<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0"><channel><title>My Blog: Latest Posts</title><link>http://beta.ferdianto.com</link><description>To blogly go when no one has blog before ;)</description><language>en-us</language><item><title>Dear Admin: "Please Limit POST/GET request Length"</title><link>http://www.ferdianto.com/2012/01/01/dear-admin-please-limit-postget-request-length</link><description>&lt;p&gt;
First of all, I would like to say: Happy new year ;) Haha, this is my first post in 2012 and my first post will began with messages to all admins around the world, to limit their request length. Why? Because it can lead to DOS attack, using a simple POST request with specially crafted messages that can led to huge amount of CPU usages.
&lt;/p&gt;

&lt;p&gt;
I don't have to explain the background behind it, because many articles has done a great job of explaining. Here's the related articles explaining the problem:
&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;&lt;a href="http://www.ocert.org/advisories/ocert-2011-003.html"&gt;http://www.ocert.org/advisories/ocert-2011-003.html&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://cryptanalysis.eu/blog/2011/12/28/effective-dos-attacks-against-web-application-plattforms-hashdos/"&gt;http://cryptanalysis.eu/blog/2011/12/28/effective-dos-attacks-against-web-application-plattforms-hashdos/&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://nikic.github.com/2011/12/28/Supercolliding-a-PHP-array.html"&gt;http://nikic.github.com/2011/12/28/Supercolliding-a-PHP-array.html&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;The most important is the third link, because many sites are using PHP, and so many sites are not yet updated into PHP 5.3, especially shared hosting sites.&lt;/p&gt;

&lt;script type="text/javascript"&gt;
  var _gaq = _gaq || [];
  _gaq.push(['_setAccount', 'UA-22398060-1']);
  _gaq.push(['_setDomainName', '.ferdianto.com']);
  _gaq.push(['_trackPageview']);

  (function() {
    var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;
    ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';
    var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);
  })();
&lt;/script&gt;

            </description><pubDate>Sun, 25 Dec 2011 16:01:00 -0000</pubDate><guid>http://www.ferdianto.com/2012/01/01/dear-admin-please-limit-postget-request-length</guid></item><item><title>Test</title><link>http://www.ferdianto.com/2011/12/30/test</link><description>&lt;p&gt;test hello world&lt;/p&gt;</description><pubDate>Fri, 23 Dec 2011 15:12:00 -0000</pubDate><guid>http://www.ferdianto.com/2011/12/30/test</guid></item><item><title>Mandiri Transaction Downloader</title><link>http://www.ferdianto.com/2011/05/09/mandiri-transaction-downloader</link><description>&lt;p&gt;Following the BCA transaction downloader script, my &lt;a href="http://jaylangkung.net"&gt;friend&lt;/a&gt; asked me to do the &lt;a href="http://www.bankmandiri.co.id"&gt;Mandiri&lt;/a&gt; transaction downloader script.&lt;/p&gt;

&lt;p&gt;So, here it is, ofcourse it is in &lt;a href="http://python.org"&gt;python&lt;/a&gt;. The reason I keep doing this in python is that so other user can use and learn python too. Since it is not as suck as the other scripting language and never let me down ;)&lt;/p&gt;

&lt;p&gt;Just change the parameter inside the script:&lt;/p&gt;
&lt;pre&gt;

#Ganti username dengan username anda
USERNAME = "user123"

#Ganti pin dengan pin anda
PIN = "123123"

#Ganti pake norek anda
NOREK = "1111111111111"

#Hari
DAYS = 7
&lt;/pre&gt;
&lt;p&gt;Its so self explaining, below is the full script&lt;/p&gt;

&lt;p&gt;&lt;a href="http://www.ferdianto.com/media/mandiri.py"&gt;http://www.ferdianto.com/media/mandiri.py&lt;/a&gt;&lt;/p&gt;</description><pubDate>Mon, 02 May 2011 23:05:00 -0000</pubDate><guid>http://www.ferdianto.com/2011/05/09/mandiri-transaction-downloader</guid></item><item><title>Test Post Using Android</title><link>http://www.ferdianto.com/2011/04/04/test-post-using-android</link><description>&lt;p&gt;Hello, this is my test post using android. Need abetter interface actually&lt;/p&gt;</description><pubDate>Mon, 28 Mar 2011 09:04:00 -0000</pubDate><guid>http://www.ferdianto.com/2011/04/04/test-post-using-android</guid></item><item><title>Edit Your Email Before Reply or Forward In Blackberry</title><link>http://www.ferdianto.com/2011/03/30/edit-your-email-before-reply-or-forward-in-blackberry</link><description>&lt;p&gt;Having trouble editing e-mail prior to reply or forwarding? Or perhaps your colleagues at mailing-list is flaming you because of top posting? No more excuses now, there is apps for Blackberry that allow you to edit / inline editing email messages for reply or forward&lt;/p&gt;

&lt;p&gt;Try &lt;a href="appworld.blackberry.com/webstore/content/34815?lang=en" title="EmailEdit for Blackberry"&gt;EmailEdit&lt;/a&gt; Blackberry Apps. The price is less than a dollar, but it works great.&lt;/p&gt;

