Add FilesTube.com
Click here to add FilesTube.com
About | Privacy | Terms | DMCA Policy | Contact | Api
FilesTube.com is a search engine designed to search files
in various file sharing and uploading sites like:
rapidshare, megaupload, mediafire, hotfile, netload, filesonic, 4shared.
Copyright 2010 © FilesTube.com, 103,958,107 files indexed
Cached Commons is a collection of user-contributed javascript libraries that have been cached, optimized, and hosted on Github’s fast CDN. If a library is missing from this collection, post a request on Github and we’ll add it immediately. The readme has all the details.
Here is a list of courses and innovative resources to help CS students, faculty, and instructors. These are examples of the training Google engineers use to learn new skills.
Tip: Check out the General Google Code University Forum to ask and answer questions.
You need to have Flash player to visit this website.
or contact me : cyril(at)cyrilmasson.com
 |
CERT's Podcast Series: Security for Business LeadersOverview Practicing strong information and cyber security is a nonnegotiable requirement for organizations doing business today. However, building security into an existing corporate culture is a complex undertaking. This series of podcasts provides both general principles and specific starting points for business leaders who want to launch an enterprise-wide security effort or make sure their existing security program is as good as it can be. Please review our Legal Disclaimer
Podcast CategoriesForensicsGoverning for Enterprise Security Measuring Security Privacy Risk Management and Resilience Security Education and Training Software Security Threat Trends and Lessons Learned Tips from the Trenches: Areas of Practice Forensics TJX, Heartland, and CERT's Forensics Analysis Capabilities Complex, distributed, multi-year investigations of computer crimes require sophisticated methods, techniques, and tools. Computer and Network Forensics: A Master's Level Curriculum Students learn how to combine multiple facets of digital forensics and draw conclusions to support full-scale investigations. Computer Forensics for Business Leaders: Building Robust Policies and Processes Business Leaders can play a key role in computer forensics by establishing strong policies and proactively testing to ensure those policies work in tough situations. Computer Forensics for Business Leaders: A Primer Computer forensics is often overlooked when planning an incident response strategy; however, it is a critical part of incident response, and business leaders need to understand how to tackle it. Governing for Enterprise Security Establishing a National Computer Security Incident Response Team (CSIRT) A national CSIRT is essential for protecting national and economic security, and ensuring the continuity of government agencies and critical infrastructures. Leveraging Security Policies and Procedures for Electronic Evidence Discovery Being able to effectively respond to e-discovery requests depends on well-defined, enacted policies, procedures, and processes. Managing Risk to Critical Infrastructures at the National Level Protecting critical infrastructures and the information they use are essential for preserving our way of life. Making Information Security Policy Happen Targeted, innovative communications and a robust life cycle are keys for security policy success. Becoming a Smart Buyer of Software Managing software that is developed by an outside organization can be more challenging than building it yourself. Information Compliance: A Growing Challenge for Business Leaders Directors and senior executives are personally accountable for protecting information entrusted to their care. Internal Audit's Role in Information Security: An Introduction Internal Audit can serve a key role in putting an effective information security program in place, and keeping it there. Tackling Security at the National Level: A Resource for Leaders Business leaders can use national CSIRTs (Computer Security Incident Response Teams) as a key resource when dealing with incidents with a national or worldwide scope. Using Standards to Build an Information Security Program Business leaders can use international standards to create a business- and risk-based information security program. Getting Real About Security Governance Enterprise security governance is not just a vague idea - it can be achieved by implementing a defined, repeatable process with specific activities. The Legal Side of Global Security Business leaders, including legal counsel, need to understand how to tackle complex security issues for a global enterprise. Why Leaders Should Care About Security Leaders need to be security conscious and to treat adequate security as a non-negotiable requirement of being in business. Compliance vs. Buy-in Integrating security into standard business operating processes and procedures is more effective than treating security as a compliance exercise. Measuring Security Getting to a Useful Set of Security Metrics Well-defined metrics are essential to determine which security practices are worth the investment. Using Benchmarks to Make Better Security Decisions Benchmark results can be used to compare with peers, drive performance, and help determine how much security is enough. Initiating a Security Metrics Program: Key Points to Consider A sound security metrics program is grounded in selecting data that is relevant to consumers and collecting it from repeatable processes. Building a Security Metrics Program Selecting and reporting meaningful security metrics depend on picking topics of great interest, defining the business context, and having access to sound data. The ROI of Security ROI is a useful tool because it enables comparison among investments in a consistent way. Privacy Integrating Privacy Practices into the Software Development Life Cycle Addressing privacy during software development is just as important as addressing security. Electronic Health Records: Challenges for Patient Privacy and Security Electronic health records (EHRs) are possibly the most complicated area of IT today, more difficult than defense. Protecting Information Privacy - How To and Lessons Learned Aligning with business objectives, integrating with enterprise risks, and collaborating with stakeholders are key to ensuring information privacy. The Value of De-Identified Personal Data As the legal compliance landscape grows increasingly complex, de-identification can help organizations share data more securely. Privacy: The Slow Tipping Point A trend toward more and more data disclosure, as seen in online social networks, may be causing users to become desensitized to privacy breaches in general. Risk Management and Resilience Train for the Unexpected Being able to respond effectively when faced with a disruptive event requires that staff members learn to become more resilient. Introducing the Smart Grid Maturity Model (SGMM) The SGMM provides a roadmap to guide an organization's transformation to the smart grid. Ensuring Continuity of Operations When Business Is Disrupted Providing critical services during times of stress depends on documented, tested business continuity plans. Managing Relationships with Business Partners to Achieve Operational Resiliency A defined, managed process for third party relationships is