Cross-site Scripting Article on DevShed

I’m sure that many of you have heard of a little thing called “[url=http://www.devshed.com/c/a/Security/A-Quick-Look-at-Cross-Site-Scripting]cross-site scripting[/url].” If you haven’t, or you have never thought about how it may affect you or your websites; please take the time to read [url=http://www.devshed.com/c/a/Security/A-Quick-Look-at-Cross-Site-Scripting]this article[/url] on DevShed. It does a pretty good job at showing you what XSS is, how to prevent it from happening, and why you should care.

January 3, 2005 Newsletter

O’Reilly News for User Group Members
January 3, 2005
—————————————————————-
Book News
—————————————————————-
-Windows XP Pro: The Missing Manual, 2nd Edition
-Photo Retouching with Photoshop: A Designer’s Notebook
-Linux Cookbook
-Revolution in The Valley
-Silence on the Wire
-Jakarta Commons Cookbook
-Dr. Tom Shinder’s Configuring ISA Server 2004
-Oracle SQL*Plus: The Definitive Guide, 2nd Edition
-Windows XP Annoyances for Geeks, 2nd Edition
-Home Theater Hacks
-Hacking a Terror Network
-Word Hacks
-High Performance Linux Clusters
—————————————————————-
Upcoming Events
—————————————————————-
-O’Reilly Happenings at Macworld SF–January 10-14
-Free Exhibit Hall Pass for Macworld
—————————————————————-
Conference News
—————————————————————-
-Registration is Open for 2005 O’Reilly Emerging Technology Conference,
San Diego, CA–March 14-17
-Registration Is Open for the 2005 MySQL Users Conference,
Santa Clara, CA–April 18-21
—————————————————————-
News
—————————————————————-
-“Make” Subscriptions Now Available
-Renewable Energy–The Next Opportunity for Silicon Valley
-Freedom, Innovation, and Convenience: The RMS Interview
-Ten Tips for Building Your First High-Performance Cluster
-Clever Tricks with MythTV
-Tim O’Reilly, Derrick Story, and David Pogue make the 2004 MDJ
Power 25 List
-Build an eDoc Reader for your iPod
-Book Worms into Minds of PC Cultists
-Windows Explorer Hacks
-Inside Secrets of MSN Desktop Search
-Towards Bug-Free Code
-ONJava 2004 in Review: Popular Articles
-Exporting QuickTime Movies with Simple Video Out X
================================================
Book News
================================================
Did you know you can request a free book to review for your
group? Ask your group leader for more information.

For book review writing tips and suggestions, go to:
http://ug.oreilly.com/bookreviews.html

Don’t forget, you can receive 20% off any O’Reilly, No Starch,
Paraglyph, Pragmatic Bookshelf, SitePoint, or Syngress book you
purchase directly from O’Reilly.
Just use code DSUG when ordering online or by phone 800-998-9938.
http://www.oreilly.com/

***Free ground shipping is available for online orders of at
least $29.95 that go to a single U.S. address. This offer
applies to U.S. delivery addresses in the 50 states and Puerto Rico.
For more details, go to:
http://www.oreilly.com/news/freeshipping_0703.html

—————————————————————-
New Releases
—————————————————————-
***Windows XP Pro: The Missing Manual, 2nd Edition
Publisher: O’Reilly
ISBN: 0596008988
Completely refreshed and updated for Windows XP Service Pack 2 (SP2), this
bestseller is for the novice or budding power user who wants to master
Microsoft’s latest operating system and get down to work. The book reveals
which features work well and which don’t, such as the Remote Desktop
software that enables people to connect to the office from home, the
encryption file system that protects sensitive information, and the
Windows Messenger that enables real-time text, voice, and video
communication.
http://www.oreilly.com/catalog/winxppro2/

***Photo Retouching with Photoshop: A Designer’s Notebook
Publisher: O’Reilly
ISBN: 0596008600
This lavish, colorful book showcases innovative photo-retouching solutions
by well known French artists, and will be inspiring and instructive for
anyone involved in creating digital images or animations. You’ll see what
the pros are able to do to their photographs with Photoshop; you’ll be
guided, step-by-step, through the editing process of each project–from
original shot to polished print; and you’ll gain insight into how each
visionary artist imagined, conceptualized, and created the final exquisite
image.
http://www.oreilly.com/catalog/photoretouchadn/

***Linux Cookbook
Publisher: O’Reilly
ISBN: 0596006403
Linux information can be found scattered in manpages, texinfo files, and
source code comments, but the best source is the experts who have built up
a working knowledge of managing Linux systems. This book’s tested
techniques distill years of hard-won experience into practical
cut-and-paste solutions to everyday Linux dilemmas. Use just one recipe
from this collection of real-world solutions, and the hours of tedious
trial-and-error saved will more than pay for the cost of the book.
http://www.oreilly.com/catalog/linuxckbk/

Chapter 14, “Printing with CUPS,” is available online:
http://www.oreilly.com/catalog/linuxckbk/chapter/index.html

***Revolution in The Valley
Publisher: O’Reilly
ISBN: 0596007191
“Revolution in the Valley” traces the development of the Macintosh
computer from its inception as an underground skunkworks project in 1979
to its triumphant introduction in 1984 and beyond. In this vivid
first-hand account, author and key Macintosh developer Andy Hertzfeld
reveals exactly what it was like to be a key player in one of the most
important technical achievements in modern history. Lavish illustrations
and period photos (many never before published) bring to life the talented
and often eccentric characters who participated in the birth of the
personal computer revolution.
http://www.oreilly.com/catalog/revolution/

