The report is intesting on many fronts, one of which is the fact that the tool I help build at NT OBJECTives came out on top, but also because its the first type of review thats looking at a statistic that really compares scanners in a quantifiable way.

Some comment on the site from users of the other products or from the vendors themselves have made the claim that web scanners are not designed to be “point and shoot” as they say, and that a human should be training the scanner to each web app. I think they are doing users a disservice to work from that assumption.

A scanner should do as much as it can on its own, and let humans do their own pen testing, and/or help point pen testers to areas of interest. If your a organization with hundreds or thousands of web apps that need testing, do you really have the man power to teach your “automated web scanner” how to test each of those apps?

Do you really have time to spend clinking on every link, and filling out every form on a website with some 3000+ pages, or do you want the scanner that does the best job of doing all of this for you?

Theres still a few tiny features I want to add in, but its in good shape, and I need sleep so I can run off to the Podcast Expo in a few hours.

UPDATE - Bug in this version… of course, so hang on for next release due out in a few hours

I have had the mis-fortune of being completely swamped in work during the start of these last two, but when the third is up, Im cleaning my calender, turning off cell phones and ignoring any unnecessary chats so I can beat it as quickly as possible and get listed in the top ten. Knowing rSnake, I may decide to put together a small MightySeek team to work together to increase our chances, but I will see how it plays out.

Go have fun, and test your skills

• Ha.ckers.org Challenge #1
• Ha.ckers.org Challenge #2

Btw, #2 had a logic flaw which really opens up the next one to additional scrutiny to see whats possible to find during the next one.

This is a really difficult and challenging issue, with a bunch of issues that are fuzzy at best. I have high hopes that the WASSEC Project thats being hosted by the Web Application Security Consortium, because its going to bring a bunch of us from the app sec tool vendor space and the web app sec community� together to discuss the issue and attempt to come up with a good reference document for the ways to evaluate scanners.

I’m curious how we will be able to come up with any consensus, but with any luck and some hard work and compromise I think this could be a turning point to helping public understanding of this issue.

I finally had a chance to meet Matt Mullenweg, and was thoroughly impressed, this is one young man to watch. To think that at 23, hes at the head of a project thats impacted so many people, and has gained so much interest and respect, and has managed to build a business model around an open sourced app… no easy feat.

So then it sets in. I’m the opening presenter to this conference… I’ve really been too busy to have thought much about my talk at WordCamp the preceding couple of weeks because work has been crazy busy. But standing there getting setup to open the conference I got a bit nervous. Its also been a couple years since doing one of these types of things, so I really started feeling completely unprepared.

Matt introduces me and I ask the audience a few questions about whos familiar with podcasting (everyone) and how many podcasters are out there (a few). Well, this kind of took some thunder out of my slides intended to be used to help explain podcasting basics. I had to think quick to adjust my talk and explain my views of how I feel podcasting to be a little more personal and blah blah. Was a bit of a slow start.

So I figured I could launch into the stuff about podPress and show of the features and talk some praise of WordPress, which I started… and then the Internet connection went dead. Just as I was starting to feel a little comfortable…
With some quick action by the Automattic team I got back online and was quickly followed by the audience and was able to start cracking some lame jokes and getting into a groove about podPress, podcasting and WordPress.

Even with the slow start, I felt like I was finally able to connect and coherently discuss some of the things I am passionate about, and hopefully show how easy it is to get into podcasting, the cool features of podPress and the amazing platform WordPress provided that enabled me to create the feature set. The talk was video taped, so as soon as I get a copy of the video I will be adding the media to this post so it will end up in my feed as a video podcast.

As soon as my talk was over, I chatted with a few people in the lobby for about half and hour, and then headed to the airport to get back home. Next year, as a speaker or not, I’m going to make sure to plan better so I can stay for the entire weekend.

Update: The video is now available.

Way back before World of Warcraft, Never Winter Nights, Ultima Online there was The Shadow of Yserbius which really set the bar for online gaming.

The whole network was unbelievable in its scope. You could play the D&D style Yserbius, card games at the club house, gamble at CasinoLand, have simulated dog fights in the Red Baron game, play the popular Boogers game, and ever get help with your home work.
To this day I have not seen anything to match the fun and variety that I had the privilege to experience back in the days when I was spending thousands of dollars and endless hours experiencing life “online”.

I have cherished my memories of those days and have copies of all the old software and hacks which I have kept faithfully for the last 15 years. I have joined a couple efforts to re-create the world, but all have failed… until now. A guy that goes by the name of byoung was able to re-create the server so that the old client software is able to work in DosBox which redirects the modem calls over TCP/IP. His website has all the software and directions to get setup very easily. It took me all of 10 mins to get everything installed and working. **To make it even easier to get started use the installer I created**

I spent about 4 hours online yesterday playing The Shadow of Yserbius with a few other people and building up my character. Oh man have I forgotten a ton, but the memories flooding back are a total blast. Even if you never played back in the day, I encourage you to get setup with it and join the growing community of users. If you let me know you will be in, I will be glad to join you for any game you like. Im having fun re-discovering all the cool stuff in this world of ImagiNation.

