Archive for August, 2009

Software Licensing

Wednesday, August 5th, 2009

A software license is a legal instrument which governs the usage and distribution of copyrighted software. Software licenses can fall into two broad categories:

Proprietary software licenses grant the buyer of a copy of the software the permission to use it, but ownership of the copy remains with the publisher. A limited set of rights is granted to the buyer. The buyer has to accept the terms and conditions in order to be able to use the software. Microsoft Office, for example, is distributed under a proprietary license.
Open source and free software licenses transfer ownership of the copy to the buyer/end user. The end user is free to modify the source code and redistribute the modified version(for free or at a price), with a few simple conditions that depend on the type of license. There are many open source licenses; we will look at some common ones here:
MIT License: This is probably the simplest license. It surrenders all rights that the copyright holder/publisher typically receives, including the exclusive right to commercially exploit the work. It also disclaims any express warranty and fitness for a purpose.. There is no clause prohibiting use of the names of publishing organizations and contributors for product endorsement. When the original work or “substantial portions” of it are distributed, the licensee is required to include a copyright notice and the notice giving permission to potential licensees of their rights to use the work. However, modifications may go into proprietary software and need not necessarily be redistributed.
BSD License: The BSD license is very similar to the MIT license except with respect to a major clause: the names of the contributors may not be used without their explicit permission. This provides protection to contributors in the event that the product is associated with a poorly written program.
GPL – GNU General Public License: The GPL, created by the Richard M. Stallman of the Free Software Foundation (FSF), also provides licensees with full modification and distribution rights, with two conditions: redistribution can be done under the same terms as the original license  and redistributed copies must contain the original GPL text without any modifications. This ensures that a licensee has the same rights that the licensor had over the document, the idea of copyleft. The GPL also allows value-add activities: a person can sell a guarantee that a GPL work will perform under a particular condition and make the changes necessary to achieve this goal. There are multiple versions of this license, the latest being version 3.
LGPL – GNU Lesser General Public License: This license allows work licensed under GPL to link to non-GPL software. A company could integrate LGPL software for with proprietary software for in-house use, but if the integrated work were to be sold under a proprietary license, it would violate the legal terms of the GPL. This license is generally applicable to subroutine libraries.
(There is another category of licenses called free software licenses, but since most of them are compatible with one of the above open source licenses mentioned above, this is not listed separately.)
One of the greatest advantages of open source licensing is innovation: contrary to popular belief, programmers are willing to contribute to open source projects with only a more useful program as the reward. More people using a software and more people trying to fix known issues (in a well organized manner, as is the case with many open source software) generally results in better quality and reliability. Also, while the publisher of a proprietary software can stop supporting it after some time, it is generally quite easy to find someone on the internet who will be able to help you out with the problems you may be facing with your open source code.
http://oreilly.com/catalog/9780596005818/

Proprietary software licenses grant the buyer of a copy of the software the permission to use it, but ownership of the copy remains with the publisher. A limited set of rights is granted to the buyer. The buyer has to accept the terms and conditions in order to be able to use the software. Microsoft Office, for example, is distributed under a proprietary license.

Open source and free software licenses transfer ownership of the copy to the buyer/end user. The end user is free to modify the source code and redistribute the modified version(for free or at a price), with a few simple conditions that depend on the type of license. There are many open source licenses; we will look at some common ones here:

MIT License: This is probably the simplest license. It surrenders all rights that the copyright holder/publisher typically receives, including the exclusive right to commercially exploit the work. It also disclaims any express warranty and fitness for a purpose.. There is no clause prohibiting use of the names of publishing organizations and contributors for product endorsement. When the original work or “substantial portions” of it are distributed, the licensee is required to include a copyright notice and the notice giving permission to potential licensees of their rights to use the work. However, modifications may go into proprietary software and need not necessarily be redistributed.

BSD License: The BSD license is very similar to the MIT license except with respect to a major clause: the names of the contributors may not be used without their explicit permission. This provides protection to contributors in the event that the product is associated with a poorly written program.

