Just-Share

Yahoo Domain

noreply@blogger.com (SPiRiT) — Thu, 10 Sep 2009 18:38:00 +0000

What Is a Yahoo Domain?

The well-known Internet portal Yahoo! has joined the domain name business. The company now offers domain name registration services through its Yahoo! Small Business division. This sector of Yahoo is devoted to helping entrepreneurs get their businesses up and running by providing assistance like recruiting services, marketing tools and web hosting. The next reasonable step is to offer branded Yahoo domain registration. It’s another tool which will help business establish an online presence.

PC Magazine reviewed Yahoo Domains and gave it the highly-coveted Editor’s Choice Award. The published review states that “domain registration through Yahoo! Small Business is the easiest.” The statement reflects the level of service that one receives through a Yahoo Domain. It offers great features like domain forwarding, email forwarding, control panel with DNS management, and the most popular top-level domains. Knowledgeable customer service is available twenty-four hours a day, seven days a week and the call is toll-free. In addition to this, one to five-year registration plans are available.

Yahoo! Domains also makes upgrading very easy for those who want to expand to other Yahoo! services. Customers may upgrade to receive a personal custom mailbox or business mail package which reflects the domain name. Users may also transfer their Yahoo! domain from another web host to Yahoo! Web Hosting. If the customer needs help creating an online store, they may summon the help of Merchant Solutions which is a program that will help them manage online sales.

PC Magazine said that a Yahoo Domain was the easiest. It is quite possible to claim that the service is one of the cheapest. It offers all of the aforementioned features for only $4.98 per year at the time of this writing. With so many wonderful features at such a low price, it is hard to overlook an offer like this one.

Monetize Your Traffic So You Get The Most Out Of It

noreply@blogger.com (SPiRiT) — Thu, 10 Sep 2009 15:49:00 +0000

Establishing your own E-commerce site is not like what it used to be. There are thousands of competition that is all too willing to get a bigger share of the pie. Every scheme and method you can find to augment your sales would be very beneficial.

We have got to admit to ourselves. Most of us are into it for the money. We are not going to waste our time and effort just for the fun of it. Many sites would not wait until hell freezes over just to see their profits. While there are some who takes things lightly there are always those who would rather see profit any given day

It is common knowledge that without traffic we have no business. Like any business, without any customers you don’t get sales. Traffic represents all the people that gets a chance to see what you have to offer. The more people who see your products the more people there would be to buy them.

Nobody puts up an E-commerce site that doesn’t expect profit. We have a startup capital that needs to be regained. With a consistent traffic, we at least have a fighting chance to achieve that probability. Monetizing your traffic would optimize your chances of making the best out of it.

Making Money out of your Traffic

The best and most proven method of making a profit out of your traffic is using advertising. The internet generates hundreds of thousands upon hundred of thousands of traffic everyday. Most of them are searching for something. While some are just looking for information there is also a good percentage that is looking for something that they need.

The internet has proven to be a very reliable source in finding what was deemed to be a very unsearchable product. The internet has made the world a smaller place; you can advertise a product from the depths of Istanbul and still find a buyer from the center of Philadelphia.

Generating traffic is not an easy task. You have to contend with a great number of sites to generate a good number of traffic flow. But if done successfully this could open up a Pandora’s Box of possibilities. One of the benefits is monetizing your traffic flow.

So, to get to the core of it the more traffic you generate the more likely you are considered as a desirable, desirable, in a sense that a good traffic flowing site is easily convertible to profit. Basically traffic equals profit. Advertising is the name of the game; with the good advertising scheme you can use your traffic flow to your advantage.

When you have good traffic you have a good number of potential customers, customers that are willing to pour money into your coffers. Other than that these are also traffic that can be redirected to sponsored links that are willing to pay you for a sizeable portion of the traffic that you have generated.

This scheme is called “pay-per-click”. With every click a visitor of your site makes on an advertised link you will be paid. The more traffic you generate and the more clicks that happens would spell to more profits.

Affiliate Programs

Another method of monetizing your traffic are affiliate programs. You can link up with other tried and tested sites and online companies and monetize your traffic by having a percentage of sales generated by traffic coming from your site.

The basic idea is, traffic generated from your site will go to another site that can offer a product that you do not carry. Many programs can keep track and make records of transactions that was made possible because of site linkage.

When purchases are made by customers that was led by your site to their site you get a percentage of that sale. Affiliate programs would give you the benefit of monetizing your traffic without the actual need of carrying or promoting a certain product.

There are so many ways and methods to monetize your traffic. All it takes is a bit of hard work and the desire to successfully launch a profit-earning site. The internet is a veritable source of information, many tips and guides are offered everywhere in how to monetize your traffic and make your site a good profit earner.

MUST READ ... 10 Ways To Monetize Your Blog

noreply@blogger.com (SPiRiT) — Thu, 10 Sep 2009 14:39:00 +0000

I’m co-leading a discussion session at Wordcamp about Monetizing Blogs, so I thought I’d also touch on it here with a post about 10 Ways to Monetize Your Blog.

