Web Security - A Report by Websense for first half of 2009

WebSense (websense.com) is a leading web security research company.

They have released report of web-security for the first 2 quarters of year 2009.

Its worth reading. Here is the summary:

Web Security

• Websense Security Labs identified a 233 percent growth in the number of malicious Web sites in the last six months

and a 671 percent growth during the last year.

• 77 percent of Web sites with malicious code are legitimate sites that have been compromised. This remains

unchanged from the last six-month period.

• 61 percent of the top 100 sites either hosted malicious content or contained a masked redirect to lure unsuspecting

victims from legitimate sites to malicious sites.

• 95 percent of user-generated comments to blogs, chat rooms and message boards are spam or malicious.

• 50 percent of Web pages linked to Web sites categorized as “Sex” also served malicious content.

• 69 percent of all Web pages with any objectionable content (e.g. Sex, Adult Content, Gambling, Drugs) also had at

least one malicious link.

• 78 percent of new Web pages discovered in the first half of 2009 with any objectionable content had at least one

malicious link.

Email Security

• 87.7 percent of email messages were spam. This represents a three percent increase over the last six months.

• 85.6 percent of all unwanted emails in circulation during this period contained links to spam sites and/or malicious

Web sites.

• Shopping remained the leading topic of spam (28 percent), followed closely by cosmetics (18.4 percent), medical

(11.9 percent) and education (9.5 percent). Education themed spam has nearly doubled over the previous period

and may be related to the recession as spammers seek to exploit people looking to gain new skills or obtain fake

qualifications to help their job prospects.

Data Security

• 37 percent of malicious Web/HTTP attacks included data-stealing code. This remains unchanged from the last

six-month period.

• 57 percent of data-stealing attacks are conducted over the Web. This number has stayed consistent over the

six-month period.

Read more here:

http://www.websense.com/site/docs/whitepapers/en/WSL_Q1_Q2_2009_FNL.PDF

Few interesting facts:

More than 47 percent of the top 100 sites support user-generated content.

• Not surprisingly, sites that allow user-generated content comprise the majority of the top 50 most

active distributors of malicious content. Blog hosting sites that offer free hosting and good reputations

provide malware authors with the perfect combination to compromise unsuspecting users.

• 61 percent of the top 100 sites either hosted malicious content or contained a masked redirect to

lure unsuspecting victims from legitimate sites to malicious sites. In many cases these redirects

appeared as the actual Web site, when in fact the content served on that page was being hosted

elsewhere.

• Websense Defensio technology enabled Websense Security Labs to identify a significant and

alarming trend regarding the ease with which Web 2.0 sites can be compromised: 95 percent

of user generated comments

Microformats- the buzz word

Microformats are simple, open design patterns based on existing standards that you use to describe and add meaning to common web content, such as that about people, places, events and links. These structured data patterns allow machines like computers, user agents and applications to extract that content for a wide range of uses.

Sites already using microformats, includs Google, Yahoo!, Facebook, Twitter, Flickr, and LinkedIn. But these are just some of the more well-known names..

...How pervasive microformats are. For example, according to Yahoo! SearchMonkey, there are 1,450,000,000 web pages that publish hCard and 36,200,000 pages marked up with hCalendar.

Few good links to get set go:

http://visitmix.com/Articles/Microformats-Role-Play#200909160429190

http://microformats.org/wiki/Main_Page

http://visitmix.com/lab/oomph

Privacy guideliance from Microsoft

This document provides basic criteria to consider when building privacy into software releases.

Ten Things You Must Do to Protect Privacy

• Collect user data only if you have a compelling business and user value proposition. Collect data only if you can clearly explain the net benefit to the user. If you are hesitant to tell users what you plan to do, then don’t collect their data.

• Collect the smallest amount of data for the shortest period of time. Collect personal data only if you absolutely must, and delete it as soon as possible. If there exists a need to retain personal data, ensure that there is business justification for the added cost and risk. Do not collect data for undefined future use.

• Collect the least sensitive form of data. If you must collect data, collect it anonymously if possible. Collect personal data only if you are absolutely certain you need it. If you must include an ID, use one that has a short life span (for example, lasting a single session). Use less sensitive forms of data (for example, telephone area code rather than full phone number). Whenever possible, aggregate personal data from many individuals.