essential, particularly when business is disrupted. The Smart Grid: Managing Electrical Power Distribution and Use The smart grid is the use of digital technology to modernize the power grid, which comes with some new privacy and security challenges. Rethinking Risk Management Business leaders need new approaches to address multi-enterprise, systems of systems risks across the life cycle and supply chain. Security: A Key Enabler of Business Innovation Making security strategic to business innovation involves seven strategies and calculating risk-reward based on risk appetite. An Alternative to Risk Management for Information and Software Security Standard, compliance, and process are more effective than risk management for ensuring an adequate level of information and software security. Security Risk Assessment Using OCTAVE® Allegro OCTAVE Allegro provides a streamlined assessment method that focuses on risks to information used by critical business services. The Path from Information Security Risk Assessment to Compliance Information security risk assessment, performed in concert with operational risk management, can contribute to compliance as an outcome. Business Resilience: A More Compelling Argument for Information Security A business resilience argument can bridge the communication gap that often exists between information security officers and business leaders. Resiliency Engineering: Integrating Security, IT Operations, and Business Continuity By taking a holistic view of business resilience - similar in many ways to classical engineering - business leaders can help their organizations stand up to known and unknown threats. Adapting to Changing Risk Environments: Operational Resilience Business leaders need to ensure that their organizations can keep critical business processes and services up and running in the face of the unexpected. Assuring Mission Success in Complex Environments Analysis tools are needed for assessing complex organizational and technological issues that are well beyond traditional approaches. Security Education and Training Better Incident Response Through Scenario Based Training Teams are better prepared to respond to incidents if realistic, hands-on training is part of their normal routine. Using High Fidelity, Online Training to Stay Sharp Virtual training environments can deliver high quality content to security professionals on-demand, anywhere, anytime. What Business Leaders Can Expect from Security Degree Programs Information security degree programs are proliferating, but what do they really offer business leaders who are seeking knowledgeable employees? A New Look at the Business of IT Education System administrators increasingly need business savvy in addition to technical skills, and IT training courses must try to keep pace with this trend. Building Staff Competence in Security Practical specifications and guidelines now exist that define necessary knowledge, skills, and competencies for staff members in a range of security positions - from practitioners to managers. Software Security The Power of Fuzz Testing to Reduce Security Vulnerabilities To help identify and eliminate security vulnerabilities, subject all software that you build and buy to fuzz testing. The Role of the CISO in Developing More Secure Software CISOs must leave no room for anyone to deny that they understand what is expected of them when developing secure software. Is There Value in Identifying Software Security "Never Events?" Now may be the time to examine our responsibilities when developing software with known, preventable errors - along with some possible consequences. An Experienced-Based Maturity Model for Software Security Observed practice, represented as a maturity model, can serve as a basis for developing more secure software. Mainstreaming Secure Coding Practices Requiring secure coding practices when building or buying software can dramatically reduce vulnerabilities. Developing Secure Software: Universities as Supply Chain Partners Integrating security into university curricula is one of the key solutions to developing more secure software. How to Start a Secure Software Development Program Software security is accomplished by thinking like an attacker and integrating security practices into your software development lifecycle. Identifying Software Security Requirements Early, Not After the Fact During requirements engineering, software engineers need to think deeply about (and document) how software should behave when under attack. Building More Secure Software Software security is about building better, more defect-free software to reduce vulnerabilities that are targeted by attackers. Threat Protect Your Business from Money Mules Organized criminals recruit unsuspecting intermediaries to help steal funds from small businesses. Mitigating Insider Threat: New and Improved Practices 282 cases of actual insider attacks suggest 16 best practices for preventing and detecting insider threat. More Targeted, Sophisticated Attacks: Where to Pay Attention Business leaders need to take action to better mitigate sophisticated social engineering attacks. Getting in Front of Social Engineering Helping your staff learn how to identify social engineering attempts is the first step in thwarting them. Insider Threat and the Software Development Life Cycle Significant insider threat vulnerabilities can be introduced (and mitigated) during all phases of the software development life cycle. Tackling the Growing Botnet Threat Business leaders need to understand the risks to their organizations caused by the proliferation of botnets. Inadvertent Data Disclosure on Peer-to-Peer Networks Peer-to-peer networks are being used today to unintentionally disclose government, commercial, and personal information. Protecting Against Insider Threat The threat of attack from insiders is real and substantial. Insiders have a significant advantage over others who might want to harm an organization. Proactive Remedies for Rising Threats Threats to information security are increasingly stealthy, but they are on the rise and must be mitigated through sound policy and strategy. Trends and Lessons Learned Cyber Security, Safety, and Ethics for the Net Generation Capitalizing on the cultural norms of the Net Generation is essential when developing security awareness programs. Tackling Tough Challenges: Insights from CERT's Director Rich Pethia Rich Pethia reflects on CERT's 20-year history and discusses how he is positioning the program to tackle future IT and security challenges. Climate Change: Implications for Information Technology and Security Climate change requires new strategies for dealing with traditional IT and information security risks. Integrating Security Incident Response and e-Discovery Responding to an e-discovery request involves many of the same steps and roles as responding to a security incident. Virtual Communities: Risks and Opportunities When considering whether to conduct business in online, virtual communities, business leaders need to evaluate risks and opportunities. The Human Side of Security Trade-Offs It's easy to think of security as a collection of technologies and tools - but people are the real key to any security effort. Dual Perspectives: A CIO's and CISO's Take on Security Given that you can't secure everything, managing security risk to