First, I should preface this discussion by saying you first need to seriously evaluate whether you want to work at monetizing your blog. Steve Pavlina has a very thorough post that goes over what’s necessary to really do this well, and why the majority of people who try end up not generating significant income.

Second, you have to make sure that making money from your blog directly is your goal. For example, for this blog direct income isn’t my goal. I didn’t have ads at all untli recently, and the only reason I added them was to use the ad network management application I’ve been working on called RMX Direct. It’s quite possible that your blogging goals may just to network, write about something you’re interested in, or serve some business purpose that isn’t direct income generation.

With that out of the way, let’s get started:

1. Contextual Advertising

Surprise, surprise. Advertising is easily the most popular blog monetization tactic, mostly due to it being the easiest thing to implement. Advertising comes in many forms, and contextual advertising is the most popular due to Google Adsense and it’s general success with blogs and niche sites.

I’m going to assume everyone reading this is familiar with it, but I think it should be mentioned that too many bloggers assume that Adsense is the best solution for their blog. For some blogs and topics it works great, for others, not very well at all.

My advice is to not limit your blog to one ad network or just one form of advertising. Other contextual options include the Yahoo Publisher Network, Chitika, Clicksor, AdSonar, and others. It’s not easy to manually test all these though if you’re shuffling ad tags around and randomly allocating your impressions to them, using a ad network management tool like RMX Direct can help you manage, evaluate, and control your various ad networks.

2. Display Advertising

As I mentioned above, contextual networks aren’t always the best solution for blogs. In some cases there aren’t enough advertisers in niche topics, and in others the users just isn’t likely to click. In this case, you want to be working with ad networks that provide CPM display advertising. This means you get paid something for every ad viewed, opposed to only getting paid per click.

Just like with contextual networks, it’s important to use multiple display ad networks to get more variety from your ads, to not let any one network control your inventory, and to make sure you’re earning the most amount of money possible.

3. Targeted Advertising

The most desirable form of advertising is having companies that wish to pay good rates to advertise on your blog directly whether it’s text or image ads. Many bloggers feel that this is a pipe dream, but I speak from experience from running a wakeboarding blog for many years that you can make solid income from targeted advertising without having insane amounts of traffic.

There are a number of key things you have to do though in order to get this type of advertising:

* Have a blog with leading content in your niche and a professional design

* Create a “media kit” which is essentially a page on your blog that explains that you take targeted advertising, what your rates are, demographics of your users, your traffic levels, examples of the types of ads people can run, testimonials from any companies that have advertised with you, and a phone number and email address they can use to get more information.

* Have obvious “Advertise On This Blog” links in key places on your blog.

* Give a company or two in your niche free or very low-cost advertising in order to get the ball rolling. When advertisers see their competitors or companies similar to them advertising, they get the idea that it’s available. If all they ever see is Adsense ads, they might not realize it’s an option.

* Be willing to be creative to help your advertisers achieve their goals, and lower your price to get the deals.

* Provide statistics and results to your advertisers. Use an ad server like RMX Direct, phpAdsNew, or something similar which has the ability to create reports per advertiser.

Once you’ve set your blog up properly, start approaching companies in your niche who will want to reach your traffic. You don’t need to go after the biggest companies, there are many small companies who are looking to get better results from the web, and they might not even know about your blog. You don’t need to be an ad sales professional, you just need to present your case well on why they’re missing out if they don’t advertise on your traffic. Make it easy on them to work with you, help them create ads, help them determine what sizes to use, and work with them to make sure they get the results they need. It seems like hard work at first, but after you get a solid base of advertisers going, it’s a great source of income and it starts to streamline.

4. Text Link Advertising

Another somewhat unobtrusive form of advertising is using services like Text Link Ads or Adbrite to sell text ads directly to companies. This is pretty low effort and often doesn’t take up too much space on a site, so it’s easy to implement and try out. It should be noted though that you need significant traffic for it to be a big source of income.

5. Affiliate Links

One of the older web monetization methods is still as good today as it’s always been. If you’ve got a blog in a specific area, there’s a very large chance that there are companies out there that sell products or services your users are interested in. You can earn some nice income recommending or linking to those products.

Amazon.com is probably the most common affiliate merchant used by bloggers, but I’d advise finding other unique merchants who may pay better and be more specific to your topic. Amazon is always there as an option, but you’re more likely to get more help from the merchant if you go with a smaller company.

Another nice thing about affiliate links is that they fit well with quality content. Reviewing products and services for your users is valuable content, and if you can make money off it as well it’s a great combination. A word of warning though that you shouldn’t change your reviews or be biased due to the fact you can make money off a referral.

While traffic also helps for affiliate links, it can sometimes be an easier way to generate income without high traffic levels like advertising requires. As an example I did a review of a web analytics application a couple of years ago, and this blog had very little traffic at that point. I referred two sales through that review though that still earn me $150 a month every month two years later.