GPL – GNU General Public License: The GPL, created by the Richard M. Stallman of the Free Software Foundation (FSF), also provides licensees with full modification and distribution rights, with two conditions: redistribution can be done under the same terms as the original license  and redistributed copies must contain the original GPL text without any modifications. This ensures that a licensee has the same rights that the licensor had over the document, the idea of copyleft. The GPL also allows value-add activities: a person can sell a guarantee that a GPL work will perform under a particular condition and make the changes necessary to achieve this goal. There are multiple versions of this license, the latest being version 3.

LGPL – GNU Lesser General Public License: This license allows work licensed under GPL to link to non-GPL software. A company could integrate LGPL software for with proprietary software for in-house use, but if the integrated work were to be sold under a proprietary license, it would violate the legal terms of the GPL. This license is generally applicable to subroutine libraries.

One of the greatest advantages of open source licensing is innovation: contrary to popular belief, programmers are willing to contribute to open source projects with only a more useful program as the reward. More people using a software and more people trying to fix known issues (in a well organized manner, as is the case with many open source software) generally results in better quality and reliability. Also, while the publisher of a proprietary software can stop supporting it after some time, it is generally quite easy to find someone on the internet who will be able to help you out with the problems you may be facing with your open source code.

Reference: http://oreilly.com/catalog/9780596005818/

Tags: , , , , ,
Posted in Articles | No Comments »

Ajax & UI Performance

Wednesday, August 5th, 2009
Ajax (also, AJAX), short for Asynchronous JavaScript and XML, is a group of interrelated web development techniques used to create interactive web applications. Ajax can improve response time by communicating with the server without full page requests. The result  is a rich interface and better quality applications. A simple example of Ajax is the ‘Suggest’ feature in Google – suggestions are displayed as you type in your query in the search box.
Why use Ajax?
Bandwidth savings: In applications that have a significant part of each page containing content that is identical in multiple page requests, using Ajax to update only the relevant parts of a page can bring about a significant savings in bandwidth requirements. The savings is generally dependent on the complexity of the website. Even a 10% saving in bandwidth will be significant when considering data intensive web applications (like one requiring display of rich, interactive maps and graphs) or a bandwidth constrained web application.
Time savings: Ajax can also bring increase the efficiency of using a web application. Let’s say you only want to see a list of refreshed news items on the website. The time saved by making a request only for the news items instead of the entire page is significant when accumulated over a period.
Improved responsiveness: Ajax can bring about a better and uninterrupted work flow, thus increasing productivity. Ajax also lets you work on the page while information is being retrieved in the background for a part of it.
These three factors can significantly improve overall business productivity.
One drawback with Ajax is that using the ‘Back’ button on the browser may not always take the user to the previous logical operation that they had performed, but to the previous page in the browser history, since an Ajax request is not a page request. Bookmarking will also not work. Recent releases of browsers have exposed functionality that allows developers to manipulate the browser history to show the correct operations performed by users on an Ajax enabled page, but not all web applications have incorporated this feature. Also, since the screen content is being updated dynamically, the changes may not be detected by accessibility tools.
Another is that, in many cases, complex JavaScript is required to make use of the full potential that Ajax offers, and JavaScript with high complexity is not the easiest of things to understand.
Ajax has been around for quite some time now, and has been playing a significant part in improving the interactivity of web applications. With the rich experience it can offer users, it is also one of the enablers of Web 2.0 (note: Ajax itself is not Web 2.0), and we can probably expect to see it around for quite some time to come.
http://www.helium.com/items/49433-advantages-and-disadvantages-of-ajax; http://www.webperformanceinc.com/library/reports/AjaxBandwidth/; http://www.ibm.com/developerworks/web/library/wa-aj-perform/index.html

Ajax (also, AJAX), short for Asynchronous JavaScript and XML, is a group of interrelated web development techniques used to create interactive web applications. Ajax can improve response time by communicating with the server without full page requests. The result  is a rich interface and better quality applications. A simple example of Ajax is the ‘Suggest’ feature in Google – suggestions are displayed as you type in your query in the search box.

Why use Ajax?

Bandwidth savings: In applications that have a significant part of each page containing content that is identical in multiple page requests, using Ajax to update only the relevant parts of a page can bring about a significant savings in bandwidth requirements. The savings is generally dependent on the complexity of the website. Even a 10% saving in bandwidth will be significant when considering data intensive web applications (like one requiring display of rich, interactive maps and graphs) or a bandwidth constrained web application.