a "commercially reasonable degree" can lead to the best possible solution. Reducing Security Costs with Standard Configurations: U.S. Government Initiatives Information security costs can be significantly reduced by enforcing standard configurations for widely deployed systems. Real-World Security for Business Leaders Security is not an option - but it may be time to start viewing it as a business enabler, rather than just a cost of doing business. Convergence: Integrating Physical and IT Security Deploying common solutions for physical and IT security is a cost-effective way to reduce risk and save money. IT Infrastructure: Tips for Navigating the Tough Spots Organizations occasionally may need to redefine their IT infrastructures - but to succeed, they must be prepared to handle tricky situations. Evolving Business Models, Threats, and Technologies: A Conversation with CERT's Deputy Director for Technology Business models are evolving. This has challenging implications as security threats become more covert and technologies facilitate information migration. CERT Lessons Learned: A Conversation with Rich Pethia, Director of CERT Learn more about the future of CERT and Rich Pethia's view of the Internet security landscape. Tips from the Trenches: Areas of Practice Mobile Device Security: Threats, Risks, and Actions to Take Internet-connected mobile devices are becoming increasingly attractive targets. Securing Industrial Control Systems Securing systems that control physical switches, valves, pumps, meters, and manufacturing lines as these systems connect to the internet is critical for service continuity. Using the Facts to Protect Enterprise Networks: CERT's NetSA Team Network defenders and business leaders can use NetSA measures and evidence to better protect their networks. Analyzing Internet Traffic for Better Cyber Situational Awareness Automation, innovation, reaction, and expansion are the foundation for obtaining meaningful network traffic intelligence in today's extended enterprise. The Upside and Downside of Security in the Cloud When considering cloud services, business leaders need to weigh the economic benefits against the security and privacy risks. Concrete Steps for Implementing an Information Security Program A sustainable security program is based on business-aligned strategy, policy, awareness, implementation, monitoring, and remediation. Managing Security Vulnerabilities Based on What Matters Most Determining which security vulnerabilities to address should be based on the importance of the information asset. Connecting the Dots Between IT Operations and Security High performing organizations effectively integrate information security controls into mainstream IT operational processes. The Real Secrets of Incident Management Incident management is not just about technical response. It is a cross-enterprise effort that requires good communication and informed risk management. Crisis Communications During a Security Incident Business leaders need to be prepared to communicate with the media and their staff during a high-profile security incident or crisis. Inside Defense-in-Depth Defense-in-Depth is one path toward enterprise resilience - the ability to withstand threats and failures. The foundational aspects of compliance management and risk management serve as stepping-stones to and supports for other, more technical aspects. Change Management: The Security 'X' Factor In a recent survey of organizations' security posture, one factor separated high performers from the rest of the pack: change management. |
NEWEST CONVERSATIONSMobile Device Security: Threats, Risks, and Actions to TakeAugust 31, 2010
Download:
Additional Materials Establishing a National Computer Security Incident Response Team (CSIRT)August 19, 2010
Download:
Additional Materials Related Courses Securing Industrial Control SystemsJuly 27, 2010
Download:
Additional Materials TJX, Heartland, and CERT's Forensics Analysis CapabilitiesJune 29, 2010
Download:
Additional Materials The Power of Fuzz Testing to Reduce Security VulnerabilitiesMay 25, 2010
Download:
Additional Materials PODCAST
|
|||||
|
Notice
Legal Disclaimer
These podcasts and all related information and materials ("materials") are owned by Carnegie Mellon University. These materials are provided on an "as-is" "as available" basis without any warranties and solely for your personal viewing and use. You agree that Carnegie Mellon is not liable with respect to any material received by you as a result of using the web site on which they reside and/or for any consequences or the use by you of such materials. By viewing, downloading and/or using these materials, you agree that you have read and agree to our terms of use.
Contact Us |
||||||
|
|
||||||
When I read Twitter CEO Evan Williams post tonight about the state of Twitter from a mobile perspective, the first thing that jumped out at me what that Twitter for Android, an app Twitter worked hard on, isn’t even in the top 10 most-used apps for the service. But Williams also used the post to whip out some impressive numbers. Chief among them: Twitter now has over 145 million registered users (though presumably less than 150 million, or he would have said that). And there are now nearly 300,000 registered apps in the Twitter ecosystem.
The latter number above is technically the number of registered OAuth apps in the ecosystem (and includes multiple instances of some apps). Twitter made the switch over from basic authentication to OAuth a few days ago, leaving behind some apps, such as the old Tweetie (which was reborn as Twitter for iPhone). Williams says this number of registered apps has tripled since their Chirp conference — which was only this past April.
Other big numbers thrown out there by Williams:
Lastly, he throws in that Twitter’s Promoted Products (read: their first big monetization pitch) has “exceeded our expectations.” No word on if that means Twitter has turned a profit, but that seems pretty unlikely. Still, revenues are undoubtedly growing.
Freedom is a simple productivity application that locks you away from the internet on Mac or Windows computers for up to eight hours at a time. Freedom frees you from distractions, allowing you time to write, analyze, code, or create. At the end of your offline period, Freedom allows you back on the internet. You can download Freedom immediately for 10 dollars through either PayPal or Google Checkout.
Freedom enforces freedom; you'll need to reboot if you want to get back online while Freedom's running. The hassle of rebooting means you're less likely to cheat, and you'll enjoy enhanced productivity. If you need to be productive, Freedom might be the best 10 dollars you'll ever spend.
Aug 3, 2010 0
Legendary entrepreneur, venture capitalist, former Apple Fellow, and current Alltop founder Guy Kawasaki has written a great article discussing Freedom and Anti-Social. Guy writes:
During the summer, I get even less work done because my kids are at home, and they’re always dropping into my home office. Luckily, I don’t check Facebook on a daily basis, and no one sends me text messages, or things would be worse.
Sure, I’ve read the advice of lifehackers and GTDers who tell you how to do the important things first and to create various systems. But I’m too weak. For a while I thought that I’d never finish my next book.