&lt;p&gt;It even can pull HTML email, and format it as text. &lt;/p&gt;
</description><pubDate>Wed, 23 Mar 2011 22:03:00 -0000</pubDate><guid>http://www.ferdianto.com/2011/03/30/edit-your-email-before-reply-or-forward-in-blackberry</guid></item><item><title>Blackberry Translator</title><link>http://www.ferdianto.com/2011/03/16/blackberry-translator</link><description>&lt;p&gt;Often annoyed by misspelled e-mail and some meaningless word, I would like to introduce &lt;a href="http://apps.orca.web.id/p/bbtranslator"&gt;BBtranslator&lt;/a&gt;, a blackberry translator apps.&lt;/p&gt;

&lt;p&gt;No, it is not yet published on the appworld, since it still beta release. And yes, it is powered by &lt;a href="http://translate.google.com/"&gt;Google Translate&lt;/a&gt;.&lt;/p&gt;
</description><pubDate>Wed, 09 Mar 2011 12:03:00 -0000</pubDate><guid>http://www.ferdianto.com/2011/03/16/blackberry-translator</guid></item><item><title>Indonesian News Aggregator</title><link>http://www.ferdianto.com/2011/02/01/indonesian-news-aggregator</link><description>&lt;p&gt;About couple of week ago, I've created a news aggregator, but for Indonesian news. I've made it because its getting so hard for me to track news from my own country.&lt;/p&gt;
&lt;p&gt;Please try at &lt;a href="http://id-feed.appspot.com/"&gt;id-feed.appspot.com&lt;/a&gt;&lt;/p&gt;</description><pubDate>Tue, 25 Jan 2011 16:02:00 -0000</pubDate><guid>http://www.ferdianto.com/2011/02/01/indonesian-news-aggregator</guid></item><item><title>Mining GMAIL Data</title><link>http://www.ferdianto.com/2010/12/22/mining-gmail-data</link><description>&lt;p&gt;Once I've create a script to monitor application status and send it to my email. And apparently, I need to download all the result to create some graph for analyzing purposes. Luckily, I have python at my disposal, so I can easily fetch email from my Gmail mailbox to some text file and then whipped some awk command to get the stats.&lt;/p&gt;
&lt;p&gt;Here's the simple script to fetch the required emails:&lt;/p&gt;
&lt;pre&gt;
import imaplib
import rfc822
try:
    from cStringIO import StringIO
except ImportError:
    from StringIO import StringIO

imap = imaplib.IMAP4_SSL('imap.gmail.com', 993)
imap.login(USER, PASS)
imap.select()
type,data = imap.search(None, 'SUBJECT', '&amp;quot;Push Stats&amp;quot;')
for num in data[0].split():
    typ, data = imap.fetch(num, '(RFC822)')
    text = data[0][1]
    file = StringIO(text)
    message = rfc822.Message(file)
    print message.fp.read()
imap.close()
imap.logout()
&lt;/pre&gt;
&lt;p&gt;I'm simply run the script and redirect the output to get the text file&lt;/p&gt;
&lt;pre&gt;
python gmail.py &gt; data.txt
&lt;/pre&gt;
&lt;p&gt;And then, just process the data.txt as if its a simple text file data&lt;/p&gt;
</description><pubDate>Wed, 15 Dec 2010 22:12:00 -0000</pubDate><guid>http://www.ferdianto.com/2010/12/22/mining-gmail-data</guid></item><item><title>Modify Kannel for USSD/UMB Support</title><link>http://www.ferdianto.com/2010/07/06/modify-kannel-for-ussdumb-support</link><description>&lt;p&gt;My friend asked me if I can modify kannel AT modem module for USSD support, so I've tried some and success. I've modify the gateway 1.4.3 version and have uploaded the diff for easy patching. But the edited source is also available.&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;&lt;a href="http://herdian.ferdianto.com/media/smsc_at.diff"&gt;smsc_at.diff&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://herdian.ferdianto.com/media/smsc_at.c"&gt;smsc_at.c&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
</description><pubDate>Tue, 29 Jun 2010 09:07:00 -0000</pubDate><guid>http://www.ferdianto.com/2010/07/06/modify-kannel-for-ussdumb-support</guid></item><item><title>How To Get Users IP Address in PHP</title><link>http://www.ferdianto.com/2010/05/30/how-to-get-users-ip-address-in-php</link><description>&lt;p&gt;
There are many tutorial to get users IP address, for instance like &lt;a href="http://www.php.net/manual/en/language.variables.predefined.php#31724"&gt;this&lt;/a&gt; or &lt;a href="http://www.php.net/manual/en/function.getenv.php#function.getenv"&gt;this&lt;/a&gt;. The problem is that &lt;b&gt;HTTP_XXX&lt;/b&gt; &lt;code&gt;$_SERVER&lt;/code&gt; variables is easily spoofed. It's not reliable because the user can fake it with a simple header addition. 
&lt;/p&gt;

&lt;p&gt;The only real solution to retrieve the client IP address is using &lt;code&gt;$_SERVER['REMOTE_ADDR']&lt;/code&gt;, unless your website is serving behind reverse proxy such as &lt;a href="http://nginx.org/"&gt;NGINX&lt;/a&gt; or &lt;a href="http://trafficserver.apache.org/"&gt;TrafficServer&lt;/a&gt;, than you can safely use &lt;code&gt;$_SERVER['HTTP_X_FORWARDED_FOR']&lt;/code&gt;&lt;/p&gt;
</description><pubDate>Sun, 23 May 2010 14:05:00 -0000</pubDate><guid>http://www.ferdianto.com/2010/05/30/how-to-get-users-ip-address-in-php</guid></item></channel></rss>