However, the iPhone just isnt it for me. Its cool, and its heading toward the dream of having a single device, but for $600 and having to switch to a crappy cell phone carrier, NO THANKS. Aside from the price and cell phone carrier monopoly, I really just cant stand touch pad phone buttons. I need to be able to dial without looking, and can only do� that with actual buttons. Touch screens wear out, and become a pain to push the button you want. Im sure you are all experienced in using the touch screens at the market when you pay by debit card, and the hassles when they start wearing out. Do we really want that on our cell phone, where we have a $600 price tag to replace the thing. No me.

For those not familiar with Planet sites, they are basically RSS readers which download other RSS feeds and merge together into a single feed. This means you can subscribe to one and get all the postings from all the feeds in the Planet.

Visit Planet Websecurity to see this in action

This makes me wonder if web app sec is ever going to succeed, or if the web is just doomed to have problems for all time. Forum software is a very good example of the problem with many web apps, and web app development in general. To start its a very simple application, which if done right can be done securely. Of course the major challenge is that your taking user input and displaying it to other users. This immediately means your storing the data most likely into a database, which means you must secure against SQL Injection attacks. OK, thats not too hard, so that can be done. Next you need to make sure your filtering the inputs on the way in to remove any HTML tagging and escaping on the way out to be safe. The XSS part is a bit harder because there are clever people out there using a ton of different ways to bypass any filtering/escaping you do.� However, this can be accomplished with some focused attention, and you will then have a simple, secure and stable forum application.

So whats wrong with this? Feature creep.
Now that you have a basic forum in place, people will want to be able to format their text, which means you need to allow some� HTML tags, or have some custom tags like BBCode which you then convert to real HTML tags. At this point things are starting to get a little tougher, but with diligence its still all workable. Next users want to upload attachments, have avatars, have all sorts of moderation features, and so on and so on. Then to make matters even worse, new developers join the project and they are not always as aware or concerned about security issues, and soon the application is as buggy and vulnerable as the forum software you are trying to replace.

Is this solvable? Yes, but only with diligence, hard work and auditing. Did I mention hard work?

In any case, here ya go.

PHP has frequently been blamed for security problems in applications written in PHP which really is no fault of the language and engine itself. It would be like everyone blaming C and C++ as being insecure, and the cause of tons of security problems. Most of the time the problem is the developers who use the languages, not the languages themselves. However, there are security problems in the PHP codebase which need to be fixed and is what is being highlighted by the Month Of PHP Bugs.

So in this episode I discuss these issues, some of my past projects and some various other issues in PHP… Its so good to be back at the mic, even tho I am still recovering from the flu and had my voice start failing me at the end.
Enjoy!

So, its only a year and one month old!

What started as a quick hack to wordpress that I wanted to use to bring attention to my little podcast, has become far more widely appreciated and used than I could have ever guessed.
I want to thank you all for your support and thanks that I get in forum posts, emails and paypal donations. They all matter very much to me, and encourage my development to continue.

A special thanks also to macx who, over the last couple of months has really taking the initial quick little stats feature and turned it into something impressive. Its always great fun when I can chat about code with another developer and enjoy the collaborative artistic effort that software development can be.

So when I say I was blown away by the efforts of Stranger Things (http://www.strangerthings.tv), its not from a lack of experience with the brillance and creativity in this community. Its because its quite an impressive accomplishment. Audio is one thing, and it takes skill and hard work to do it well. Short video clips like those from zeFrank andTikiBarTV are also quite a bit of work and take great talent. But to produce a 30 minute long episode with decent acting, a cool story (from self-pimping Sigler) and very nice special effects… and to make it a free podcast. Wow.

I have a hell of a time just trying to get my show out once a month, and even that is wayyy behind on getting some episodes out (one is coming soon btw).

Anyways, my props to the Stranger Things team, and I hope you are able to continue gaining an audience and some sponsorship/donations to help keep your show going.

note: this post is likley to become a podcast if I can finish recording the show.

Go check out the interview, along with the forum thread discussion.

My best effort          vs       Daddo
 

Daddo wins!

Well thats all changing now. Today I released a new version of podPress and am preping to push out a podcast in the next day or two.
Thanks for all of you still out there watching, I’ll make sure to avoid big gaps like this again.

Seek3r

I was pretty silent thru most of it, but toward the end Evo went around the room introducing each of us and asking a few questions. I hassled them a little (all in good fun) and got quite a laugh/boo out of it. It was a great time and it alone was worth getting to the PPME for me.

Im the guy on the right with the green shirt and this hat

Mighty Seek

The Podcast Academy: Dan Kuykendall