iBlog - Ilia Alshanetsky

While md5 is a fairly strong hashing algorithm, even with the best algorithm weak passwords based on dictionary words and/or their variants can be easily compromised. There are a few sites on the net that have built searchable databases of "weak" password allowing quick strength checks of md5 hashes. But, each one of those databases has different set of hashes and a different database size, making a "complete" search rather difficult. So, I've come up with a little aggregator script that gathers information from 5 different (tell me if you know of others) sources and offers the resolved data on a single page, thus giving you a fast response from a cumulative database.

The script can be downloaded from here, http://ilia.ws/uploads/hash.php.txt

It is released under BSD license, so anyone is free to use it.

It would seem that the Canadian province of Ontario, of which I happen to be a resident of, is rapidly and willingly being assimilated into our Southern neighbor. The latest bout idiocy comes from our Attorney General who according to the CBC article that can be found here intends to force extension of DST to match that of United States. According to Americans this change, signed into law by GWB will lead to energy savings, right… Of all the things to change, I suppose no one considered doing something about all those SUV drivers, whose cars eat fuel by the truckload, but anyway…
The synchronization of the change in Ontario is being argumented by the fact that having the same time zone will make easier to maintain trade links. So, in 2007 Ontario will blindly follow US’s lead and extend daylight time. Supposedly, Quebec, 2nd most populous province after Ontario is well on its way in adopting a similar stance.

I am in release mode this week, first PHP 5.1.0RC3, now FUDforum 2.7.3RC3. Number three seems to work well for me .

Since FUDforum's RC2 there have been a surprising number of small bug fixes many of the important ones aimed at improving (*cough*fixing*cough*) the PostgreSQL support, which now appears to work quite well. So, to ensure that is indeed the case I've decided to make another release candidate.
The upgrade and installer scripts can be found at their usual locations, but here are the direct URLs to them anyway .

Upgrade Script

Installer Script

Continue reading "FUDforum 2.7.3RC3 Released"

Those of you monitoring the PHP development mailing list probably know that I've taken over from Andi as far as PHP 5.1 Release Management. Today I am happy to announce the second (yes, I know its RC3) release candidate of PHP 5.1.0 is out and available for testing. You can grab the source snapshots from here: http://downloads.php.net/ilia/

If you have some spare time in the next week or two, please take a moment to try out 5.1.0 and see if it works with your code/programs. Majority of the test suit passes with this releases, so the only remaining the issue are those waiting to be discovered through "real-life" testing.

To all the people who carelessly claim that Cross Site Scripting (XSS) is not a real security problem here is definitive proof that the threat is quite real. A very creative user of MySpace, Samy created a little self propogating worm via a stored XSS attack.

He was able to inject raw HTML into his profile by breaking the normally disallowed "javascript" into components, relying on IE to "combine" it back together. This code snippet then utilized XMLHTTPRequest, usually used for Ajax to execute a request in the background that would cause the viewer to transparently add Samy (author of the trick) to their buddy list.
The "worm" component of the hack used the same code to insert the attack HTML sequence into the profiles of comprised users allowing the hack to self propagate.

The attack process and why it was possible is explain is fair amount of detail here.

It should be noted that while Samy was careful not to cause any lasting damage, a more malicious person could have used the same code to do a whole lot more, like steal passwords of users and so on. Hopefully, this worm, which will surely get massive exposure in the coming days will prove effective where hundreds of security professionals were not, proving that XSS is a serious issue.

While coming back with friends from a photo trip this weekend, I've spotted this wonder navigating the parking lot of a shopping mall. I'd try to describe it, but in this case a picture is truly worth a thousand words. Definitely not something that you see every day.