6. Selling Your Content (Ebooks, Videos, DVDs)

If you’ve got great content, another option is to package it and sell it. There are numerous bloggers who have created ebooks and even real books based on their blog content and made great income selling them. You can also expand to infoproducts like videos, DVDs, audio CDs, and printed books on demand.

This can take some significant work and it requires great content to actually sell, but it can be a nice income stream that lasts a long time.

7. Consulting

Depending on your topic and your level of expertise, you can sell consulting services. If you’re a web analytics expert, you could offer web analytics consulting services on your blog for an hourly fee. This takes very little work to setup beyond creating a page outlining your services, getting a standard contract, and having a way to take payments from companies. Again though, it just takes a little bit of effort to let people know that consulting services are available.

8. Donations

Not quite as common as it once was, it used to be fairly common for bloggers to ask for donations on their blog through Paypal or some other service. This only works if you have a dedicated userbase, and a large enough number of users that their donations add up. I wouldn’t recommend this if you’re also putting a lot of advertising and other monetization methods on your blog. You’ll come off as a bit too greedy in that case.

9. Selling Products

Besides infoproducts, you can sell real products like t-shirts, bumper stickers, clothing, or whatever other kind of merchandise makes sense for your topic. Companies like Goodstorm, CafePress, Lulu, and others make it easy by creating the products based on your design and letting you set up a shop. There is no risk to bloggers, which makes it a great opportunity.

10. Selling Your Blog

Perhaps the most extreme of the blog monetization methods, but it can be lucrative! If you aren’t attached to your blog and are willing to part with it, you can usually find a buyer for it. Your blog must be pretty good, and have a level of traffic worth buying, and it really helps if you already have some income streams going for it. Blogs usually sell for 12-24 times monthly revenues, and there are numerous places you can sell them like eBay and the Sitepoint Marketplace.

Conclusion

It definitely takes some work to monetize your site well, and having good traffic really helps out. Work on building a blog with a solid userbase, and you should be on your way to generating income using any of the methods above. Good luck, and please share any blog monetization experiences you have in the comments.

Update: I was pointed to a similar post by Darren Rowse at Problogger.net that is also a recommended read on the subject of making money from your blog. He mentions many of the same things, and has a couple I didn’t mention as well.

Which Web Content Management System is Right For You?

noreply@blogger.com (SPiRiT) — Wed, 02 Sep 2009 09:47:00 +0000

CMS The choice of the correct web content management system can be critical to your aspirations. As margins are so thin these days your site design, appearance and rendition can often make the difference between success or failure. The website is your shop window to the world and it fully reflects your professionalism. You have but a fraction of a second to create that first impression to start off with and once the visitor is at your site, you must make sure that they are able to navigate and interact according to your intended purpose. Choosing the correct web content management solution is a process of narrowing down your choices. There are many hundreds of different options available to you and your choice will be dependent on your needs as well as budget.

As flexibility is demanded in the marketplace these days, your WCM platform should enable you to rapidly respond to your market conditions and in general you should seek to simplify and not leave yourself at the mercy of technical paralysis.

For many webmasters, the choice between open source or commercial hinges largely on cost but you should know that whereas open source is invariably free to procure and to install, you may come up against costs on the backend should you run into problems. Top quality support is not always available right when you need it.

Above all else, your web content management system should be easy to use and control, enabling you to specify your branding with little or no technical restriction. SEO should be almost second nature and your system should come with the tools to make it so. As there are so many different ways of presenting your site these days, different browser standards and, lately, internet-enabled mobile devices, strive for flexibility within your system so that it may be optimized and rendered according to your visitor’s choice. Note that within a good content management system your site’s templates will be separate from content and you should be able to maintain total consistency throughout. As the site will be easy to update, it will be possible to refresh content more frequently and in response to your particular market pressures.

There are many highly specialized providers in the field of enterprise specific content management and you can further zero your selection based on whether you want to focus on Java or Microsoft.NET technology.

Within the open source options, Joomla, Mambo, Drupal and WordPress are front and center.

Joomla is a highly flexible CMS which allows you to create numerous modules and components within a fresh and progressive framework. The latest version, 1.5, marks a considerable improvement, yet while you may be able to install this CMS in less than 30 minutes, you may spend some time getting the hang of it.

Mambo is similar to Joomla, is quite powerful and is simple to use. Its control panel is user-friendly and the system is backed up by a growing community of forum support.

Drupal is considered one of the top open-source CMS systems available, especially as far as its architecture is concerned. This system may be more for developers though, so you’d need to tread warily. Some users find Drupal more functional than Joomla or even WordPress, but unless you are somewhat experienced you may be better off sticking to the others.

Wordpress has long been known as the blogger’s platform and it is at the very head of its game without a doubt. It is very simple to use, but remember that it is fundamentally not designed for extensive modification and may not be the best platform if you require considerable e-commerce functionality, for example.

Do you have any experience with other CMS systems?

