distributedINFORMATION.com

I was having a discussion with someone on IRC about how TWiki is vulnerable to Cross-site scripting and Cross-site request forgery, and we realized that there are 2 possible approaches to securing TWiki effectively (both requiring a unique magic number for all URLs):

1. add a pre process to the TWiki::UI system, requiring a valid and unique magic, and a post process step between rendering and output to the browser
2. use a small proxy system between TWiki and browsers to add and validate the magic

1. is actually still risky as all scripts still are able to output directly to the browser using a =print= statement, thus giving the user urls that may not have a necessary magic in the url, or similarly for AddOns that persist in not using resthandlers.

whereas 2. abstracts the security from the application server, in much the same way as it is for ssl - goodness all round.

So - I wonder if there is such a proxy already?

There are also massive performance reasons why you should always have a proxy between browsers and heavy application servers like TWiki - this too could do with filling out.Securing TWiki is not as simple as converting all actions to POST (ie using proper REST / HTTP) because there are too many legacy conveniences, allowing GET URL’s to act upon the data. But, by delegating the securing of the transactions to an external wrapper, I think we can avoid these flaws.
see Wikipedia on Cross Site Scripting and Cross-site request forgery

I’ve been using firefox 3 on my notebook since beta3, and loving its lower CPU and memory needs, but have been frustrated by the lack of 64 bit builds for my 8Gig RAM desktop development and VMWare system.

It seems that they have been building 64bit binaries for quite some time - see their nightly build dir.. http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-trunk/

NICE!

I’ve set up a debian repository that you can help test the package before it gets uploaded into debian proper.

To try it out, add the following to your /etc/apt/sources.list

deb http://distributedinformation.com/debian/ stable main contrib
deb-src http://distributedinformation.com/debian/ stable main contrib

and then run

gpg –keyserver the.earth.li –recv-keys 3C0C33BB442B5BE9

apt-key add /root/.gnupg/pubring.gpg

apt-get update

apt-get install twiki

I will be putting my ongoing work into the experimental distribution there, until they are ready for general use from my stable. From there I’ll be pushing them to my debian mentors.
The experimental repository, containing 171 twiki-plugins - though without testing nor dependancies can be found at

deb http://distributedinformation.com/experimental/ experimental main contrib
deb-src http://distributedinformation.com/experimental/ experimental main contrib