<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>In Nomine - The Lotus Land &#187; Security</title>
	<atom:link href="http://www.in-nomine.org/category/security/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.in-nomine.org</link>
	<description>The focused mind can pierce through stone...</description>
	<lastBuildDate>Sat, 14 May 2011 20:22:03 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=</generator>
		<item>
		<title>JSONP with Werkzeug</title>
		<link>http://www.in-nomine.org/2009/04/03/jsonp-with-werkzeug/</link>
		<comments>http://www.in-nomine.org/2009/04/03/jsonp-with-werkzeug/#comments</comments>
		<pubDate>Fri, 03 Apr 2009 13:07:15 +0000</pubDate>
		<dc:creator>asmodai</dc:creator>
				<category><![CDATA[Browsers]]></category>
		<category><![CDATA[Programming]]></category>
		<category><![CDATA[Python]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[ajax]]></category>
		<category><![CDATA[jquery]]></category>
		<category><![CDATA[json]]></category>
		<category><![CDATA[jsonp]]></category>
		<category><![CDATA[werkzeug]]></category>

		<guid isPermaLink="false">http://www.in-nomine.org/?p=269</guid>
		<description><![CDATA[So I had implemented a simple JSON data server with Werkzeug for a classroom experiment. Unfortunately in my haste to get everything up and running I totally forgot about the fact that, since we cannot allow uploads to this server &#8230; <a href="http://www.in-nomine.org/2009/04/03/jsonp-with-werkzeug/">Continue reading <span class="meta-nav">&#8594;</span></a>]]></description>
			<content:encoded><![CDATA[<p>So I had implemented a simple <a title="JSON data format website" href="http://www.json.org/">JSON</a> data server with Werkzeug for a classroom experiment. Unfortunately in my haste to get everything up and running I totally forgot about the fact that, since we cannot allow uploads to this server of various custom made webpages, using <a title="Ajax/jQuery.ajax() documentation" href="http://docs.jquery.com/Ajax/jQuery.ajax">jQuery&#8217;s <code>$.ajax()</code></a> everything just fails since it will then be a cross-site scripting request.</p>
<p>So, normally you would do something like the following in order to return JSON data:</p>
<pre lang="python">return json.dumps(data)</pre>
<p>Which would be used with the $.ajax() call in a way like the following:</p>
<pre lang="javascript">$.ajax({
  type: "POST",
  url: "http://example.com/json/something",
  data: "parameter=value",
  dataType: "json",
  error: function(XMLHttpRequest, textStatus, errorThrown){},
  success: function(data, msg){}
});</pre>
<p>Which is perfectly fine for scripts getting and using the data on the same host/domain. But, as said before, this will fail with warnings similar to: <code>"Access to restricted URI denied" code: "1012" nsresult: "0xdeadc0de (NS_ERROR_DOM_BAD_URI)"</code>.</p>
<p>One way out of this is using <a title="Remote JSON - JSONP" href="http://bob.pythonmac.org/archives/2005/12/05/remote-json-jsonp/">JSONP</a>. jQuery has a <a title="Ajax/jQuery.getJSON() documentation" href="http://docs.jquery.com/Ajax/jQuery.getJSON"><code>$.getJSON()</code> function</a>, which loads JSON data using a HTTP GET request. Now, the simplistic way to convert your code would be to change it as such:</p>
<pre lang="javascript">$.getJSON("http://example.com/json/something",
  function(data){}
);</pre>
<p>But this causes another issue. Since <code>$.getJSON()</code> GETs the JSON data, but doesn&#8217;t use eval() on it, but instead pulls the result into <code>script</code> tags, it somehow causes,on Firefox at least, an invalid label error. In order to fix this you need to set up the JSON data server to properly support a callback argument, to use <code>$.getJSON()</code> how it is meant to be used:</p>
<pre lang="javascript">$.getJSON("http://example.com/json/something?jsoncallback=?",
  function(data){}
);</pre>
<p>In the code above the additional parameter <code>jsoncallback</code> will, thanks to jQuery, get the question mark replaced by an alphanumeric string (typically in the form of <code>jsonp</code> followed by a timestamp). This value should be used to wrap the resulting JSON data with. This means you would have to change the initial Python code to something like this:</p>
<pre lang="python">return request.args.get('jsoncallback') + '(' + json.dumps(data) + ')'</pre>
<p>Of course this causes problems when you want to reuse the code for both AJAX use on the same host/domain and use it from outside. So in order to make both work you can test on whether or not the callback parameter is available and return the appropriate data. I came up with this little snippet for that:</p>
<pre lang="python">def jsonwrapper(self, request, data):
    callback = request.args.get('jsoncallback')

    if callback:
        return callback + '(' + json.dumps(data) + ')'
    else:
        return json.dumps(data)</pre>
]]></content:encoded>
			<wfw:commentRss>http://www.in-nomine.org/2009/04/03/jsonp-with-werkzeug/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>OpenSSH ControlMaster and Subversion</title>
		<link>http://www.in-nomine.org/2008/04/13/openssh-controlmaster-and-subversion/</link>
		<comments>http://www.in-nomine.org/2008/04/13/openssh-controlmaster-and-subversion/#comments</comments>
		<pubDate>Sun, 13 Apr 2008 10:14:34 +0000</pubDate>
		<dc:creator>asmodai</dc:creator>
				<category><![CDATA[Programming]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[openssh]]></category>
		<category><![CDATA[subversion]]></category>
		<category><![CDATA[svn]]></category>