***Silence on the Wire
Publisher: No Starch Press
ISBN: 1593270461
Author Michal Zalewski has long been known and respected in the hacking
and security communities for his intelligence, curiosity, and creativity,
and this book is truly unlike anything else out there. “In Silence on the
Wire,” Zalewski shares his expertise and experience to explain how
computers and networks work, how information is processed and delivered,
and what security threats lurk in the shadows. No humdrum technical white
paper or how-to manual for protecting one’s network, this book is a
fascinating narrative that explores a variety of unique, uncommon, and
often quite elegant security challenges that defy classification and
eschew the traditional attacker-victim model.
http://www.oreilly.com/catalog/1593270461/index.html

***Jakarta Commons Cookbook
Publisher: O’Reilly
ISBN: 059600706X
This collection of recipes provides expert tips for using the utilities of
the Java-based Jakarta Commons open source project. You don’t have to be
an expert; the book’s solution-based format contains code examples for a
wide variety of web, XML, network, testing, and application projects. If
you want to learn how to use Jakarta Commons utilities to create powerful
Java applications and tools, this cookbook is for you.
http://www.oreilly.com/catalog/jakartackbk/

Chapter 8, “Math,” is available online:
http://www.oreilly.com/catalog/jakartackbk/chapter/index.html

***Dr. Tom Shinder’s Configuring ISA Server 2004
Publisher: Syngress
ISBN: 1931836191
This book provides you with unparalleled information on installing,
configuring, and troubleshooting ISA Server 2004 by teaching you to Deploy
ISA Server 2004 in small businesses and large organizations; achieve
99.999% uptime for your ISA Server 2004 Internet access solution; roll out
an International VPN using built-in ISA Server 2004 VPN Wizards and
configuration interface; learn how to configure complex DMZ configurations
using ISA Server 2004’s new network awareness features and built-in
multinetworking capabilities; and learn how to take advantage of ISA
Server 2004’s new VPN capabilities.
http://www.oreilly.com/catalog/1931836191/index.html

****Oracle SQL*Plus: The Definitive Guide, 2nd Edition
Publisher: O’Reilly
ISBN: 0596007469
Updated for Oracle 10g, this bestselling book is the only in-depth guide
to SQL*Plus. It clearly describes how to perform, step-by-step, all of the
tasks that Oracle developers and DBAs want to perform (and maybe some you
didn’t realize you could) with SQL*Plus. If you want to capitalize upon
the full power and flexibility of this popular Oracle tool, this book is
an indispensable resource.
http://www.oreilly.com/catalog/orsqlplus2/

Chapter 6, “Creating HTML Reports,” is available online:
http://www.oreilly.com/catalog/orsqlplus2/chapter/index.html

***Windows XP Annoyances for Geeks, 2nd Edition
Publisher: O’Reilly
ISBN: 0596008767
“Windows XP Annoyances for Geeks, 2nd Edition” offers dozens of on-target
tips, workarounds, and warnings, allowing users to improve their overall
experience with the popular XP operating system. You’ll learn how to use
the Registry Editor, customize the interface, and master Windows’s
built-in networking capabilities. The book also includes detailed coverage
of the newly released Service Pack 2 (SP2), which provides protection
against viruses, hackers, and worms. Seize control of the Windows XP
operating system before it takes control of you.
http://www.oreilly.com/catalog/winxpannoy2/

Chapter 5, “Maximizing Performance,” is available online:
http://www.oreilly.com/catalog/winxpannoy2/chapter/

***Home Theater Hacks
Publisher: O’Reilly
ISBN: 0596007043
“Home Theater Hacks” is a smart collection of insider tips and tricks,
covering everything you need to know about home theater installation. Say
goodbye to frustrating trial-and-error processes and expensive
appointments with installation experts. This book prevents both by
imparting down-and-dirty techniques not found anywhere else. From finding
the right audio and video components and dealing with speakers and wiring,
to mastering remote controls and getting a handle on TiVo, this book will
help you customize your own, personal home theater experience.
http://www.oreilly.com/catalog/htheaterhks/

Sample hacks are available online:
http://www.oreilly.com/catalog/htheaterhks/chapter/index.html

***Hacking a Terror Network
Publisher: Syngress
December 2004
ISBN: 1928994989
Written by a certified Arabic linguist from the Defense Language Institute
with extensive background in decoding encrypted communications, this
cyber-thriller uses a fictional narrative to provide a fascinating and
realistic “insider’s look” into technically sophisticated covert terrorist
communications over the Internet. The accompanying CD-ROM allows readers
to “hack along” with the story line, by viewing the same web sites
described in the book containing encrypted, covert communications.
http://www.oreilly.com/catalog/1928994989/index.html

***Word Hacks
Publisher: O’Reilly
ISBN: 0596004931
Become a power user with “Word Hacks.” Insider tips, tools, tricks, and
hacks help you accomplish your pressing tasks, address your frequent
annoyances, and solve even your most complex problems. The book examines
Word’s advanced (and often hidden) features, and delivers clever,
time-saving hacks on taming document bloat, customization, complex search
and replace, tables and comments, XML, and even using Google without
leaving Word.
http://www.oreilly.com/catalog/wordhks/

Sample hacks are available online:
http://www.oreilly.com/catalog/wordhks/chapter/index.html

***High Performance Linux Clusters
Publisher: O’Reilly
ISBN: 0596005709
“High Performance Linux Clusters” covers everything you need to build and
deploy a high-performance Linux cluster. You’ll learn about effective
planning, hardware choices, bulk installation of Linux on multiple
systems, and other basic considerations. This guide also addresses the
major free software projects and how to choose those that are most helpful
to new cluster administrators and programmers. Guidelines for debugging,
profiling, performance tuning, and managing jobs from multiple users round
out this immensely useful book.
http://www.oreilly.com/catalog/highperlinuxc/index.html

Chapter 10, “Management Software,” is available online:
http://www.oreilly.com/catalog/highperlinuxc/chapter/index.html

================================================
Upcoming Events
================================================
***For more events, please see:
http://events.oreilly.com/

***O’Reilly Happenings at Macworld SF–January 10-14
Macworld SF 2005 is shaping up to be a busy show for O’Reilly Media (Booth
#2225). We have great specials, lots of books, a full speaker lineup, and
a menu of activities. Plus, we’re partnering with some of the Mac OS X
Innovator Contest winners to provide discounts on award-winning software.
Here’s a comprehensive overview:
http://www.macdevcenter.com/pub/a/mac/2004/12/17/macworld.html

And make sure you come by the booth on Tuesday, January 11 and say hi to
me–Marsee. I’ll be there all day.