Registration .mp Now OPEN

noreply@blogger.com (SPiRiT) — Wed, 02 Sep 2009 09:16:00 +0000

At $20 a pop, it’s now possible to register your own .mp domain. It’s quite expensive compared to a regular .com or .net domain so I’m not sure if I’m biting this one. But the number of words ending in “-mp” opens up a lot of doors for creativity, to boot: donaldtru.mp or whitemencantju.mp or bigpi.mp or my.mp (the band). The list goes on. For $20/year, your domain ought to be funny or cool enough to be worth it.

Get a .mp domain now! (not an affiliate link)

Mr Modem's Dekstop

noreply@blogger.com (SPiRiT) — Wed, 02 Sep 2009 08:43:00 +0000

For some computer users, calling for technical support (with the exception of Smart Computing and Mr. Modem, of course) is slightly less enjoyable than having an anesthetic-free root canal. There are, however, a few things you can do prior to placing your call that will minimize and even eliminate that occasionally challenging experience.

Harkening back to my keyboard-deprived youth, I believe the Boy Scout motto, “Be Prepared,” best captures the focus of this month’s missive. Indeed, the better prepared you are, the less time you’ll spend talking to a tech support representative.

As part of your precall preparation, be sure you’re in a good mental place to make the call. If you’re agitated, frustrated, or experiencing a karma-induced “payback day,” don’t even dial the number. Only initiate contact when you’re relaxed, and you have quality time to devote to it.

When making your call, have several items at your fingertips: First, be sure to know what version of Windows you’re using and how much RAM (memory) your system has. If you’re not sure, simultaneously press the Windows Logo key and the PAUSE/BREAK key. You’ll find memory in the Computer area (on the General tab) or System section, depending on the version of Windows you’re using.

If you are seeking assistance for an error message, have the precise wording of the message available. It is not helpful to say that “some kind of error message came up.” Avoid nonspecific phrases such as, “My computer just won’t work,” or “I’d like to throw this thing out the window

No Windows , No Problem

noreply@blogger.com (SPiRiT) — Wed, 02 Sep 2009 08:41:00 +0000

Like its name would suggest, Data Rescue PC3 is an application designed to recover data from your PC when the files on your hard drive have been lost or damaged. The primary appeal of Data Rescue is that Prosoft includes an application disc that works even if Windows won’t boot because of a system crash. If errors, a power failure, or a virus corrupt your copy of Windows or the computer’s hard drive, you may still be able to reclaim files. Data Rescue PC also gives you the ability to copy all the files from a drive you think may be failing, so you have a backup on an external storage device, a second internal hard drive, or another storage location on your network.

When using Data Rescue as a bootup CD, you can select a Standard mode with step-by-step directions or an Advanced mode, which lets you view more detailed file information. After selecting the drive and allowing time for the scan to finish, we picked our Destination drive, and the files copied over without a hitch.

When we installed Data Rescue on our test PC, it offered us a Select Source window where we could select any of the storage drives (and the associated partitions) connected to our computer. Once the drive was scanned, we could navigate the folder directory or search the files for specific file types to clone onto our external hard drive.

by Nathan Lake

Your Firewall Blocks Internet Explorer

noreply@blogger.com (SPiRiT) — Wed, 02 Sep 2009 08:36:00 +0000

No single tool can provide your PC total protection from the potential dangers on the Internet. Instead, a number of tools working together, such as an email filter, antivirus program, and a firewall, can give your system the coverage it needs.

Unfortunately, these tools—whether installed individually or as part of a suite—sometimes get a little overzealous. For instance, your email filter could quarantine a message you want to read, or your firewall might block a program you want to use.

A firewall is an indispensable part of system protection. It blocks the attempts of anyone on the Internet trying to connect to or access your system without your permission. The firewall also asks your permission—which you can grant permanently by establishing an exception—to allow connections you need for programs such as instant messengers or online multiplayer gaming. Some firewalls will block outbound communication with networks. In addition, they can protect against viruses and worms.

For quick access to Windows Security Center and Windows Firewall, open the Start menu and use the Run command.

However, when your firewall blocks your ability to use your Web browser, then it’s gone too far. If you can’t use Internet Explorer and you think your firewall is the culprit, here’s what to do—short of turning off the firewall completely.

Windows Firewall

When Microsoft released Service Pack 2, a major upgrade to Windows XP, it included Windows Firewall, which was designed to replace the old Internet Connection Firewall. By default, Windows Firewall is turned on. If you’ve installed another firewall, the installation process likely will ask you to turn off Windows Firewall, or the other firewall may automatically disable Windows Firewall. If you are using one of the major third-party firewalls, we’ll explain your troubleshooting options below.

To access Windows Firewall, go to the Start menu, open the Control Panel, and click Windows Firewall. (Alternatively, you can choose Start, Run, and type firewall.cpl.)

If Windows Firewall is blocking IE, you might receive a Windows Security Alert indicating such is the case. If so, click Unblock in this dialog box, and your problem should be solved.

