Had problem with PHP XCache with my server configuration, seems I must spend another hour fixing this… it totally blows…
Securing Ajax and Web Services
It is undeniable that Web services and AJAX-ified interfaces are the trend now. Application that utilizes internet to retrieve data (such as mobile application or other thin client) uses web services alongside with its data format. AJAX-ified interface and website gives a modern and edgy look can make websites more attractive and can create great impression to the users.
However the issue of the web application security would still remain the same, if not more challenging, since there are so many ways to exploit the vulnerability of websites that utilizes Web Services and AJAX transfers on the background.
Therefore, it is imperative to use the right technique in order to evaluate the security of these services before deploying them out in the open.
For that matter, now I’m currently reading Ajax Security (Hoffman,B. & Sullivan, B.) and Securing Ajax applications (Wells, C.) which in my opinion is a pretty good start for somebody like me to understand common methods for securing web services and websites which uses AJAX heavily.
Hopefully the situation would improved as there are a lot of campaigns around to raise the state of awareness of web application security.
lowendbox.com: A place to look for cheap-ish VPS and Dedicated Server – Less than USD7 / month!
lowendbox.com is a website that lists bare minimum VPS or Dedicated Server offerings with the lowest price.
For VPS, the category is divided by the virtualization technology and the operating system, as well as the geographical location of the data centers.
Additionally lowendbox.com provides discussion forum for optimizing web server and databases for the bare minimum servers!
My wishlist: PHP Development in the Cloud
I’m not a PHP developer by profession, nor I’m very good at it, there are times where I was required to write PHP web application for my daytime job. While it is still a simple application, nevertheless I grew fond of the simplicity of PHP application development and deployment (though some aspects of the language still confuses me, and sometimes the maintenance is a PITA).
I haven’t developed any PHP application for the masses yet, but if I do, I imagine it would benefit from the use of Cloud, therefore my latest wishlist is this book: PHP Development in the Cloud
The book is written by Ivo Jansch and Vito Chin, and it covers Cloud Computing Characteristics and Models, Cloud Computing Architecture and Scalability and how to prevent bottlenecks, Working with Popular Cloud Infrastructures and Platform (covers Amazon, Google and Rackspace) and Working with Popular Cloud Software and Services (OpenID, OAuth, CRM, Maps and Storage).
The book is available from in paperback format from online bookstore (Amazon, Barnes & Nobile, etc) or in digital form from PHP Architect website
Rant: About Starting up an E-commerce Site….
A bit of advice when starting up an e-commerce (especially storefront) site, please use proper e-commerce software for the job. Do not ‘force’ a general-purpose (CMS) to be an e-commerce site via plugins (or *cough* *cough* ‘component’), it’s gonna be a pain-in-the-ass to secure ’em.
So do yourself (and the sysadmin guys) a favor, use a proper e-commerce software platform or just turn to blogger.com for selling your stuffs…
How to Hide Apache2 and PHP version without using mod_security in Ubuntu Linux
Although security by obscurity is not the best policy to protect your IS assets, but it is still useful to thwarts simple network scanner or newbie crackers.
Note: This tip is written for Ubuntu Linux, the steps is similar to other GNU/Linux distro, albeit with a slight variant.
Hiding Apache2 version
Edit /etc/apache2/apache2.conf
Add these lines at the end of the file:
ServerSignature Off
ServerTokens Prod
Restart Apache2
[bash]
sudo /etc/init.d/apache2 restart
[/bash]
Hiding PHP version
Edit /etc/php5/apache2/php.ini file
Find these lines, and switch it off:
expose_php = Off
display_errors = Off
Additionally you may disable certain ‘risky’ functions in php by editing the disable_functions line:
disable_functions = phpinfo, system,show_source,
Finally, you may restart Apache2 web server.
[bash]
sudo /etc/init.d/apache2 restart
[/bash]