ASP.Net Traditional Web Anti-Pattern

ASP.Net introduces some new concepts in Web Development that many aren’t familiar with. I’ve come across enough projects done badly in the same way that I’ve concluded this must be an anti-pattern…

“The ASP.Net Traditional Web Anti-Pattern” is what web developers coming from all web backgrounds Perl/CGI, ASP/COM, JSP, PHP and others all seem to build if not given adequate time, guidance or training in .Net Web Development.

Continue reading

Role of Architect

What a wonderfully eclectic group we are! It is clear that we all bring many different levels of ability and many different experiences to the mix here. While this is the lifeblood of any organisation it can have a damaging side-effect. If people are not self-aware and self-evaluating there is a real risk that the same things that have been done before keep getting done again and again, regardless of their suitability.

Continue reading

Code Red Prevalent

We’ve been working on some proposition prototypes here over the past few weeks, based on Apache, PHP and MySql. We decided to run it on one of our win2k servers in the lab and get everything up and running before putting out onto the public Internet for testing.

We had some problems with one of the PHP extensions under win2k, libmcurl, so after much digging around newsgroups decided to switch to Linux – where we knew it worked. And lucky we did… When we came to put the box public, we set up a NAT address for it and opened port 80 only for that address. Within 30 seconds it was taking requests, not for our work, but for Code Red and variants.

We probably wouldn’t have patched the win2k box, it was only a little bit of prototyping, and we didn’t harden the Linux install. But what a difference. Win2k would have been compromised in seconds. And, the server wasn’t even listed in DNS, these were the straight forward random ip address attacks that these worms perform, and most were from IP addresses close by on our providers network.

I can’t understand how, with all the publicity and so on, these worms are still so prevalent.

SecureSummit & PKI

I was talking earlier this month about Entrust’s latest purchase, GetAccess (formerly EnCommerce GetAccess), at their SecureSummit conference in San Diego. It was great fun and we had a great turn out of people wanting to hear all about Egg and what we’ve been doing.

I managed to get some of the humorous bits from our adverts in which lightened up the topic a bit and even got a few laughs from what was a very friendly audience.

But it still strikes me as odd that Entrust have gotten so big on, essentially, PKI.

Continue reading