***Free Exhibit Hall Pass for Macworld, San Francisco, CA–
January 11-14
A PDF version of the Macworld Pass is available online to print out:

Click to access macworld2005.pdf

================================================
Conference News
================================================
***Registration is Open for the 2005 O’Reilly Emerging Technology
Conference, San Diego, CA–March 14-17
Early Bird registration for ETech has just opened. This year’s conference
theme is “Remix,” which infuses ETech’s roll-up-your-sleeves tutorials,
to-the-point plenary presentations, and real world focused breakout
sessions. Come to ETech and discover how applications and hardware are
being deconstructed and recombined in unexpected ways. Learn how users and
customers are influencing new interfaces, devices, business models, and
services. For all the scoop on tutorials, featured speakers, and
conference events, check out:
http://conferences.oreillynet.com/etech/

User Group members who register before January 31, 2005 get a double
discount. Use code DSUG when you register, and receive 20% off the
early registration price.

To register for the conference, go to:
http://conferences.oreillynet.com/cs/et2005/create/ord_et05

***Registration Is Open for the 2005 MySQL Users Conference, Santa Clara,
CA–April 18-21
The MySQL Users Conference, co-presented by O’Reilly Media and MySQL AB,
brings together experts, users, and industry leaders with unique MySQL
insights, offering attendees a detailed look into new features in MySQL
5.0, sessions and workshops designed to teach best practices, and exposure
to new open source technologies.
For more information, go to:
http://www.mysqluc.com/

User Group members who register before Febuary 28, 2005 get a double
discount. Use code DSUG when you register, and receive 20% off the
early registration price.

To register for the conference, go to:
http://conferences.oreillynet.com/cs/mysqluc2005/create/ord_mysql05

================================================
News From O’Reilly & Beyond
================================================
———————
General News
———————
***”Make” Subscriptions Now Available!
The annual subscription price for four issues is $34.95. When you
subscribe with this link, you’ll get a free issue–the first one plus four
more for $34.95. So subscribe for yourself or friends with our very best
offer for charter subscribers: five volumes for the cost of four.
Subscribe at:
https://www.pubservice.com/MK/Subnew.aspx?PC=MK&PK=M5ZUGLA

***Renewable Energy–The Next Opportunity for Silicon Valley
There are striking parallels between the renewable energy industry today
and the personal computing industry circa 1980. Brian McConnell argues
that the same basic dynamics that fueled the PC boom in Silicon Valley
apply to renewable energy, and this represents an important opportunity,
especially as the computing industry matures and becomes a commoditized
consumer product business.
http://www.oreillynet.com/pub/q/articles

———————
Open Source
———————
***Freedom, Innovation, and Convenience: The RMS Interview
Since 1984, Richard M. Stallman has fought for software freedom as a
coder, a project leader, and a philosopher. The GNU GPL and GNU/Linux
projects are just two results of that work. Federico Biancuzzi recently
interviewed RMS about his views on freedom, the GNU project, and the Linux
kernel and GNU/Linux distributions.
http://www.linuxdevcenter.com/pub/a/linux/2004/12/22/rms_interview.html

***Ten Tips for Building Your First High-Performance Cluster
Been meaning to build your very first high-performance Linux cluster, but
fear the trials and tribulations? Joseph D. Sloan, author of “High
Performance Linux Clusters with OSCAR, Rocks, OpenMosix, and MPI,” saves
you the trouble with ten very helpful tips. Now you can get all of the
cost effectiveness of high-performance clusters without all of the
frustration.
http://www.linuxdevcenter.com/pub/a/linux/2004/12/29/lnxclstrs_10.html

***Clever Tricks with MythTV
Building your own personal video recorder means that you can avoid
manufacturer- or broadcaster-enforced restrictions. That’s not all,
though. John Littler presents some clever ideas on what you can accomplish
with a MythTV box, some free time, and a little work.
http://www.linuxdevcenter.com/pub/a/linux/2004/12/29/mythtv_hacks.html

———————
Mac
———————
***Tim O’Reilly, Derrick Story, and David Pogue make the 2004 MDJ
Power 25 List
“MDJ,” the Journal for Serious Macintosh Users, today released the fifth
annual MDJ Power 25 list distilled from surveys sent to industry movers
and shakers (including journalists, executives, engineers, and Apple
Computer insiders).
http://www.macjournals.com/gcsf/mdj_power_25_2004.html

***Build an eDoc Reader for your iPod
Wouldn’t you like to read large text documents, PDF files, and other eDocs
on your 3G iPod (or newer)? In this first part of a three-part series,
Matthew Russell shows you how to do so using Xcode.
http://www.macdevcenter.com/pub/a/mac/2004/12/14/ipod_reader.html

Build an eDoc Reader for your iPod, Part 2:
http://www.macdevcenter.com/pub/a/mac/2004/12/17/ipod_reader.html

***Book Worms into Minds of PC Cultists
A recent review of the No Stach’s “Cult of Mac” in “The Inquirer,” a UK
publication.
http://www.theinquirer.net/?article=20351