However, if you can’t use IE and don’t receive a Windows Security Alert, a better course of action is to open Windows Security Center—make sure you are logged on as an administrator when doing this—and click the Windows Firewall link so you can manage its security settings. To do this, either click the Windows Security Center icon in the Control Panel or type wscui.cpl in the Run command and click OK.

In Windows Firewall, click the Exceptions tab. This displays the list of programs and services that Windows Firewall exempts from blocking incoming network connections for. If IE is not listed, click the Add Program button and use the Browse button to find it. (The file Iexplore.exe should be located at C:\PROGRAM FILES\INTERNET EXPLORER.) Highlight it and click OK twice.

Third-Party Firewalls

As mentioned, installing a third-party firewall, even if it’s just an incoming firewall that is part of another program, will result in disabling Windows Firewall. (If this doesn’t happen automatically, or if you aren’t prompted to do so, you should disable Windows Firewall because in most cases it’s best to have just one firewall running at a time.) Once the firewall is installed and activated, if you encounter a problem using IE, check the security settings.

Windows Firewall can help protect your computer by blocking unauthorized access from outside network or Internet communications.

If you are using Norton Personal Firewall ($49.99; www.symantec.com), for example, click Status & Settings on the left side of the main page and then click the Personal Firewall link. Now, double-click Default Level. Make sure the setting here is Medium, which will not only allow access to IE, but will also allow the use of Java applets and ActiveX controls. When these are blocked, many Web pages won’t load—making you think the problem is with IE.

Another example, the McAfee Personal Firewall ($34.95; www.mcafee.com), employs six levels of security—from the ultra-tight Lockdown level to the permissive Open level. The default setting is the Standard level, which alerts the user when a new or unknown program is seeking Internet access.

When the firewall is set to Lock-down, that effectively shuts down your Internet access. It blocks all incoming and outgoing connections to networks, including your access to the Web and email programs.

To get out of Lockdown, go to the Internet & Network Configuration window in Personal Firewall and click Advanced. This opens the Security Level pane. Here, move the slider from Lockdown to another security level. Moving the slider even one position to the Stealth security level should restore your access to IE. After you’ve chosen a security level, click OK.

Modify Your Firewall Rules

In addition to security settings, firewalls contain specific rules you can modify that govern how programs on your system access the Web. Thus, if you’re having problems with your browser, try modifying your firewall rules.

We’ll use Norton Personal Firewall as an example. Click Personal Firewall and then click Configure. On the Programs tab, choose from the Settings For drop-down menu and then choose the Network Location that contains the program rule you want to change. In the Manual Program Control list, click the program rule you want to change.

Short of shutting down a third-party firewall, such as Norton Personal Firewall, try turning down the settings in the firewall so that it doesn't block all programs, including Internet Explorer.

In the Internet Access column, use the drop-down menu to select Custom or Manually Configure Internet Access. Choose the firewall rule you want to change and then click Modify.

You will then need to determine the action the rule should take (Action tab), the type of connection the rule should monitor (Connections tab), the computers the rule should monitor (Computers tab), and the protocols and ports the rule should monitor (Communications tab). There are additional measures you can take on the Tracking, Description, and Locations tabs. When you are finished modifying the rule, click OK.

Update Your Virus Protection

If a firewall detects a security risk, such as one posed by a virus or worm, it might prevent a user from going online through IE. This is why it’s very important to keep your antivirus program updated. When you update your antivirus program, you are staying on top of the virus definitions the program uses to identify the latest virus threats.

Of course, it’s ideal to do this on a regular basis so that your system does not get infected. But if you find access to IE blocked and tweaking the settings in your firewall doesn’t work, the problem might actually be a virus. One solution is to go online with a different computer and visit the Web site of the manufacturer of your antivirus program. Download the latest definitions to a CD and then insert the disc into the computer with the nonfunctioning IE.

Once you load the new definitions, initialize a full-system scan with your antivirus program and then use a repair wizard or similarly named tool to fix any security risks that are found. Restart your system, and you should be able to launch IE

Identify these HTTP servers/devices, receive something cool

noreply@blogger.com (SPiRiT) — Wed, 02 Sep 2009 07:01:00 +0000

[Update 6/27: Dan a.k.a. "Mr. Smoot" pointed me to a URL that further confirms #3 as a NetScaler device, as well as makes a convincing case that #4 is a NetScaler device as well. In addition, he helped narrow down the possible list of suspects of #1 to Radware devices]

[Update 6/11: Ryan P. pointed me to Citrix NetScaler devices, which further research indicates is the right answer to #2; other Citrix/NetScaler family devices may also prove to be the answers to #1 and #3, and even have similar behavior to #4. However, I'll still take concrete answers for #1, #3, and #4]

Below are some oddball/unique HTTP responses with strange behaviors I've recently ran across while surfing the 'Interweb', and I'd like your help in identifying the underlying software/device. In exchange, the first person(s) to provide reasonable information for each of the items have the option to receive a free SPI Dynamics t-shirt or, if you're going to BlackHat Las Vegas 2007, an invite to the after-hours SPI party at Tao. You don't have to have an answer for all of the items below--any single one is fine.

