DEAN LEE:/DEV/BLOG » security http://www.deanlee.cn mount /dev/brain || tail -f /var/log/thoughts >> /pub/www Fri, 03 Sep 2010 04:03:37 +0000 en hourly 1 http://wordpress.org/?v=3.0 PHP – Top Ten Security Vulnerabilities http://www.deanlee.cn/programming/php-top-ten-security-vulnerabilities/ http://www.deanlee.cn/programming/php-top-ten-security-vulnerabilities/#comments Wed, 11 Oct 2006 17:42:20 +0000 Dean Lee http://www.deanlee.cn/2006/10/12/php-top-ten-security-vulnerabilities/
  • Sorting Algorithms Source Code and Performance
  • Best of the Best Web 2.0 Websites
  • Ubuntu tricks – how to create a list software and use it to restore your pc
    • ]]>     These vulnerabilities can, of course, exist in PHP applications. Here are some tips on how to avoid them. I’ve included related links and references where relevant.

    read more | digg story

    Related posts:

    1. Sorting Algorithms Source Code and Performance
    2. Best of the Best Web 2.0 Websites
    3. Ubuntu tricks – how to create a list software and use it to restore your pc

    ]]>     http://www.deanlee.cn/programming/php-top-ten-security-vulnerabilities/feed/ 5     用google"偷"密码 http://www.deanlee.cn/technology/expose_password_to_google/ http://www.deanlee.cn/technology/expose_password_to_google/#comments Sun, 08 Oct 2006 15:56:13 +0000 Dean Lee http://www.deanlee.cn/2006/10/08/%e7%94%a8google%e5%81%b7%e5%af%86%e7%a0%81/
  • AJAX-the answer to webmail
  • Fckeditor for wordpress is now hosted on Google Code
  • Google Browser : Lynx
    • ]]>     google前天开放了”google code serch“服务。可以搜索这些年google从网上抓到的代码，包括压缩文件里的也没有放过。

    来看看都能搜索到什么：

    例子一

    再试另一个：

    例子二

    这些站点的密码一览无遗，都被google抓到了。

    这是管理员随意把敏感文件打包压缩在web能访问的目录的结果。而且通过配置文件明文保存密码本身就非常不安全。

    早些年程序员对这个问题的重视性还很高，现在随着各种framework的发展，都有鼓励人们把密码明文保存在配置文件里的趋势，至少默认都是明文的。不少程序员也习惯了这种方式。希望google code search的这个”副作用“能够重新唤醒我们都快丢掉的安全意识。

    Related posts:

    1. AJAX-the answer to webmail
    2. Fckeditor for wordpress is now hosted on Google Code
    3. Google Browser : Lynx

    ]]>     http://www.deanlee.cn/technology/expose_password_to_google/feed/ 1