———————
Windows/.NET
———————
***Windows Explorer Hacks
Face it, Windows Explorer is old and tired. Mitch Tulloch, author of
“Windows Server Hacks,” shows you how to power up this venerable utility
and make it an actual powerhouse.
http://www.windowsdevcenter.com/pub/a/windows/2004/12/21/windows_explorer_hacks.html

***Inside Secrets of MSN Desktop Search
MSN’s Desktop Search is a surprisingly powerful desktop search tool, with
loads of hidden features and hacks. Wei-Meng Lee opens up the hood and
takes a look, and fills you in on what he finds.
http://www.windowsdevcenter.com/pub/a/windows/2004/12/21/msd_desktop_search.html

———————
Java
———————
***Towards Bug-Free Code
Test-driven development sometimes sounds better than it turns out to be.
Early decisions to tightly couple functional parts of your system can make
it a lot less amenable to testing than it ought to be. As Ashwin
Jayaprakash shows, J2SE 5.0’s generics make working with abstract classes
and interfaces easier than it used to be, which encourages loose coupling
and facilitates testing.
http://www.onjava.com/pub/a/onjava/2004/12/22/towardsbugfree.html

***ONJava 2004 in Review: Popular Articles
Editor Chris Adamson takes a look back at some of the most popular
articles published on ONJava during the last year.
http://www.onjava.com/pub/a/onjava/2004/12/22/2004-yearender-1.html

———————
Digital Media
———————
***Exporting QuickTime Movies with Simple Video Out X
You have great QuickTime content in your computer, but it seems not so
easy to play it on a TV or send it to a VCR or DVD recorder without firing
up iMovie or Final Cut. Or is it? Erica Sadun has discovered a simple but
powerful (and free) application that makes exporting QuickTime as fun as
watching it.
http://digitalmedia.oreilly.com/2004/12/22/video_out.html

================================================
From Your Peers
===============================================
Don’t forget to check out the O’Reilly UG wiki to see what user groups
across the globe are up to:
http://wiki.oreillynet.com/usergroups/index.cgi

Until next time–

Marsee

Using PHP scripting for sysadmins

An [url=http://enterprise.linux.com/article.pl?sid=04/12/22/0028257]article on linux.com[/url] shows a couple of examples of using PHP scripting to perform sysadmin tasks on servers.

More info can be found on the [url=http://www.php.net/manual/en/features.commandline.php]Command Line manual[/url] page on PHP.net.

PHP Hits the Mainstream: Gets worm to prove it!

We have had some interesting security-related news in our world these last couple of weeks. You may want to read on if you are running:

  • php < 4.3.10
  • php < 5.0.3
  • phpBB < 2.0.11

Also, I’ve added a little trick you might be interested in to keep your services safe. This is especially imporant if you use a shared host, and don’t have access to update your own software. Read on for more…

As Eric pointed out in the Forums, [url=http://www.php.net/ChangeLog-4.php#4.3.10]PHP 4.3.10[/url] and [url=http://www.php.net/ChangeLog-5.php#5.0.3]5.0.3[/url] are now out. You really need to look into ugrading to one of these as soon as possible.

Also, a new worm targeting phpBB has been written. This initial version used a flaw in phpBB’s highlighting code to deface your site with the worm. Then, the worm would use google to find phpBB sites that had not yet been upgraded to infect. You can [url=http://it.slashdot.org/it/04/12/21/2135235.shtml?tid=220&tid=217&tid=169[/url] read more about it on [url]slashdot.org[/url].

While google has stopped returning requests related to this worm, that doesn’t mean a new variant that uses a different (read:lesser) engine won’t pop up soon.

As “akiy” on slashdot posted:
[quote]It looks like the latest [url=http://www.phpbb.com/phpBB/viewtopic.php?t=244451]phpBB version 2.0.11[/url] or a [url=http://www.phpbb.com/phpBB/viewtopic.php?t=240513]simple patch[/url] will thwart the worm, though. Time to upgrade if you haven’t yet![/quote]

I have to take his word on this, because I can’t get to [url]phpbb.org[/url] right now.

Happy Patching!! Don’t forget to try it in your test environments first if you have one!!

Also, a pretty reliable way to keep things like this from happening is to run your php scripts using a different user than the one that can write to your files.

For example, your website quantumbagel.com runs phpBB. All of the files are owned by qb_admin, and are read-only to everyone else. Then, PHP runs as qb_cgi. The qb_cgi user has no files…maybe some jpeg’s in an upload or avatar directory, but that’s it. If php or your scripts get compromised, the worst thing they could do is jack with your data…but your code would still be clean and intact.

If your php runs as an apache module in Linux, it is probably running as nobody…and unless your permissions allow anyone to write to your files you are probably ok.

I’m not sure how you would do this in windows though. (I have some fuzzy recollections about IIS_USER and the everyone group, or something) Anyone care to enlighten us?

Be safe out there!

Posted in PHP

December, 2004 (Savant)

Another great month! A big thank you to everyone who came by. The turnout was incredible, especially being right in the middle of the holiday season.

Hope to see you all again in January.

You may be interested in the slides for the [url=http://kcpug.org/doghouse/2004_dec/savant_20041218.swf]Presentation on PHP Savant[/url].

Happy holidays!!

Scalable Inline Image Replacement

This is definatly one of those things that I’m not sure I would ever use, but it is certainly cool enough to share. Using a little php and javascript, [url=http://axisfive.net/aboutsiir/]this script[/url] seemingly allows you to replace the content of any tags (h1 for example) with a nice graphic of the text in any font/size/color you choose.