Basically I'm looking for the as much information as possible, particularly the vendor and software name, and then any additional information (configuration that causes the exhibited behavior, etc.). Please don't take guesses--I'm looking for confident answers from people who have encountered these scenarios before and know first (or second) hand the exact software/device that exhibits these behaviors. I've already done a moderate amount of Googling, to no avail; it's extremely unlikely that a few web searches are going to be enough to identify these items. But you're more than welcome to try anyways.

Without further ado, let's get identifying!

1. The web device (proxy, cache, load balancer, surrogate, etc.) that changes the "Content-Length:" header into "Xontent-Length:", as used by www.paypalobjects.com (make a 404 request to see the behavior); the underlying server is thttpd, and thttpd does not exhibit that behavior internally, so it must be an intermediary HTTP device. The partial HTTP response looks like:

[Update 6/27: this is potentially a Radware device]

HTTP/1.0 404 Not Found\r\n
Xontent-Length: \r\n
Server: thttpd/2.25b 29dec2003\r\n
Content-Type: text/html; charset=iso-8859-1\r\n
Last-Modified: Tue, 05 Jun 2007 17:01:12 GMT\r\n
Accept-Ranges: bytes\r\n
Cache-Control: no-cache, no-store\r\n
Date: Tue, 05 Jun 2007 17:01:12 GMT\r\n
Content-Length: 329\r\n
Connection: close\r\n
\r\n

2. The web server that identifies itself with the "Server" banner "NS_3.0", as used by www.paypal.com.cn and totale.usc.edu (no, it is not a Netscape 3.x server). Note the broken "Content Type" and "Cache Control" headers. Is this something from NetworkEngines? The response looks like: (Note: the Location header value has been removed)

[Update 6/11: reasonably sure this is a NetScaler device]

HTTP/1.1 302 Object Moved\r\n
Server: NS_3.0\r\n
Location: ...\r\n
Content Type: text/html\r\n
Cache Control: private\r\n
Connection: close\r\n
\r\n

3. The web device (proxy, cache, load balancer, surrogate, etc.) that uses a "Via:" header signature of "NS-CACHE-6.0", as used by www.ireland.com and developer.mozilla.org (make a 404 request to see the behavior); it also has the "Xontent-Length" header switch, an all-alpha, all-caps "Etag" value, and a superfluously spaced "Age" header value; is this a iPlanet/Netscape/Sun product? Does anyone know anyone officially at Mozilla.org they can ask? Also note the Xontent-Length header--this may relate back to #1. The response looks like:

[Update 6/27: this link seems to confirm the device as being a NetScaler; also, NetScaler devices ship with software version 6.0 by default, which further confirms it based on version number]

HTTP/1.1 404 Not Found\r\n
Age: 7 \r\n
Date: Tue, 05 Jun 2007 17:04:05 GMT\r\n
Xontent-Length: \r\n
Connection: Close \r\n
Via: NS-CACHE-6.0: 101\r\n
ETag: "KXDEBBLANKSQVXUM"\r\n
Server: Apache\r\n
Content-Type: text/html; charset=iso-8859-1\r\n
\r\n

4. The web device (proxy, cache, load balancer, surrogate, etc.) that changes the "Connection:" header into "nnCoection:"; there's some speculation that it's a Netapp NetCache, but I haven't seen this behavior from our own NetCache devices. Various Amazon web sites are known to exhibit this behavior, but I've seen it elsewhere as well. The response looks like:

[Update 6/27: seems to be a NetScaler device]

HTTP/1.1 200 OK\r\n
Date: Tue, 05 Jun 2007 17:05:18 GMT\r\n
Server: Server\r\n
Vary: Accept-Encoding,User-Agent\r\n
Content-Type: text/html; charset=ISO-8859-1\r\n
nnCoection: close\r\n
Transfer-Encoding: chunked\r\n

To identify any of the above, you can either leave a comment to this blog post (be sure to include your email address), use the email contact web form (again, be sure to include your email address), or send me email directly via username jforristal at the domain spidynamics.com.

Sql Server Data Recovery

noreply@blogger.com (SPiRiT) — Wed, 02 Sep 2009 06:54:00 +0000

OfficeRecovery.com provides the best data recovery software so that you can use their software when you have lost your data and files on your computer. I know that you always take care of your files and data on your computer but sometimes you cannot avoid losing your data. For instance, you accidentally delete your files and data or because your computer goes damaged or hard drive failure, you may lose your files and data. Now you do not need to worry because you can still get back your files and data by using the data recover software.

Those who have used the data recovery software from OfficeRecovery.com should be very enthusiastic because now Office Recovery has improved their software. Now you can use the software for corrupted MDF database. If you want to know more features of the software for SQL Server data recovery, you can check out their website now. I think your files and data on your computer will safer than before.

