Forgot your password?

typodupeerror
Security

GMail POST Mortem: Can You Handle CSRF?->

Submitted by
Giorgio Maone
Giorgio Maone writes "This week couldn't be worse for Google and GMail: four distinct vulnerabilities disclosed in the past few days, plus a Google Docs weakness by Rios/McFeters allowing for easy Flash-based XSS, and now another GMail hijacking technique half-disclosed (!) by Petko H. Petkov (AKA pdp).

GMail POST Mortem analyzes the details published by Petko under his ambiguous "semi-disclosure" policy, and it shows how this is in facts a 0 day full disclosure, since building a working exploit from it is pretty trivial. Finally, countermeasures against the CSRF (the class of vulnerabilities which this one belongs to) are provided, both for developers and for users.

BTW, the GMail hole is still unpatched (tested 1 minute ago)."

Link to Original Source
The Internet

What's hot on Wikipedia->

Submitted by
Craig
Craig writes "WikiRage lists the pages in Wikipedia which are receiving the most edits per unique editor over various periods of time. Popular people in the news, the latest fads, and the hottest video games can be quickly identified by monitoring this social phenomenon."
Link to Original Source
Robotics

BigDog's little brother tackles tough terrain

Submitted by
willatnewscientist
willatnewscientist writes "The company that that brought us BigDog has a new robotic pooch. LittleDog is a smaller, more nimble version of the larger robot and was developed for DARPA to test competing adaptive approaches to crossing a highly irregular piece of terrain. Six different research groups — MIT, CMU, University of Pennsylvania, Stanford, USC and IHMC — have each been given one LittleDog and are developing their own walking algorithms. Once a month, DARPA tests these algorithms on its own LittleDog to see which shows the most promise. Ultimately, the program could help robots like BigDog cross rocky ground without breaking a robot leg."
Software

Microsoft Expression Web - Is it All that?

Submitted by
erica_ann
erica_ann writes "I am a Dreamweaver lover and die-hard fan. When I hear / see a website was made with Front Page, I cringe and shrudder. I have spent too many sleepless nights correcting the mangled code from Front Page so it would be cross-browser complaint as well as W3C and even CSS compliant — not to mention meet accessibility standards.

Now, I read that Microsoft has dropped Front Page and is now touting Microsoft Expression Web. From what I have read, it seems to be one of the few (or the only one) WYSIWYG editor that lets you drag and drop — say even an image — and creates a CSS style for it... not using HTML to place it.

I have also seen that it will not work with PHP — which is one of the reasons I love Dreamweaver so much — since it will.

Supposedly the new Microsoft Expression Web will be a rival for Dreamweaver and other top name Editors.. but can Microsoft really make a comeback from Front Page? I plan on downloading it and trying the trial out — but you have to uninstall the Office trail first which I am still crunching through to do a review on.

Have any ./ readers tried out the new Microsoft Expression Web? Is the code produced really that much better than the older Front Page? I would like to hear what others who have tried this have to say about it."
Power

Solar Powered Car Breaks Record by 3 Days

Submitted by Walking The Walk
Walking The Walk writes "Jaycar Sunswift III broke the Transcontinental World Record today, by an incredible 3 days! As previously mentioned on slashdot, the UNSW Solar Racing Team started their 4000km journey across Australia 6 days ago. Cloudy weather the first two days couldn't slow them down, and they raced into Sydney in 5.5 days, surpassing the previous record of 8.5 days with ease. Several news agencies were on hand to meet the team on their triumphant arival. Read about the team's history and previous attempts on their site, www.sunswift.com"

Promptness is its own reward, if one lives by the clock instead of the sword.

Working...