Does any of this sound familiar? If it does, I recently found two applications that have helped me. First, Freedom by Fred Stuzman. It turns off Internet access for your computer for up to eight hours. There is a way to override it—restarting your computer—but doing this is a total admission of weakness. It sells for $10, Macintosh and Windows.
One of my first visits to Silicon Valley involved attending a conference where Guy was a speaker – It is a great honor to have Guy writing about (and liking) my work.
Other recent press about Freedom includes:
I may have to start a new media section! And don’t forget to check out the Tweets about Freedom. Some recent favorites:
Many more like it over on the Twitter stream. So happy to know that people are getting lots done with Freedom!
This website uses the Grid Focus Wordpress theme, written by Derek Punsalan 5thirtyone.com.
Freedom is Copyright 2010 Fred Stutzman
Watch
Google TV is coming to a living room near you.
Watch
the Google TV announcement.
Learn
Learn about the partners we're working with.
Visit Sony, Logitech,
Intel, and
DISH Network.
Develop
Optimize your web apps for Google
TV.
Android SDK coming soon. Learn more.
Google TV is a new experience made for television that combines the TV you know and love with the freedom and power of the Internet. Watch an overview video below, sign up for updates, and learn more about how to develop for Google TV.
I recently purchased and installed a new SSL certificate from GoDaddy for Marrily. During the process, I came to learn more about SSL and the different steps to set everything up from scratch. There are an abundant amount of articles and tutorials on how you can get started, but surprisingly there are no articles on “why” you have to follow those steps. Truth is I was pretty confused when I first started. There were a bunch of different steps and different key, pem, crt, csr files that need to be generated. The result was that I got lost and screwed up during the process. I then add insults to injury by accidentally revoking my certificate instead of re-keying it and ended up having to call GoDaddy to revert the deletion. Since any entrepreneur with a SaaS website will eventually need to implement SSL to protect their customers, having a better understanding of SSL will be greatly beneficial. This is my explanation to the entire process in plain English in hope that I can help clear up the confusion.
Why SSL?
To protect the communications between your web server and the client’s browser, you need to implement an encrypted channel so that all data transferred back and forth can only be read by your server and the browser. Anyone who eavesdrops in between will just see gibberish. Only your web server and the client’s browser know the right “secrets” to unlock the encrypted message. This communication protocol is called https, with the s stands for “secured”.
When user requests a page via https, your server will need to encrypt the content using a secret which the user’s browser can decrypt using a well-known identity. If somehow the content is encrypted with an unknown identity, the browser will be very hesitant to accept it, and it will ask user to make the hard decision to proceed or not.
Why Purchase a SSL Certificate?
To purchase a SSL certificate is to obtain a publicly verifiable identity for your domain that is accepted in all browsers. Most modern browsers include a list of well-known root Certificate Authority (CA) public keys, and any encryption done using these CA sources will be accepted by the browser. It is also possible for you to generate a root Certificate Authority set of key as well, technically speaking you become your own Certificate Authority. However, since your identity is unknown and not verifiable, the browser will not trust your keys and thus it will pop up an alert to notify the user. Nonetheless, once you add your certificate key to your browser’s list of accepted certificates, it will come to know about your identity and hence it won’t bother popping up anymore.
Since you can’t ask everyone to manually install your public key to their browser’s list of accepted certificates, you will need to buy the certificate from an established vendor whose public key already came bundled by default in the browser. I read somewhere that this is how browser vendors can make some money, e.g. the SSL guys will need to pay to have their identity (the public key) included in the browser. In exchange, these SSL vendors can turn around and certify (or “sign”) anyone who wants to get a SSL certificate for a fee.
If you think about becoming a SSL vendor, you will need to convince all other browsers that you’re completely trustworthy, and you protect your private key used to generate the SSL certificate with your life, since whoever gets their hands on your private key will be able to sign any SSL request, thus compromising your identity as the reputable Certificate Authority. All SSL vendors offer a warranty on their SSL certificate service from $1,000 to $10,000 to a lot more specifically as a statement that they keep their secret hidden really well to protect the identity of their customers’ SSL certificates.
Obtaining a SSL Certificate
Step 1: Generate your private key
To handle https requests, your web server will need to encrypt the data. Hence the first step you need to do is to generate a private key that will be used for the encryption. You can use different encryption algorithms but a SSL vendor can ask you to use a specific method and key length. The longer the key, the better the encryption strength. If the key is too short, the bad guy can quickly run through all the possibilities and found out your private key, then he can pretend to be you. In my case, GoDaddy want to have 2048 bits (256 bytes) for the strength for the private key. For personal use, a key strenght of 1024 bits (128 bytes) would be sufficient.
openssl genrsa -out private.key 2048 Generating RSA private key, 2048 bit long modulus ..............................+++ .+++ e is 65537 (0x10001)
Step 2: Generate a new SSL Request .csr file
The next step is to generate a “request” for a new SSL using your private key. This request file has an extension of .csr which stands for Certificate Signing Request, and it contains the identity about you (or your company), and most importantly, where the SSL certificate would be valid for: a single domain (cheapest) or any sub-domains (a.k.a. wildcard, and a bit more pricey). All these information will be encrypted using your private key and saved to a file. The SSL Vendor will then take this file and sign it to produce a valid SSL certificate that can be applied to your server.