Time savings: Ajax can also bring increase the efficiency of using a web application. Let’s say you only want to see a list of refreshed news items on the website. The time saved by making a request only for the news items instead of the entire page is significant when accumulated over a period.

Improved responsiveness: Ajax can bring about a better and uninterrupted work flow, thus increasing productivity. Ajax also lets you work on the page while information is being retrieved in the background for a part of it.

These three factors can significantly improve overall business productivity.

One drawback with Ajax is that using the ‘Back’ button on the browser may not always take the user to the previous logical operation that they had performed, but to the previous page in the browser history, since an Ajax request is not a page request. Bookmarking will also not work. Recent releases of browsers have exposed functionality that allows developers to manipulate the browser history to show the correct operations performed by users on an Ajax enabled page, but not all web applications have incorporated this feature. Also, since the screen content is being updated dynamically, the changes may not be detected by accessibility tools.

Another is that, in many cases, complex JavaScript is required to make use of the full potential that Ajax offers, and JavaScript with high complexity is not the easiest of things to understand.

Ajax has been around for quite some time now, and has been playing a significant part in improving the interactivity of web applications. With the rich experience it can offer users, it is also one of the enablers of Web 2.0 (note: Ajax itself is not Web 2.0), and we can probably expect to see it around for quite some time to come.

References: http://www.helium.com/items/49433-advantages-and-disadvantages-of-ajax; http://www.webperformanceinc.com/library/reports/AjaxBandwidth/; http://www.ibm.com/developerworks/web/library/wa-aj-perform/index.html

Tags: ,
Posted in Articles | No Comments »

Security Threats – II: SQL Injection

Wednesday, August 5th, 2009
In this article, the second in our website security attacks series, we look at the hows and whys of SQL injection.
SQL injection involves compromising the security of an application by insertion or injection of an SQL query via the input data from the client to the application. This can happen when the input data is not correctly filtered for string literal escape cahracters. Successful SQL exploits can read data from the database and DBMS files, make modifications to it and execute administrative functions on the database.
How does this work? Let’s take a simple query
Select * from user_details where username = ;
The webpage probably has something similar to the following to capture the username and pass it on to the  backend:
string userName = field.getUserName();
string query = “Select * from user_details where username = ‘” + userName + “’”;
If a malicious user wanted to obtain the contents of the entire table (and the application is vulnerable to SQL injection attacks), all he would have to do is, instead of just typing in a username, he’d input <m_user’ OR ‘x’='x>. When this gets inserted into the query, the query gets transformed into
Select * from user_details where username = ‘m_user’ OR ‘x’='x’;
Because ‘x’ always equals ‘x’; the condition is always true and the query, which essentially converts into ‘Select * from user_details;’  returns the entire contents of the table user_details.
Hackers can make use of this vulnerability to obtain data and perpetrate malicious attacks on websites. Some databases allow multiple SQL statements separated by semicolons to be executed as a batch, allowing the attacker to execute arbitrary commands on the database.
How can you avoid such an attack on your website? A simple approach is to accept characters only from an allowed list of safe characters. This provides a first layer of security for the application. Another way is to use parameterized statements and stored procedures. Also, it must be ensured that the account with the least privileges is used for all user interactions. These precautions will go a long way in preventing your site from being hacked.
http://www.owasp.org/index.php/Guide_to_SQL_Injection; http://en.wikipedia.org/wiki/SQL_injection; http://www.owasp.org/index.php/SQL_injection

In this article, the second in our series of articles on website security attacks, we look at the hows and whys of SQL injection.

SQL injection involves compromising the security of an application by insertion or injection of an SQL query via the input data from the client to the application. This can happen when the input data is not correctly filtered for string literal escape characters. Successful SQL exploits can read data from the database and DBMS files, make modifications to it and execute administrative functions on the database.