No image support? no problem…alt property supplied on replace
No JS support? no problem…css marks up your h1 as normal
No visual support? no problem…screen reader reads your h1 or alt tag

Pretty cool in theory. It has built in, server-side cache support, etc. I’m a little squimish about a DoS vulnerability…someone flooding your site with obscene image generation requests. But, that could be trapped. What do you all think?

November 23, 2004 Newsletter

O’Reilly News for User Group Members
November 23, 2004
—————————————————————-
Book News
—————————————————————-
-Treo Fan Book
-PowerBook Fan Book
-iBook Fan Book
-Xbox Fan Book
-Securing Windows Server 2003
-The CSS Anthology: 101 Essential Tips, Tricks & Hacks
-Oracle Utilities Pocket Reference
-Programmer’s Ultimate Security DeskRef
-Unit Test Frameworks
-Inside the Spam Cartel
-PC Hacks
-Degunking Your Email, Spam, and Viruses
-Gaming Hacks
-Smart Home Hacks
-Head First Design Patterns
-Knoppix Hacks
-Windows to Linux Migration Toolkit
—————————————————————-
Upcoming Events
—————————————————————-
-Wil Wheaton (“Just a Geek”), Barnes & Noble,
Huntington Beach, CA–November 30
-Nathan Torkington (“Perl Cookbook”), Open Source
Developers’ Conference, Melbourne, Australia–December 1-3
-Gordon Meyer (“Smart Home Hacks”), DigitalGuru,
Sunnyvale, CA–December 15
—————————————————————-
Conference News
—————————————————————-
-Registration is Open for O’Reilly Emerging Technology Conference,
San Diego, CA– March 14-17, 2005
—————————————————————-
News
—————————————————————-
-O’Reilly author Wil Wheaton Just Added as a Speaker at Macworld
San Francisco
-Interesting Work for Interesting People
-Hacks for Smart Homes
-“Spam Kings” Author Shares Insights, Spam-Prevention Tips
-Open Source Licenses Are Not All the Same
-make: The Evolution and Alternatives
-The Youngest “Learning Python” Fan
-Write a Webserver in 100 Lines of Code or Less
-iPod Photo: Breakthrough Device or Work in Progress?
-Building Simple Lists Using Strings in VBA
-Skins and Themes
-Extending Struts
-Take the ONJava.com Survey
-Creating iPod Tattoos
-Could Ringtones Be More Annoying?!
—————————————————————-
From Your Peers
—————————————————————-
-First Annual New York Technical Community Holiday Party, NY, NY–
December 15
-London Perl Workshop, London, UK–December 11
================================================
Book News
================================================
Did you know you can request a free book to review for your
group? Ask your group leader for more information.

For book review writing tips and suggestions, go to:
http://ug.oreilly.com/bookreviews.html

Don’t forget, you can receive 20% off any O’Reilly, No Starch,
Paraglyph, Pragmatic Bookshelf, SitePoint, or Syngress book you
purchase directly from O’Reilly.
Just use code DSUG when ordering online or by phone 800-998-9938.
http://www.oreilly.com/

***Free ground shipping is available for online orders of at
least $29.95 that go to a single U.S. address. This offer
applies to U.S. delivery addresses in the 50 states and Puerto Rico.
For more details, go to:
http://www.oreilly.com/news/freeshipping_0703.html

—————————————————————-
New Releases
—————————————————————-
***Treo Fan Book
Publisher: O’Reilly
ISBN: 0596008163
Owners of the Treo smartphone from palmOne will master their revolutionary
little do-all device in no time flat with the new “Treo Fan Book.” This
unbeatable reference guide contains all the information people need–and
want–to know about the combined mobile phone/Palm-powered
organizer/wireless email, text messaging, and web-browsing tool/digital
camera.
http://www.oreilly.com/catalog/treofb/index.html

***PowerBook Fan Book
Publisher: O’Reilly
ISBN: 0596008171
This is the perfect guide for mastering all the features and taking
advantage of the advanced capabilities of Apple’s most desirable laptop.
The “PowerBook Fan Book” takes readers through the process of getting
familiar with their new machine and OS X Panther, learning handy tricks
and using high-end features, and finding out about little-known but
gotta-have accessories for their sleek and speedy new PowerBook.
http://www.oreilly.com/catalog/powerbkfb/index.html

***iBook Fan Book
Publisher: O’Reilly
ISBN: 0596008619
Anyone who owns an ultra-thin iBook can count on the “iBook Fan Book” to
give them everything they need to make the stylish little white wonder
work–and play–just as hard as they do. The book covers: getting familiar
with Mac OS X Panther; organizing a digital lifestyle; using advanced features;
enjoying iBook at home, at the office, and on the go; minimizing time and
stress; and maximizing fun and productivity.
http://www.oreilly.com/catalog/ibkfanbk/index.html

***Xbox Fan Book
Publisher: O’Reilly
ISBN: 0596008848
With cool 3D graphics, mind-boggling animation, and
devastatingly real audio, Microsoft’s Xbox is the most powerful and
popular gaming machine ever created. And now, the half-million (and
growing) gamers who own one have a reliable, all-purpose reference book
to guide them to the ultimate video game triumph: the top score! The “Xbox
Fan Book” covers using the console, enhancing the multimedia experience,
online play, recommended games like Halo, and accessories such as the
Xbox DVD Playback Kit.
http://www.oreilly.com/catalog/xboxfanbk/index.html

***Securing Windows Server 2003
Publisher: O’Reilly
ISBN: 0596006853
If you use Windows 2003 Server at a small- to medium-sized organization,
or if you use Microsoft’s Small Business Server, this thorough yet concise
tutorial offers the hands-on advice you need to secure your network. The
book focuses on ways to plan and implement a secure operating environment,
using real-world examples to show you how various security concepts relate
to your own system. Read it cover to cover to create and implement a
security plan, or use individual chapters as standalone lessons.
http://www.oreilly.com/catalog/securews/