EV SSL
If you pay more money, you can also get your identity in the SSL certificate confirmed as a legitimate business entity. This type of SSL certificate is called EV SSL (Extended Validated Certificate). Essentially the SSL vendor will verify the identity of your company by asking you to submit your business registration paperwork, bank account, letter from attorney or accountant, etc., for an additional fee ($400 to $1,000). In return, you will have a green-bar status with your company’s name next to the browser’s address bar. The theory is that user can identify your company’s name, and thus feels more secured as he/she knows that the website is the correct one, not a phished site that just pretend to be your website. Most (if not all) banks and prominent businesses have this type of EV certificate to protect their identity.
To generate a new CSR from your private key, use the command:
$ openssl req -new -key private.key -out marrily.com.csr
As I mentioned, the most important bit of the CSR file is where the SSL Cert should be valid for, which is defined in the “Common Name” attribute. For single domain (https://marrily.com, or https://www.marrily.com), you can use either “domain.com” or “www.domain.com”, since the “www” subdomain is so commonly used and thus can be omitted. Check out line 14 below for more details:
$ openssl req -new -key private.key -out marrily.com.csr You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:US State or Province Name (full name) [Some-State]: Locality Name (eg, city) []: Organization Name (eg, company) [Internet Widgits Pty Ltd]:Marrily Organizational Unit Name (eg, section) []: Common Name (eg, YOUR name) []:marrily.com Email Address []:alexle@marrily.com Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []:
I did not specify any challenge password in this case to keep everything simple.
Step 3: Submit your CSR to get a SSL Cert
Now that you have the CSR file containing your identity and which domain the SSL would be valid for, you can submit this CSR file to the SSL vendor (of course you will have to pay them first). They will take your CSR file and generate a new .crt (certificate) file using their own private key. Essentially they “sign” your CSR file with their carefully guarded secret file. You will then get back the your .crt file corresponding to the CSR, and another .crt file that belongs to the SSL vendor.
Chances that the SSL Vendor’s crt file actually contains a list of different certificates (public keys). The reason is that more or less your SSL vendor is actually a re-seller of another Certificate Authority, which can also be a reseller of another higher-level CA. So the first certificate would belong to your immediate SSL vendor, the one after that belongs to the higher-level CA that signed your vendor’s cert, and the cert listed after that belongs to an even higher CA that signed the CA’s cert that signed your vendor’s cert which signed your own certificate. Essentially it’s a tree of certificates that lead all the way up to the highest level of CA, which is a root certificate that is included in the browsers by default. For GoDaddy, the root CA is www.valicert.com, and for VeriSign, it is VeriSign’s own Class 3 Public Primay Certification Authority - G5.
(notice the green bar, that’s the EV SSL which costs you some more money to obtain)
Step 4: Configure Your Web Server
Now you should have in your possession these files:
1) your private key
2) your .csr file (not used anymore)
3) your new SSL certificate provided by your vendor as a .crt file, which is valid for your domain.
4) your SSL vendor’s crt file, containing a list of different certificates.
You are now ready to go and configure the web server to use your private key and your new SSL certificate (which is technically a public key) for the https-enabled website. The specific configuration for each web server is different, but the process will be the same. Also, the .crt files sometimes have a “.pem” extension as well, but for simplicity’s sake, they can be used interchangeably.
Nginx and GoDaddy SSL
In my case, I used nginx to serve my Rails application. I originally installed this nginx instance from source using passenger’s installer but ssl was not enabled by default (you can check this by running “nginx -V” and look for –with-http_ssl_module). I re-ran the passenger’s installer again and add the –with-http_ssl_module switch to the optional parameters, and everything was good to go.
One gotcha for Nginx is that you will have to combine the 2 certs that GoDaddy give you into one .crt file, with your SSL certificate comes first, then GoDaddy’s crt file (gd_bundle.crt). The browser would understand this as your SSL was signed by the CA whose public key is next cert entry, then that one was signed by the one after it, etc. all the way to the root CA.
$ cat www.marrily.com.crt gd_bundle.crt > marrily_combined.crt
I then added a new server{} block to listen for ssl requests on port 443. After restarting Nginx, Marrily is now ssl-protected with a green padlock.
![[Valid RSS]](/images/valid-rss.png "Validate my RSS feed")
server {
listen 443;
server_name marrily.com;
# passenger stuff
ssl on;
ssl_certificate /your/ssl/folder/marrily.crt;
ssl_certificate_key /your/ssl/folder/marrily.key;
}
Self-Signing your Certificate and Testing SSL Locally
Now that Marrily is https-enabled and some of the actions requires SSL, I wanted to develop the site locally using SSL as well to make sure all the logic worked correctly. I’d need to self-sign a new SSL certificate and have it installed locally.
Preparation
In my environment (Mac OS X Snow Leopard), I also have nginx installed using homebrew. Homebrew installed nginx with ssl support by default so no recompilation was needed. I also added a new entry to my host file so that I can use a fake domain to access my local site, and I’d use this fake domain in my CSR as well.
# /etc/hosts 127.0.0.1 marrilydev.com
Self-Signing a New Certificate
I generated a new private key openssl:
$ openssl genrsa -out privatekey.pem 2048
Then I generated a CA cert using this private key:
$ openssl req -new -x509 -key privatekey.pem -out cacert.pem -days 3650 You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]: State or Province Name (full name) [Some-State]: Locality Name (eg, city) []: Organization Name (eg, company) [Internet Widgits Pty Ltd]: Organizational Unit Name (eg, section) []: Common Name (eg, YOUR name) []:marrilydev.com Email Address []:
I didn’t care about any of the details except for the Common Name field, which I specified the fake domain.