How does this work? Let’s take a simple query:

Select * from user_details where username = ;

The web page probably has something similar to the following to capture the username and pass it on to the  backend:

{ …

string userName = field.getUserName();

string query = “Select * from user_details where username = ‘” + userName + “’”;

…}

If a malicious user wanted to obtain the contents of the entire table (and the application is vulnerable to SQL injection attacks), instead of just typing in a username, he’d input <m_user’ OR ‘x’='x>. When this gets inserted into the query, the query gets transformed into:

Select * from user_details where username = ‘m_user’ OR ‘x’='x’;

Because ‘x’ always equals ‘x’, the condition is always true and the query, which essentially converts into ‘Select * from user_details;’ returns the entire contents of the table user_details.

Hackers can make use of this vulnerability to obtain data and perpetrate malicious attacks on websites. Some databases allow multiple SQL statements separated by semicolons to be executed as a batch, allowing the attacker to execute arbitrary commands on the database.

How can you avoid such an attack on your website? A simple approach is to accept characters only from an allowed list of safe characters. This provides a first layer of security for the application. Another way is to use parameterized statements and stored procedures. Also, it must be ensured that the account with the least privileges is used for all user interactions. These precautions will go a long way in preventing your site from being hacked.

References: http://www.owasp.org/index.php/Guide_to_SQL_Injection; http://en.wikipedia.org/wiki/SQL_injection; http://www.owasp.org/index.php/SQL_injection

Tags: , , ,
Posted in Articles | 1 Comment »

The Month That Was – Google Wave and more

Wednesday, August 5th, 2009
Red Hat just got into the S&P 500 stock index!

- Red Hat (RHT) just got into the S&P 500 stock index! This is yet another indicator pointing to the growing importance that open source is gaining across industries.

- On July 29th Yahoo! and Microsoft inked a 10-year deal and joined hands in the ongoing search engine battle with a revenue sharing deal. Under the agreement, Microsoft, with Bing, will provide the search technology for Yahoo! search, while Yahoo! will focus on search engine advertising. Yahoo! also gets guaranteed revenues for the first 5 years of the deal. The move enables MS-Yahoo! to garner a greater search engine market share and slightly narrow the gap between them and rival (and market leader) Google.

- Google is releasing a preview build of a new Web-based communication and collaboration tool by late September. Called Google Wave, the open-source tool will initially be offered to about 100,000 people who have volunteered to provide feedback. Google Wave — based on the new HTML 5 markup language for building Web pages — is already available to developers via a “sandbox” version of the tool’s enabling APIs. The tool will let individuals communicate and work together on “waves” — collaborative communications containing richly formatted text, photos, videos, maps, gadgets and other elements. Each wave is formulated as a “tree structure of messages” within which conventional e-mail and instant-messaging capabilities are combined and delivered in almost real time on a keystroke-by-keystroke basis.

Tags: , , , , ,
Posted in News | 1 Comment »

Open Source Events in August

Wednesday, August 5th, 2009

The table below provides a listing of some open source events happening this month around the world.

Event Type Starts Ends Location

Umbraco UK Meetup (Aug-2009)

Community Event

Aug 6, 2009

Aug 6, 2009

London, UK

Drupal Camp Los Angeles

Community Event

Aug 8, 2009

Aug 9, 2009

Los Angeles, USA

Intensive Alfresco Training for Development

Training

Aug 10, 2009

Aug 14, 2009

New York, USA

Search Engine Strategies SJ 2009

Conference

Aug 11, 2009

Aug 14, 2009

San Jose, USA

Open Source World 2009

Conference

Aug 12, 2009

Aug 13, 2009

San Francisco, USA

Cloud World 2009

Conference

Aug 12, 2009

Aug 13, 2009

San Francisco, USA

Joomla Beginner Training in Reno

Training

Aug 17, 2009

Aug 17, 2009

Reno, USA

FrOSCon

Community Event

Aug 22, 2009

Aug 23, 2009

Sankt Augustin, Germany

Joomla Beginner Training in New Orleans

Training

Aug 24, 2009

Aug 24, 2009

New Orleans, USA

Discovering Open Source ERP

Community Event

Aug 24, 2009

Aug 24, 2009

London, UK

DrupalCamp Kyiv 2009

Community Event

Aug 28, 2009

Aug 29, 2009

Kiev, Ukraine

References: http://www.cmswire.com/events/;  http://ossg.bcs.org/; http://fossevents.org/?m=200908&cat=7

Tags:
Posted in Announcements, News | No Comments »