Security zone shortcomings: why browsers and websites encourage phishing

noreply@blogger.com (SPiRiT) — Wed, 02 Sep 2009 06:32:00 +0000

Hello everyone. Since this is my first blog post, an introduction is warranted. My name is Jeff Forristal, and I'm a recent addition to the SPI Labs team at SPI Dynamics. I came to SPI from a security services company, and have almost a decade of security experience--particularly in the web arena. In the past I've written multiple magazine articles and contributed to a book on various security-related topics. I have a very practical security outlook: I want to see real security solutions that can be used and succeed today, because that's what is needed. Theories are fine, but until they are implemented and deployed, they don't make the world a safer place.

Which brings me to the topic of browser security zones, which are particularly notable in Internet Explorer and are a part of Microsoft's general remediation strategy for many of the vulnerabilities found in IE. For those of you unaware or unfamiliar with browser security zones, the short story is that web sites can be classified into 'zones'. There's typically a zone for web sites you explicitly trust (such as your bank), a zone for local/intranet web sites (typical in a work environment), and then an Internet zone for everything else. The goal is to reduce the security privileges given to the Internet zone (i.e. restrict what the Internet at large can do to/with your browser), while having more relaxed restrictions for sites you trust (letting them perform more security-sensitive operations). In a perfect world, you would configure your browser to disable Javascript, ActiveX, Flash, and all other excessive features in the Internet zone. This would reasonably protect your browser against any Javascript-based attack (including attacks related to phishing and XSS) and likely curb direct browser exploitation by a native browser vulnerability.

Great...in theory. However, I've spent the last four+ years living this approach and it has proven to be borderline unusable at times, and down-right frustrating most other times. But I'm not going to place all the blame on the web browsers themselves--web sites boast architectural design decisions and page implementations that do not cater to zoned browsing (and in some cases, make it nearly impossible to configure the site to be trusted at all!). Not to mention, any Web 2.0/AJAX style application requires full trust due to the amount of client-side technology it needs to leverage.

As I've said, I've lived with the security zone browsing model in IE for the last four+ years. As a security practitioner, I felt it necessary to 'practice what I preached', especially since I often told enterprise clients that they should consider leveraging security zone policies in corporate environments to reduce the potential for client-side exploitation and the introduction of browser-sourced malware into their internal network. Well, after using the security zone model for the first year (i.e. disabling Javascript, amongst other things, for the Internet non-trusted zone), I stopped making that recommendation. Trying to not trust the Internet at large and explicitly trust certain sites proved too cumbersome and often impacted my browsing experience (or prevented it entirely). Many folks often incite the 'Grandmother usability rule' (i.e. "It needs to be so easy that my computer-illiterate grandmother must be able to figure it out"); the use of security zones definitely falls short in that regard. And if I, a web and security expert, can't make browser security zones work as a practical reality, then I don't want to think about the effectiveness it will (or more appropriately, won't) have with the rest of the world at large. [As a side note, I still to this day use restricted browser zones, as painful as they are; they are a necessary evil given all the vulnerabilities in browsers and IE in particular.]

Common issues encountered on websites running in non-trusted zone

Over a decade ago I was the webmaster for a web design company based in Chicago. I developed a mantra back then, and I've stuck to it through today: a good website design should not depend on Javascript and/or should gracefully degrade when Javascript is disabled. Now, AJAX aside, this is a good mantra to live by--especially if you're a security practitioner (check out http://ha.ckers.org/ for all the evil/fun things people are doing with Javascript these days). The requirement of Javascript essentially forces the user to trust your web site (or the Internet at large) in order to achieve full functionality...and that's essentially a strongarm tactic that erodes the value of browser security zones. Now, I can see the requirement of Javascript for unique or complex calculations or functionality (Google maps, anyone?)...but so many sites use it in obnoxious ways:

* They use a Javascript-based URL redirect instead of the functionally equivalent meta refresh HTML tag (particularly when there's no URL parameters that must be calculated/passed)
* They use a Javascript onclick() URL location changer in an HTML anchor tag while leaving the href attribute empty (causing the browser to go nowhere if the link is clicked and Javascript is disabled)
* They have users enter their credentials/data into a visible form, and upon submission, use Javascript to copy the credentials/data to a hidden form and submit the hidden form instead (many cite client-side validation as the reason, but proper security requires you to do server-side validation anyways)
* They use dynamic Javascript or Flash menus and provide no other 'normal link' method to navigate their site
* They use Javascript to load/define CSS elements, or otherwise render basic aspects of the page (look at http://www.hp.com/ without Javascript to see what I mean)