Since the cacert.pem file was generated (a.k.a. signed) using the same privatekey.pem file, we could use it as the SSL certificate directly. All we’d need to do is set the ssl_certificate_key setting in the configuration to the privatekey.pem file:
upstream rails { server 127.0.0.1:3000; }
server {
listen 443;
server_name marrilydev.com;
ssl on;
ssl_certificate /Users/sr3d/projects/misc/ssl/cacert.pem;
ssl_certificate_key /Users/sr3d/projects/misc/ssl/privatekey.pem;
ssl_session_timeout 5m;
server_name marrilydev.com;
access_log /Users/sr3d/projects/marrily/svn/marrily_marrily/m3/app/log/access.log;
error_log /Users/sr3d/projects/marrily/svn/marrily_marrily/m3/app/log/error.log;
root /Users/sr3d/projects/marrily/svn/marrily_marrily/m3/app/public/;
location / {
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $http_host;
proxy_connect_timeout 74; # max is 75s
proxy_redirect off;
# Proxy to Backend
if (!-f $request_filename) {
proxy_pass http://rails;
break;
}
}
}
(Note: locally I have the nginx proxy all traffic to the development server running on port 3000)
Also, since Mac OS X has special restrictions for port 80 and port 443, nginx must run with sudo to listen to port 443, otherwise it would silently fail and you won’t be able to hit the site via https.
Getting Rid of SSL Warning By Installing The self-signed cert
With nginx configured to listen to secured requests, I opened up the site in Chrome, and saw a huge red error message complaining about the validity of the certificate, since Chrome did not recognize the identity of the cacert.pem. Obviously I could just ignore the warning and proceed to the https site for the current session, but there’s a better solution: add the cacert.pem to the list of approved certificates.
To install the self-signed certificate, just double click on the cacert.pem file in Finder. The cert would be added automatically to Keychain Access.
With the cert added to Keychain, all browsers installed in the system would gladly accept a https connection to https://marrilydev.com.
Summary
gzip_buffers 16 8k; to make sure nginx doesn’t loose large gzipped JS or CSSReference
Tags: encryptiong, godaddy, nginx, rails, ssl
Subscribe in a reader. Enjoy reading my blog? Subscribe to my RSS to read new post whenever I publish something new.
Excellent post.
Last week I had to implement some functionality to support uploading images to an MVC 2 application and then subsequently display them. Naturally there are a mountain of blog posts on this topic but I was unable to find anything comprehensive that covered everything that I needed on both the client and server side. What follows is my attempt to fill that hole.
My constraints were:
I used the jQuery.upload plugin too assist me with both of these. Obviously that means I am also using jQuery.
Let’s look at the code. Here’s the Content from my View:
Select File to Upload: <input id="file" name="file" type="file" />
<img id="fileView" />
<script type="text/javascript">
$(document).ready(function () {
$('#file').change(function () {
var data = { ID: "b53dd6b4-f24c-4450-bf6a-246e5835a125" };
$(this).upload(
"FileUpload/AttachFileToEntity",
data,
function () {
$("#fileView").attr("src", "FileUpload/GetFileDataFromEntity/" + data.ID);
}
);
});
});
</script>
I am simply attaching an change event handler the the <input type=”file” /> control. The event handler does two things:
Note that the name attribute of the input control must be set and it must match the name of the HttpPostedFileBase parameter in the AttachFileToEntity Controller Action. Speaking of the Controller here it is:
public class FileUploadController : Controller
{
private readonly EntityRepository _entityRepository = new EntityRepository();
public ActionResult Get()
{
return View();
}
public ActionResult AttachFileToEntity(Guid ID, HttpPostedFileBase file)
{
var entity = _entityRepository.Get(ID);
entity.FileData = GetFileData(file);
return Content("File saved");
}
private byte[] GetFileData(HttpPostedFileBase file)
{
var length = file.ContentLength;
var fileContent = new byte[length];
file.InputStream.Read(fileContent, 0, length);
return fileContent;
}
public FileResult GetFileDataFromEntity(Guid ID)
{
return File(_entityRepository.Get(ID).FileData, "image");
}
}
The imaginatively named Entity could not be simpler:
public class Entity
{
public Guid ID { get; set; }
public byte[] FileData { get; set; }
}
In a production scenario you are using probably using an O/RM such as NHibernate. In this case you will want to deviate from what I have above and store the uploaded file in a different entity. This is to avoid having to load the binary data for the file each time you access the entity. Note that NHibernate 3 supports (to a limited degree) lazy loading properties. However even if you are utilizing this feature you still want to make sure that the binary data is stored in a different table in the underlying RDBMS so that any full table scans (for example if you are performing some type of aggregation) don’t end up reading mountains of irrelevant data.
The one thing that you are missing is the Repository. Rather than introduce the complexity of data access I am simply using a static Dictionary to store the data:
public class EntityRepository
{
private static readonly IDictionary<Guid, Entity> _entities = new Dictionary<Guid, Entity>
{
{ new Guid("b53dd6b4-f24c-4450-bf6a-246e5835a125"), new Entity { ID = new Guid("b53dd6b4-f24c-4450-bf6a-246e5835a125") }}
};
public Entity Get(Guid ID)
{
return _entities[ID];
}
public void Save(Entity entity)
{
if (entity.ID == Guid.Empty) entity.ID = Guid.NewGuid();
if (_entities.ContainsKey(entity.ID)) _entities[entity.ID] = entity;
else _entities.Add(entity.ID, entity);
}
}
That’s everything you need. Hope that you find this useful.