Chapter 4, “File System Security,” is available online:
http://www.oreilly.com/catalog/securews/chapter/index.html

***The CSS Anthology: 101 Essential Tips, Tricks & Hacks
Publisher: SitePoint
ISBN: 0957921888
Make your site easier to maintain and faster to load with Cascading Style
Sheets. This book answers the 101 most common CSS questions about
everything from styling text to using CSS for layout. Plus, you’ll learn
how to use CSS to create accessible and standards-compliant web sites. All
solutions and effects are cross-browser compatible and easy to customize.
http://www.oreilly.com/catalog/0957921888/

***Oracle Utilities Pocket Reference
Publisher: O’Reilly
ISBN: 0596008996
“Oracle Utilities Pocket Reference” is a quick-reference guide to the
multitude of Oracle utilities that database administrators use every day.
Packed with information in an easy-to-read format, this compact resource
supplies the syntax and options for whatever utility a DBA needs to
perform a given task. Some of the utilities documented include:
SQL*Loader, for loading data; expdp and exp for exporting data to another
database; oradebug for use in troubleshooting; and loadjava and dropjava
for loading and unloading Java programs.
http://www.oreilly.com/catalog/oracleutilpr/

A sample excerpt, “expdp,” is available online:
http://www.oreilly.com/catalog/oracleutilpr/

***Programmer’s Ultimate Security DeskRef
Publisher: Syngress
ISBN: 1932266720
“The Programmer’s Ultimate Security DeskRef” is the only complete desk
reference covering multiple languages and their inherent security issues.
It will serve as the programming encyclopedia for almost every major
language in use. While there are many books starting to address the broad
subject of security best practices within the software development
lifecycle, none has yet to address the overarching technical problems of
incorrect function usage. Most books fail to draw the line from covering
best practices security principles to actual code implementation. This
book bridges that gap and covers the most popular programming languages
such as Java, Perl, C++, C#, and Visual Basic.
http://www.oreilly.com/catalog/1932266720/

***Unit Test Frameworks
Publisher: O’Reilly
ISBN: 0596006896
This is the only book to explore unit testing as a language-independent,
standalone development methodology. It covers the theory and methodology
of unit test frameworks, offers instruction in unit test development,
provides useful code examples in both Java and C++, and details the most
commonly used frameworks from the XUnit family, including JUnit for Java,
CppUnit for C++, and NUnit for .NET. It also includes the complete source
code for CppUnit for C++ and NUnit for .NET.
http://www.oreilly.com/catalog/unitest/

Chapter 3, “The xUnit Family of Unit Test Frameworks,” is available
online:
http://www.oreilly.com/catalog/unitest/chapter/index.html

***Inside the Spam Cartel
Publisher: Syngress
ISBN: 1932266860
“Inside the Spam Cartel” is a methodical, technically explicit expose of
the inner workings of the spam economy. The book offers you a view inside
this dark underworld, the sophistication and sheer size of which will
shock you. You’ll meet the characters that control the flow of money as
well as the hackers and programmers committed to keeping the enterprise up
and running. You may disagree with their objectives, but you’ll marvel at
their ingenuity and resourcefullness in defeating spam filters, avoiding
identification, and staying one step ahead of the law.
http://www.oreilly.com/catalog/1932266860/

***PC Hacks
Publisher: O’Reilly
ISBN: 0596007485
“PC Hacks” shows you how to enhance performance and prevent problems with
your PC. You’ll learn about hacking the system board, BIOS, peripherals,
and operating system, and overclocking CPU and video cards, tweaking RAM
timing, and selecting the best performing components. This step-by-step,
hack-by-hack guide covers both Windows and Linux, and includes advice on
reusing an old PC to offload work from newer systems, as well as ways to
prevent security problems.
http://www.oreilly.com/catalog/pchks/

Sample hacks are available online:
http://www.oreilly.com/catalog/pchks/chapter/index.html

***Degunking Your Email, Spam, and Viruses
Publisher: Paraglyph Press
ISBN: 193211193X
“Degunking Your Email, Spam, and Viruses” outlines Paraglyph’s unique
12-step Degunking program, written in everyday language for all computer
users, that will teach you all the tried-and-true techniques to keep your
computer clutter-free and running well. The “Degunking with Time
Limitations” chart shows how you can improve your computer’s performance
and keep your email better organized, whether you have ten minutes or a
few hours. The book also provides information and links to free utilities
and programs that will help you get rid of viruses, manage your email
better, and protect your computer.
http://www.oreilly.com/catalog/193211193X/

***Gaming Hacks
Publisher: O’Reilly
ISBN: 0596007140
It doesn’t take long for an avid or just wickedly clever gamer to be
chafed by the limitations of videogame software and hardware. If you want
to go far beyond the obvious, there’s a tremendous amount of free fun you
can have by following the creative exploits of the gaming gurus. “Gaming
Hacks” is the indispensable guide to cool things gamers can do to create,
modify, and hack videogame hardware and software.
http://www.oreilly.com/catalog/gaminghks/

Five sample hacks are available online:
http://www.oreilly.com/catalog/gaminghks/chapter/index.html

***Smart Home Hacks
Publisher: O’Reilly
ISBN: 0596007221
“Smart Home Hacks” covers a litany of stand-alone and integrated smart
home solutions designed to enhance safety, comfort, and convenience in new
and existing homes. Learn how to equip your home with motion detectors for
added security, install computer-controlled lights for optimum
convenience, mount an in-home web cam or two purely for entertainment, and
much more. No matter what your technical level may be, this book will help
you achieve the automated home of your dreams.
http://www.oreilly.com/catalog/smarthomehks/