• Provide a prominent notice and obtain explicit consent before transferring personal data from the user's computer. Before you transfer any personal data, you must tell the user what data will be transferred, how it will be used, and who will have access to it. Important aspects of the transfer must be visible to the user in the user interface.

• Prevent unauthorized access to personal data. If you store or transfer personal data you must help protect it from unauthorized access, including blocking access to other users on the same system, using technologies that help protect data sent over the Internet, and limiting access to stored data.

• Get parental consent before collecting and transferring a child's personal data. Special rules for interacting with children apply any time you know the user is a child (because you know the child’s age) or when the content is targeted at or attractive to a child.

• Provide administrators with a way to prevent transfers. In an organization, the administrator must have the authority to say whether any data is transferred outside the organization's firewall. You must identify or provide a mechanism that allows the administrator to suppress such transfers. This control must supersede any user preferences.

• Honor the terms that were in place when the data was originally collected. If your team decides to use data, its use must be subject to the disclosure terms that were presented to the user when it was collected.

• Provide users access to their stored personal data. Users have a right to inspect the personal data you collect from them and correct it if it is inaccurate—especially contact information and preferences. You also need to ensure that the user is authenticated before he or she is allowed to inspect or change the information.

• Respond promptly to user questions about privacy. Inevitably, some users will have questions about your practices. It is essential that you respond quickly to such concerns. Unanswered questions cause a loss of trust. Be sure a member of your staff is ready to respond whenever a user asks about a privacy issue.

JSON is fun- JSON is for masses

JSON is fun- JSON is for masses

Really a interesting and great post / article on JSON

http://www.dustindiaz.com/json-for-the-masses/

The geeks

HEIGHT OF ISOLATION:
Two persons sitting side by side using emails to communicate with each other.

HEIGHT OF COWARDICE:
Two persons fighting through emails.

HEIGHT OF HELPLESSNESS:
Receiving no emails for a week.

HEIGHT OF FRUSTRATION:
The email server being down.

HEIGHT OF CARELESSNESS:
Writing a love mail and doing a 'Send All.'

HEIGHT OF TIMEPASS:
A person sending email to himself

HEIGHT OF EXPECTATION:
Sending Indian cricket team an e-mail, wishing them to win a match

HEIGHT OF REPETITION:
Forwarding an email to someone and receiving the same email forwarded back to you By some one in the receiving chain.

HEIGHT OF BROWSING:
U r swimming in the water tank and shout 'F1 F1 F1 ' instead of shouting 'HELP' when u are unable to swim...

The Google reality and business model

I came to read really a god article. It's all about the Google business strategies and business model. It describes why Google is succeeding. There are many negative aspects associated with the Google business model. Really a beautiful article but author may be biased sometimes...
----

Galen Ward: Google is supposed to be an unbiased search engine, but they are hurting consumers by using their dominance to become a king maker for their own, increasingly inferior products.

Google's search results are the ultimate world flattener: a website that creates fantastic content where consumers can zoom past name brands and websites with enormous marketing budgets in the search results. In the post-Google world, traditional marketing is dead and content is king.

Startups can flourish -- growing on ideas and content alone instead of through expensive TV commercials.

But Google is eroding the meritocracy they helped create, and the search giant abuses its power when they promote their often inferior services outside or above search results.

From removing map options to aggressively inserting YouTube clips into search results, from giving websites with Google CheckOut special designations to pushing their mediocre real estate search, Google is using their ostensibly open, egalitarian system to aggressively promote their own in-house products.

And the more aggressively they do it, the more it hurts the startup ecosystem and consumers alike.

Some case studies:

Google Maps is a fantastic product that blew away techies and had no technical rivals when it launched. But no one used it.

When maps were included in the Google search results, they included links to the most popular mapping sites on the web - Yahoo Maps and MapQuest.

Just two years ago, MapQuest still had twice Google's traffic. Google shut them off and only Google maps links appeared in search results. Today Google Maps dominates.

Google maps is clearly a superior product. But unlike a lot of other superior products, it got outside-the-search-results treatment.