| Personal Completely Free |
Pro 14 Day Free Trial $8/Month After Trial |
Developer $30 Per Month |
|
| Number of Custom Pages | 5 Pages | Unlimited | Unlimited |
| Storage Space | 1 GB | 10 GB | 10 GB |
| Photo Gallery |  |
|
|
| Public Calendars | |
|
|
| Contact Forms | |
|
|
| Personal Subdomain | |
|
|
| Customizable Themes | |
|
|
| HTML/Javascript Snippets | |
|
|
| 3D Photo Galleries | |
|
|
| Premium Themes | |
|
|
| Custom Branding | |
|
|
| Use Your Own Custom Domain Name | |
|
|
| SEO Settings | |
|
|
| Analytics Integration | |
|
|
| Manage Multiple Accounts | |
||
| Full CSS Control | |
||
| One-Click Logins | |
||
| Volume Discounts | |
||
| Project Management Tools | |
||
| Invoice Creator | |
||
Sign up today
Watch a quick tour
View examples
Pricing information
The Peer 2 Peer University (P2PU) is an online community of open study groups for short university-level courses. Think of it as online book clubs for open educational resources. The P2PU helps you navigate the wealth of open education materials that are out there, creates small groups of motivated learners, and supports the design and facilitation of courses. Students and tutors get recognition for their work, and we are building pathways to formal credit as well.
Start Learning, view our Open Courses List.
Get Involved - Join the Community.
Contact Us for any further info.
I just wanted to try the new features in Fedora. Installation is very easy but guest additions installation is little difficult. Anyhow, I figured out and this post shows how to install Fedora 13 on VirtualBox with working Fedora 13 VirtualBox guest additions.
You need working network on guest with downloading access.
I’m using VB 3.2.0 in Windows XP 32 Bit host.
Download the Fedora 13 ISO file here
1) Create a new virtual machine.
Operating System – Linux, Version Fedora.
2) Allocate memory, create new disk and complete other steps.
3) Go to Display settings and allocate display memory. Enable 3D to get better display performance.
4) You can enable processor cores and PAE features too.
5) Mount Fedora 13 ISO file to CD drive of virtual machine ( add to media manager first)
6) Start machine. Select first option and boot.
7) Select automatic log in and press login. This is the live CD which we can run like this without installing to hard disk. But, our purpose is to install permanently on virtual disk. Click on Install to Hard drive as shown below.
8.) Continue the Fedora installation on VirtualBox. Its easy with instruction. I’m not going to cover each step.
9) Once installation completed successfully, check the network especially Internet access with download. I configured bridged network and it worked out of the box.
10) Now, Lets install VirtualBox Guest additions for fedora 13. Open Terminal and login as root.
11) First update the kernel by typing following command.
yum -y update kernel
This will download and update the kernel.
12) Type following command after above installation completed.
yum -y install kernel-devel kernel-headers dkms gcc gcc-c++
Once installation completed, restart the fedora 13 VM.
13) Wait a moment, VB guest additions not installed yet. Go to devices in VirtualBox console, select Install Guest additions. It will mount built in ISO file.
14) Open terminal, log in as root and go inside Vboxadditions CD ( /media/VBox Additions CD)which you can see on desktop. Run following command from CD.
sh VBoxLinuxAdditions-x86.run
Make sure all components installed OK without any failure.
15) That’s it. Installation done. Restart the VM. To confirm the proper installation VirtualBox guest additions, you can check seamless mode and increasing screen size of VM.
Read more about Seamless mode in VB.
Share your issues on installing guest additions.
That worked pretty well for me, thanks 
I was having issues for some reason I just reinstalled fedora and followed this guide and it worked
If anyone is trying to access shared folder just use
# mount.vboxsf [the_name_of_the_shared_folder] /media/[name_of_mount_point]
Thank you for creating and posting these instructions!
I do everything you said. There wasn’t any fail in the installation process, but “guest additions” doesn’t work. My VirtualBox runs under Ubuntu 10.04. Do I need anything else?
Same as Aldo but I’m using gentoo as host.
Seamless Mode and Guest Display Auto-resize options in Machine menu are not enabled.
Any suggestions?
Hey guy,
Have u tried deleting and creating VM all over again? It worked for me give it a try once and see if that helps u
Great guide, works like a charm! Thanks
[...] Fedora 13 on VirtualBox with Guest Additions [...]
I installed Fedora 13 and everything works great except the guest additions. I tried installing and I even deleted the virtual machine a couple of time and the guest additions stil fail to install.What should I do???
[...] Install Fedora 13 on VirtualBox with working guest additions [...]
Great tut, followed it step by step Fedora13 + Additions all working.
Many thanks for your time in putting this guide together.
Well Done
Regards
Steve
[...] Install and run Fedora 13 in VB with working Guest additions. [...]
Phone
(678) 225-4900
If you look in our office, there is a whole bookshelf of references on wood frame design. We have 4 textbooks on wood design. We have the National Design Standard for Timber Construction, the Wood Frame Construction Manual, both from the American Wood Council. We have the International Residential Code, which has extensive prescriptive design information on wood. There are also about 5 different government publications we've obtained. It's a pretty extensive library.
What do we have on shipping container house design - the only book we could find, a small self-published book by Paul Sawyers. If you go through the web, there is nothing definitive on shipping containers where engineering is concerned. We get calls from people all the time who point out this website or that website, but again, no website includes information on how to structurally engineer these things.
The main problem is there is no standard design for the containers. The ISO standard is a performance spec for the manufacturers. It gives loads in Kilo Newtons that the container has to carry. That works well if you are going to make a house from containers that you don't modify. What happens when you take off the skin to open the container up? The lateral bracing disappears, as does a significant amount of it's ability to carry a vertical load. So, if you put a bunch of the containers together, how do you know they will carry the wind load, or the live and dead loads imposed?
One way is to figure on the containers having no real strength after they are cut open, and put in a lot of steel to make up for it. That can be expensive. You can figure on the corners maintaining the strength to carry the vertical loads (probably a good assumption), and the side rails having no strength (expensive again). The way we're trying to go about this is more definitive. We've taken measurements of actual shipping containers and built a model from the measurements. For the corner posts and side rails, we used steel members that were close (and slightly smaller) than the ones we measured on site. For the steel skin, we use a steel section modeled from one corrugation and spaced at the same space as the corrugations. The ends of the members are assumed to be fixed.
