com
Technical Editor
O'Reilly Network
================================================================
Carson Workshops: Getting Started with Rails
Taught by Geoffrey Grosenbach, May 25th 2006, NYC Learn how to get rockin'
with Ruby on Rails by one of the world's leading Rails developers.
http://www.oreilly.com/go/carson_rubyonrails
================================================================
ONLamp.com and Linux Devcenter Top Five Articles Last Week
1. Rolling with Ruby on Rails
The Ruby community is abuzz about Rails, a web application framework that
makes database-backed apps dead simple. What's the fuss? Is it worth the
hype? Curt Hibbs shows off Rails, building a simple application that even
non-Rubyists can follow.
<http://www.onlamp.com/pub/a/onlamp/2005/01/20/rails.html>
***
2. How Shellcodes Work
Buffer overflow problems are well-known. Fewer people know how exploits
can help attackers execute their malware through buffer overflows and
other holes. Peter Mikhalenko walks through the construction and
refinement of a shellcode to show how they work so that you can protect
your machines.
<http://www.linuxdevcenter.com/pub/a/linux/2006/05/18/how-shellcodes-work.html>
***
3. Rolling with Ruby on Rails, Part 2
Curt Hibbs introduced Ruby on Rails by building a simple but functional
web application in just a few minutes. Does the ease of use continue? He
thinks so. In the second of two parts, Curt completes his example Rails
application in merely 47 lines of code.
<http://www.onlamp.com/pub/a/onlamp/2005/03/03/rails.html>
***
4. Ajax on Rails
XMLHttpRequest and Ruby on Rails are two hot topics in web development. As
you ought to expect by now, they work really well together. Curt Hibbs
explains the minimal Ajax you need to know and the minimal Ruby you need
to write to Ajax-ify your Rails applications.
<http://www.onlamp.com/pub/a/onlamp/2005/06/09/rails_ajax.html>
***
5. Using PC-BSD
A few user-friendly distributions of FreeBSD have appeared lately. PC-BSD
is one suitable for the corporate and home desktops, even those of users
unfamiliar with Unix. Dru Lavigne walks through the installation and
configuration of PC-BSD to provide a modern, powerful workstation.
<http://www.onlamp.com/pub/a/bsd/2006/05/11/FreeBSD_Basics.html>
***
=================================================================
O'Reilly Learning Web Programming Certificate Special
"I tried to learn this from books but it only seemed like letters and
numbers for me. Now I am dreaming in code. :)"
-William Twiner, Enterpreneur
Will Twiner is enrolled in our University of Illinois Web Programming
Certificate Series, and plans to use his skills to start a small business.
Have you been wanting to start a new I.T. career, but think you can't
learn the skills? Right now, enroll in all six Web Programming courses,
and receive a $300 instant rebate! Enroll today--you just might surprise
yourself.
<http://www.oreillylearning.com/promotion/>
=================================================================
------------------------------------------------------------------
Visit our Sponsored Developer Resource Pages and learn about cool
stuff from our sponsors!
Downloads - Free Training - Webinars - Updates
Altova's Developer Zone: http://www.xml.com/zones/altova
ASP.net 2.0 Training Center: http://www.oreilly.com/go/ms_aspnet
Driver Agents Driver Updates: http://www.oreilly.com/go/driver_updates
GoToMyPC(R) Remote Access: http://www.oreillynet.com/etel/citrix/
Coming soon:
Stylus StudioTutorials from DataDirect!
------------------------------------------------------------------
Interested in sponsoring the Linux DevCenter newsletter? Please
email us at advertising@oreilly.com for rate and availability
information. Thank you!
-----------------------------------------------------------------
To change your newsletter subscription options, please visit
http://www.oreillynet.com/cs/nl/home
For assistance, email help@oreillynet.com
O'Reilly Media, Inc.
1005 Gravenstein Highway North
Sebastopol, CA 95472
(707) 827-7000
-----------------------------------------------------------------