YouTube is another example. Until recently, other sites had vastly superior video quality and featured longer videos. While YouTube dominated the market for user submitted videos, Google pushed it overly aggressively in search results.

Google Checkout offers more evidence.

Checkout solves a problem that consumers never had: it lets you give Google your credit card and shipping information and confusingly lets you then instruct Google (a search engine?) to pay for stuff at participating online stores, instead of just typing in your credit card number. After trying to win market share by paying consumers to sign up, it withered.

So Google inserted an ever-growing icon next to advertisers who accepted Google Checkout (the only icon allowed in paid search results).

As with Microsoft (see: Active Desktop, MS Bob), even Google's monopoly couldn't guarantee success on initiatives that no one actually wants: Paypal is growing at a faster rate than checkout.

And then there's Google Real Estate.

Google has had real estate search for a couple of years now (and they've pushed it at the top of the search results). But with the recent update, they've introduced another special "Google Box" above search and paid results on Google Maps.

Google real estate is the king of inferior products. It has around 50 percent of the homes for sale at any given time. Some of the data is out of date. And they pass you off to random sites to get details about any given house. (Disclaimer: I know a lot about this because it competes directly with the company I founded, Estately).

So why should you give a shit?

Even the antitrust suit against Microsoft was "misguided," right? Wrong.

Without the fear of another DOJ suit, Microsoft would have snuffed Google out faster than you can say "Netscape." And Google can snuff out competitors with their dominance too.

But like Microsoft in the 90s, Google's dominance hurts competition and consumers in a less obvious, but much more significant way.

It makes it hard for startups to make long-term investments in areas of the web that Google may one day tackle: Google can kill a comparable or superior product overnight (or nearly cut traffic in half) through otherwise unattainable and unbuyable search results.

And Google doesn't have to win every battle to hurt consumers. It only takes a veiled threat of Google entering a market (Microsoft's infamous "vaporware") to give entrepreneurs pause.

Google says that "competition is a click away," but that response is very similar to Microsoft's old stance on browser competition - "A new browser is only two clicks away."

I'm not sure what the best solution is.

Google is innovative and any court-ordered limitation on cross-promoting Google products would probably leave consumers worse-off.

But (sorry Microsoft) out-innovating Google probably won't either. As with Windows, Google search is so familiar and trusted that consumers won't switch for comparable or slightly better results from somewhere else.

Galen Ward is co-founder of Estately, an online real estate search company based in Seattle. Opinions expressed in guest posts are those of their authors, and don't necessarily reflect the views of TechFlash or its staff.

You Must Obey: The Unwritten Laws of Technology

"Fix a computer for a friend or family member, and you'll be tech support for life."

For every fix that a Windows Update patches, the update will break two more things on your PC.

he likelihood that Windows will automatically install time-sucking critical updates is directly proportional to your need to get your PC started.

The hard drive always fails just before you were going to back it up

Your data will get corrupted just before you plug in your new backup external drive

The number of USB ports on your Mac will always be one less than you need at any given time.

If you close the PC case with screws before testing, it won't work; If you test before closing, it will.

Read some more interesting laws here.

Getting Query-String Values From Javascript

script type="text/javascript">
function GetQueryStrValFor(key)
{
var retVal="";
var query = window.location.search.substring(1);
var parms = query.split('&');
for(var i=0 to parms.length)

{ var pos = parms[i].indexOf('=');
if (pos > 0)
{
if(key==parms[i].substring(0,pos))
{
retVal= parms[i].substring(pos+1);
}
}
}
return retVal;
}

script>

good collection of stock photos and web icons :http://www.dreamstime.com/it&c-cat108

good collection of stock photos and web icons :http://www.dreamstime.com/it&c-cat108

Joe Stagner []MSFT] on open sourse

When I talk about Open Source, it's not form a "religions" perspective. I'm interested in the applications, the people and the business model.
A PHP friend, Wez Furlong, share a passion for making things that were necessarily designed to work together do exactly that. Wez is a pretty big figure in the PHP world and we did a panel together a few years ago at MIX in which Wez brilliantly described Open Source as "Itch Driven Development".
The point is, it's the community need that drive the success of an Open Source project, no matter what the underlying technology......

Joe Stagner []MSFT] on open sourse