Here is a graphic of the model:
I spent a lot of time working on the model and had to make a couple trips to measure and check out containers again and again. The problem that took some work to get through is the sides and top get a significant compression load during windstorms. Since I modeled the skin using cold formed members at the same dimensions of the corrugations, and spaced the same, the skin is in effect a series of columns axially and laterally loaded - that includes the roof.
Since the corrugations are connected, and their ends are fixed, there are some column factors that have to be considered. The columns have to be modeled as braced in one axis, and fixed at the ends. They also have to be modeled for Continuous Lateral Torsion. Here's some graphics:
Above is how a shipping container deflects (very exaggerated) under a wind and an interior live load. This container is supported at the connection points. Look at how the roof ends up in compression, as well as the bottom and sides.
This is the code check of the model under a 40lb/sf live load in the floor, and a 90 MPH wind load. I figured that would work, the next step was to see how much wind load I could put on it before it fails. I tried 24 lbs/sf of wind load on the side, and the container is still way below the allowable stress. I haven't run the calcs to see what kind of a wind load that is, but I'm estimating it's over 120 MPH.
So, I upped the wind load to 50 lb/sf on one side to see what happens. That is high end hurricane force loads. Here's the results:
The model fails in a couple of minor areas. It looks like a shipping container is the place to hide in a major storm.
The next question is, what happens if you remove the sides? Such as you want to have a number of containers together and wider open spaces. So, I tried that with a 40 PSF Live Load for the floor and 20 PSF Roof Load (standard loading for one and two family residences from the 2006 International Residential Code). The load combination was DL+ 0.75 RL + 0.75 LL (no wind load). Here's the results:
The Red Areas Have Failed
As you can see, the top side rails have failed, as well as the corner posts. The corrugated sides are necessary for the overall structure, and if they are removed, it needs to be stiffened or columns added.
This is the deflection with sides removed.
A question I keep getting asked over and over again is: "Can I bury a shipping container to make an underground structure, or a basement?". The short answer is no. The reason is two fold, corrosion and structure. Constant contact with soil will give you serious corrosion problems over time, the steel is relatively light gauge for burying. You would have to put in cathodic protection to slow the corrosion, and you would still have problems, as has been discovered with buried fuel tanks over the years. The second is structural, it doesn't work. The loads on the sides are extreme, and I actually ran the calculations. Here is a graphic of the results:
Everything with a stress ratio over "1.0" is a failure, and as you can see, the sides fail by an order of magnitude of 1.7 to 1.9. That's a soil loading using soil and an angle of internal friction of about 30 degrees for all you engineers out there, which is silty sand (SM). That is an equivalent fluid pressure of 35 PSF, which is not as bad as you can get in some soil conditions.
Unfortunately, this won't put this issue to rest I'm sure. I get e-mails about burying these things all the time, and my answer is the same every time (no). Then the person will ask the question in a different manner hoping for the answer he or she wants. The laws of gravity, the strength of materials, and corrosion potential of steel doesn't change because your words do. It will still fail. You can modify the container to make it work, but it would be cheaper to pour a concrete wall. It will still corrode.
I have been asked about using aluminum containers underground. The container would still be too week, the modifications needed would be even more extremely expensive, and it still wouldn't be any better than a concrete wall and would cost you much more.
So, to conclude, you can not bury a container.
Home | About |
Contact |
Employees |
FAQ |
Information Links
News |
Photo Gallery
Copyright © 2009 Runkle Consulting. All Rights Reserved.
pycallgraph is a Python module that creates call graphs for Python programs.
Click on an image below to see the full size.
The latest version is 0.5.1 and was released on 2008-07-08. The command line tool has been renamed (again) to "pycallgraph". I have opened up tickets for anyone who wants to make a suggestion or bug report.
The ChangeLog is updated as often as I change things.
I've moved documentation to another page since it was getting large.
Using easy_install is the quickest way to install pycallgraph, if you have setuptools installed:
easy_install pycallgraph
Otherwise, more download options are at PythonCallGraphInstall. The direct link to the tarball is here.
![[-]](images/flame/collapse.gif "[-]") |
||||
| Forum | Threads | Posts | Last Post | |
 |
News Like the latest headlines from CNN, except with important news that you'll actually care about.
|
59 | 2,052 |
tSR News- Some forum upda...
Today 12:14 AM by Dex |
|
Site Discussion Discuss things related to the site, the staff, the updates, whatever. With its own mistakes and suggestions topics!
|
147 | 3,235 |
Errors
Today 05:40 AM by ze1 |
|
Rules To stop every board's dedicated rules taking up space everywhere and being generally irritating, look here for all the rules of boards. Break them and we break you.
|
5 | 12 |
NEWCOMERS READ ME
07-20-2010 07:53 PM by Kat |
|
|
||||
| Forum | Threads | Posts | Last Post | |
|
Submissions Submit your sheets to The Spriters Resource and get them up on the site for the world to use! Please try and get your sheet into the right category and only post FINISHED material.
Sub Forums:  Arcade, Custom / Edited, DS, Gameboy, Gameboy Advance, Genesis / Mega Drive, Mobile Phone, NES, Other Systems, PC / Computer, and 3 more.
|
1,791 | 26,894 |
Random Talking Bush's Sub...
Today 11:08 AM by Davias |
|
Sprite Discussion | |||
The order that animals feed on other plants and animals is called a food chain. 
COngratulation!
This is a usefull tuttorial for uploading files with asp.net mvc