Sample hacks are available online:
http://www.oreilly.com/catalog/smarthomehks/chapter/index.html

***Head First Design Patterns
Publisher: O’Reilly
ISBN: 0596007124
In the manner of O’Reilly’s popular new Head First Series, “Head First
Design Patterns” is visually rich and designed for the way your brain
works. Applying teaching techniques developed in response to the latest
research in neurobiology, cognitive science, and learning theory, the book
will load patterns into your brain in a way that sticks. You’ll be able to
put what you’ve learned to work immediately, and you’ll find that you’re
better at solving software design problems. Become fluent in the language
of Design Patterns by putting your head first.
http://www.oreilly.com/catalog/hfdesignpat/

***Knoppix Hacks
Publisher: O’Reilly
ISBN: 0596007876
“Knoppix Hacks” is an invaluable collection of 100 industrial-strength
hacks for new Linux users, power users, and system administrators who are
using or considering the Knoppix Live CD, which is included with the book.
These tips and tools show how to use the live CD to troubleshoot, repair,
upgrade, disinfect, and generally be productive without Windows, and
without the difficulty of installing Linux itself.
http://www.oreilly.com/catalog/knoppixhks/

Five sample hacks are available online:
http://www.oreilly.com/catalog/knoppixhks/chapter/index.html

***Windows to Linux Migration Toolkit
Publisher: Syngress
ISBN: 1931836396
“Windows to Linux Migration Toolkit” is a unique book that offers a
complete solution for migrating from Windows to Linux. It provides
migration process planning, automated migration scripts,
anti-virus/anti-spam solutions, and specific migration and deployment.
http://www.oreilly.com/catalog/1931836396/

================================================
Upcoming Events
================================================
***For more events, please see:
http://events.oreilly.com/

***Wil Wheaton (“Just a Geek”), Barnes & Noble,
Huntington Beach, CA–November 30
Don’t miss Wil reading from his autobiography. He will be there from
7:00pm-8:30pm.

Wil Wheaton’s Blog:
http://www.wilwheaton.net/

***Nathan Torkington (“Perl Cookbook”), Open Source Developers’
Conference, Melbourne, Australia–December 1-3
Nat gives a keynote presentation on open source trends at this grass roots
style event.
http://www.osdc.com.au/index.html

***Gordon Meyer (“Smart Home Hacks”), DigitalGuru, Sunnyvale, CA–
December 15
Gordon makes an appearance at the DigitalGuru Computer Bookshop starting
at 12:30 p.m. DigitalGuru will be offering a 40% discount on Gordon’s book
that day. (If you can’t wait til December 15, be sure to stop by DigitalGuru
between November 29 and December 10 to take advantage of a
special sale: 40% off ALL O’Reilly books, as well as books by our publishing
partners.) DigitalGuru is located at 546-3 Lawrence Expressway in
Sunnyvale, CA.
http://www.digitalguru.com/index.asp?cookie%5Ftest=1

================================================
Conference News
================================================
***Registration is Open for 2005 O’Reilly Emerging Technology Conference,
San Diego, CA–March 14-17, 2005
Early Bird registration for ETech has just opened. This year’s conference
theme is “Remix,” which infuses ETech’s roll-up-your-sleeves tutorials,
to-the-point plenary presentations, and real world focused breakout
sessions. Come to ETech and discover how applications and hardware are
being deconstructed and recombined in unexpected ways. Learn how users and
customers are influencing new interfaces, devices, business models, and
services. For all the scoop on tutorials, featured speakers, and
conference events, check out:
http://conferences.oreillynet.com/etech/

User Group members who register before January 31, 2005 get a double
discount. Use code DSUG when you register, and receive 20% off the
“Early Bird” price.

To register for the conference, go to:
http://conferences.oreillynet.com/cs/et2005/create/ord_et05

================================================
News From O’Reilly & Beyond
================================================
———————
General News
———————
***O’Reilly author Wil Wheaton at Macworld
Actor, comedian, blogger, and self-described geek Wil Wheaton will deliver
a special feature presentation at Macworld San Francisco. Wheaton will
discuss his personal story, as well as the joys of web design, HTML, and
blogging on Thursday, January 13, 2005 at 9:30 a.m. This
ever-popular actor-turned-writer will also attend a book signing after
his presentation.

Wil Wheaton’s Blog entry:
http://www.wilwheaton.net/mt/archives/001739.php

Macworld press release:
http://home.businesswire.com/portal/site/google/index.jsp?ndmViewId=news_view&newsId=20041109005168&newsLang=en

***Interesting Work for Interesting People
O’Reilly Media is looking for a web designer; an Office, .NET; and Windows
programming editor; a national account manager; product managers; a
systems analyst; and software engineers; among others. For a complete list
of open positions, visit:
http://jobs.oreilly.com/

***Hacks for Smart Homes
Implementing home automation may be easier and less expensive than you
ever imagined. By using your computer, your home can become much smarter.
Gordon Meyer, author of “Smart Home Hacks,” covers the basics of
automating your home with MisterHouse, an open source home automation
application for Linux, Windows, and Mac OS X. Move a step beyond automatic
lights to a home that actually responds to stimuli.
http://www.onlamp.com/pub/a/onlamp/2004/11/11/smrthome_hks1.html

***”Spam Kings” Author Shares Insights, Spam-Prevention Tips
In this interview with TechSoup, Brian McWilliams talks about the most
effective way to fight spam, anti-spam legislation, why spammers spam, the
types of scam people most often fall for, and much more.
http://www.techsoup.org/howto/articlepage.cfm?ArticleId=566

———————
Open Source
———————
***Open Source Licenses Are Not All the Same
As open source and the Internet continue to grow in popularity, more and
more users and developers come into contact with open source code. Though
the various licenses increase user rights somehow, they all do it in
different ways and with different goals. Steve Fishman categorizes several
popular licenses and explains their implications.
http://www.onlamp.com/pub/a/onlamp/2004/11/18/licenses.html