		<guid isPermaLink="false">http://www.in-nomine.org/?p=231</guid>
		<description><![CDATA[OpenSSH has a fantastic feature called ControlMaster. Basically this option allows you to create a socket that will share your already opened ssh session to the same host. To enable this option for all you put the following snippet in &#8230; <a href="http://www.in-nomine.org/2008/04/13/openssh-controlmaster-and-subversion/">Continue reading <span class="meta-nav">&#8594;</span></a>]]></description>
			<content:encoded><![CDATA[<p>OpenSSH has a fantastic feature called ControlMaster. Basically this option allows you to create a socket that will share your already opened ssh session to the same host. To enable this option for all you put the following snippet in your <code>$HOME/.ssh/config</code> after creating something like <code>$HOME/.ssh/sockets</code>:</p>
<pre>Host *
  ControlMaster auto
  ControlPath ~/.ssh/sockets/%r@%h:%p</pre>
<p>For every username@host:port it will create a socket in <code>$HOME/.ssh/sockets</code>. The only problem is that current Subversion (1.4.6 on my FreeBSD box) cannot work well with control sockets when using the svn+ssh:// URI identifier. In order to work around this problem you can add a specific host before the wildcard entry, for example:</p>
<pre>Host svn.example.com
  ControlMaster no

Host *
  ControlMaster auto
  ControlPath ~/.ssh/sockets/%r@%h:%p</pre>
<p>Of course, doing it like this is a bit tedious for every Subversion repository you use in this manner. Thankfully there is another way to do this. In <code>$HOME/.subversion/config</code> there is a section called <code>[tunnels]</code>. If you add the following entry to that section it will disable the ControlMaster:</p>
<pre>[tunnels]
ssh = ssh -o ControlMaster=no</pre>
]]></content:encoded>
			<wfw:commentRss>http://www.in-nomine.org/2008/04/13/openssh-controlmaster-and-subversion/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>The cake is a lie</title>
		<link>http://www.in-nomine.org/2008/01/27/the-cake-is-a-lie/</link>
		<comments>http://www.in-nomine.org/2008/01/27/the-cake-is-a-lie/#comments</comments>
		<pubDate>Sun, 27 Jan 2008 11:02:46 +0000</pubDate>
		<dc:creator>asmodai</dc:creator>
				<category><![CDATA[Games]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[half-life]]></category>
		<category><![CDATA[portal]]></category>
		<category><![CDATA[valve]]></category>

		<guid isPermaLink="false">http://www.in-nomine.org/2008/01/27/the-cake-is-a-lie/</guid>
		<description><![CDATA[Some of you may have played Valve&#8217;s Portal game and remember the phrase that &#8216;[t]he cake is a lie&#8217;. Most of us most likely associated this with the fact you get incinerated at the end of the trials. I think &#8230; <a href="http://www.in-nomine.org/2008/01/27/the-cake-is-a-lie/">Continue reading <span class="meta-nav">&#8594;</span></a>]]></description>
			<content:encoded><![CDATA[<p>Some of you may have played Valve&#8217;s Portal game and remember the phrase that &#8216;[t]he cake is a lie&#8217;. Most of us most likely associated this with the fact you get incinerated at the end of the trials.</p>
<p>I think the meaning is twofold though. Remember the source code leak Valve experienced in 2003 of their Half Life 2 engine code base? It became clear during a trial in Germany in November 2006 that a group called &#8216;myg0t&#8217; (a play on &#8216;mein Gott&#8217;?) was actually responsible for the source code leak. Now, apparently the myg0t group has some sort of initiation ritual where people have to (source: <a title="Wikipedia on myg0t" href="http://en.wikipedia.org/wiki/Myg0t">Wikipedia article on myg0t</a>):</p>
<ol>
<li>bake a cake</li>
<li>write &#8220;myg0t owns me&#8221; on it</li>
<li>take a picture of the cake with your face (including party hat) next to it</li>
<li>take a picture of you eating the cake and</li>
<li>post the picture online in a gallery</li>
</ol>
<p>Now, given that the Orange box came out in 2007, would it be overly strange if Valve was making a reference (with the cake is a lie quote) that the &#8216;cake initiation&#8217; is just a lie for them (myg0t) to laugh at others who want to join? Personally I think it fits right into Valve&#8217;s alley.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.in-nomine.org/2008/01/27/the-cake-is-a-lie/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>