***make: The Evolution and Alternatives
After 13 years of the O’Reilly classic, “Managing Projects with make, 2nd
Edition,” coauthor Andy Oram looks back and summarizes the evolution of
make. With the recent release of “Managing Projects with GNU make, 3rd
Edition,” author Robert Mecklenburg offers an adapted excerpt comparing
Ant, IDEs, and make for managing the build process.
http://www.onlamp.com/pub/a/onlamp/2004/11/18/gnumake_3e.html

***The Youngest “Learning Python” Fan
How old do you have to be to appreciate O’Reilly’s books? Not very. Tim
Pietzcker shows us how much his 17-month-old son likes “Learning Python,”
and other readers chime in with similar experiences (including Chicago
Perl Monger Andy Lester). The appeal of O’Reilly animals proves to be
cross-generational in our latest “Letters.”
http://www.oreilly.com/pub/a/oreilly/letters/2004/python_1104.html

———————
Mac
———————
***Write a Webserver in 100 Lines of Code or Less
REAL Software programmer and tester Jonathan Johnson shows you the power
and simplicity of developing with REALbasic by walking you through the
building of a working webserver. After this tutorial, you’ll not only have
a pratical knowledge or REALbasic, but you’ll have a cool little server
too.
http://www.macdevcenter.com/pub/a/mac/2004/11/19/realbasic.html

***iPod Photo: Breakthrough Device or Work in Progress?
After spending three years as the most popular digital music player, the
iPod has evolved. No longer just music to your ears, the new color iPod
photo boasts plenty of eye candy with storage for as many as 25,000
photos. Is it really everything you ever wanted? Hadley Stern, author of
“iPod & iTunes Hacks,” takes an in-depth look with his review.
http://www.macdevcenter.com/pub/a/mac/2004/11/16/ipod_photo.html

———————
Windows/.NET
———————
***Building Simple Lists Using Strings in VBA
Visual Basic for Applications (VBA), the language used for scripting
Microsoft Word, isn’t really known for its string-processing abilities.
But sometimes, string hacking is a quick and convenient way to solve a
problem, and the string functions VBA does provide are often up to the
task. In this article, Andrew Savikas, author of “Word Hacks,” shows you
how to use strings for simple lists.
http://www.windowsdevcenter.com/pub/a/windows/2004/11/16/wdhks_2.html

***Skins and Themes
In his previous column, Jesse Liberty showed you how to use web forms
security to create a personalized site. Here, he builds on that work to
introduce the concepts of skins and themes, which allow users to configure
the look and feel of your site.
http://www.ondotnet.com/pub/a/dotnet/2004/11/15/libertyonwhidbey.html

———————
Java
———————
***Extending Struts
With so many web application frameworks available, there’s little point
reinventing the wheel, especially when Struts offers remarkable
extensibility. Sunil Patil introduces the three basic means of extending
Struts to achieve custom web application behavior.
http://www.onjava.com/pub/a/onjava/2004/11/10/ExtendingStruts.html

***Take the ONJava.com Survey
We’re asking ONJava.com readers to participate in an online survey. You’ll
help shape our online editorial direction and influence which book titles
we pursue. And you’ll have a chance to win some of our most popular Java
books.
http://www.zoomerang.com/recipient/survey-intro.zgi?p=WEB223X7HZ42HJ

———————
Digital Media
———————
***Creating iPod Tattoos
One of the benefits of the Apple-HP iPod partnership is HP’s clever idea
to let iPod owners customize their devices using “tattoos.” You can
download predesigned ones from the HP site, or create your own with an
inkjet printer. Tony Williams shows you how.
http://digitalmedia.oreilly.com/2004/11/17/ipod_tattoos.html

***Could Ringtones Be More Annoying?!
People absolutely love annoying ringtones, and the annoying effect they
have on everybody else around them. This is really good news for those in
the audio business.
http://digitalmedia.oreilly.com/2004/11/10/drescher_bbq04_ringtone.html

================================================
From Your Peers
================================================
***First Annual New York Technical Community Holiday Party,
NY, NY–December 15
Network with hundreds of New York’s top IT professionals in a private SoHo
lounge space, where you’ll have a chance to connect with the industry’s
top vendors and experts. Join authors and fellow IT pros for
presentations, giveaways, open bar, hors d’oeuvres, and a unique
networking opportunity in Manhattan.
Admission is free, RSVP required.
http://nyphp.org/nytchp.php

***London Perl Workshop, London, UK–December 11
This event is intended to allow Perl beginners to learn from long-standing
members of the community, while also giving the experts a chance to make
easy tasks seem trivial, and hard tasks seem easy.
Imperial College
http://london.pm.org/lpw/

Don’t forget to check out the O’Reilly UG wiki to see what user groups
across the globe are up to:
http://wiki.oreillynet.com/usergroups/index.cgi

Until next time–

Marsee

Hey, where did the PHP News go?

Sorry everyone…I had to take the syndicated news block off the site for a while. It feels like they are using a blocking request to get news: if the other site is hanging…our site will hang right around with it until it gets an error or the news feed. As you guessed it…it was hanging. If I fix it, I’ll send the patch over to the maintainer, but for now…you can see the affiliate news by clicking the headlines link on the menu.

The PHP WTF?!?

For an entertaining read from time to time (They only seem to update once or twice a week).

Check out [url=http://thephpwtf.com/]The PHP WTF[/url].

Funny site that highlights some of the worst PHP code you can imagine.

Todays example shows off some great code where apparently the coder didn’t realize you could pull back more than one column at a time with a sql query.

Posted in PHP