While all of the above issues are Javascript-related, a bigger and more devious web site issue that breaks zone-based browsing involves the use of multiple domain names particularly for form submissions, redirects, and frames. The current security zone model is dependant on domain names; domain names are used to classify the sites into the appropriate zone. You can use wildcards (at least with IE) to help save data entry for sub-domain names; i.e. you can enter *.bankofamerica.com and it will trust all the sub-domains of the bank (cgi.bankofamerica.com, images.bankofamerica.com, etc.). The wildcard method is a real time saver--that is, if web sites were smart enough to stick with sub-domain names rather than entirely different domain names. Instead, some web sites redirect to or utilize form processing at a third-party site, or the target site may be hosted on an affiliate domain. That breaks the zone-based model because the trusted transaction will become interrupted and be demoted to an untrusted level somewhere in the middle of the transaction, typically causing errors. To make matters worse, it's often unclear to a user where/how/why the process broke, and the user is left no information that tells them anything about the use of the untrusted domain name. Thus the user has to view the HTML source and figure out what domain names need to be added, and hopefully be able to retry/restart the transaction/process after the untrusted domain names are configured to be trusted.

Experian is a good example of this point. After browsing their main web site (http://www.experian.com/), clicking various 'Get my credit report' links will take you to experiandirect.com or creditexpert.com--both Experian sites but different than the main domain name of experian.com. eBay is another site that I had issues with (albeit it was over a year ago and I haven't tried it since). The 'Sell Your Item' process involved requests to a half-dozen eBay hosts which didn't use the .ebay.com root domain (for example, they used 'ebay-imgs.com' for picture hosting, and that didn't match the wildcard *.ebay.com...why they couldn't have used imgs.ebay.com I'll never know). Needless to say I was never able to discover and add all the appropriate domain names into the trusted zones list in order to get eBay's seller wizard to function correctly.

Shortcomings in the browsers

IE doesn't win any awards for making the secure zone browsing easy and manageable. Normally IE will display the zone(s) that are currently used in the lower left corner, making it somewhat easy to see if you are in a trusted or Internet zone (see previous graphic above, left). Things start to break down when multiple zones are in use at once, leading to a 'Unknown Zone (Mixed)' label. Unfortunately IE provides no way to figure out what domains (particularly the untrusted ones) exist that trigger the mixed zone classification--and double-clicking on the mixed zone message (the only operation it supports) merely calls up the security zone configuration dialog. Kudos for IE for making the configuration dialog directly accessible, but we still don't know what to adjust (i.e. what domains to add to the trusted list). So IE gives some indication of the problem, but hides the necessary details from the user in order to correct it. The graphic below shows what happens in IE.
What happens when you double-click the zone message in IE

Recommendations for websites

If you're designing/implementing a web site, there are a lot of things you should do to ensure you are not encouraging bad security habits from your users. The evident recommendations from the previously-identified issues:

* Aggregate everything under one domain name, so a single wildcard will cover all hosts necessary to utilize your web site; adjust agreements with third parties to use "thirdparty.yourdomain.com" instead of "yourname.thirdparty.com" URLs
* If a form/process utilizes offsite processing, you should alert the user before they start the process, and list the exact domains that will be encountered so they can be configured into the trusted zone correctly; screenshot examples of how to get to the security zone configuration dialog, and a list of what to add, would be ideal
* All anchor tags should have an href; you can still have onclick() handlers, but at least degrade gracefully and have a normal link to the most appropriate location if Javascript is disabled
* Use meta refresh tags, if possible, when you need page-level redirection
* Separate your CSS and Javascript; make sure CSS is still available even when Javascript is disabled
* If you're using dynamic Javascript menus or Flash menus, be sure to gracefully degrade to a normal HTML menu, and/or provide a text menu version at the bottom of the page; this has always been an issue for accessibility reasons, and recent legal movements may have ADA requirements reaching online web sites too
* Above all else, if your page must absolutely require Javascript, then alert the user to this fact and guide them to how to add the site to the trusted zone (rather than how to enable Javascript in the Internet zone...that would be bad); also, include a link to continue what they were doing/where they were going on that same alert page so they can continue where they left off after they enable Javascript

Possible changes in web browsers

This is going to be less actionable list of suggestions, since it's doubtful that browser vendors will wander across this list and actually implement them. But for thoroughness's sake, I thought I'd throw them out there.

First, provide a usable guide to easily add the necessary domains/configuration when the site is in the untrusted/Internet zone. In IE, for example, the best you get right now is double-clicking on the zone status message (Internet, Trusted, or Unknown/Mixed) to pull up the zone configuration dialog. At least IE 7, compared to it's older kin, auto-populates the site's domain name into the site URL box when you open up the trusted sites list...that's a nice step. But what would be even nicer would be a popup list of the domains for a given page, the associated zone, and the ability to immediately add the zone to the trusted list. So when there is an Unknown/Mixed zone message, clicking on it should give the user enough info and choices to immediately remedy the problem (by adding the missing domain name to the trusted zone list). A mock-up of what I mean is displayed below (it assumes the user was browsing at www.site.com and got a mixed zone result). Whether the dialog is a tooltip-type popup or a separate floating dialog doesn't matter--all that matters is that it should be accessible via the zone status message on the browser status bar.
Better zone management popup menu

The second possible change is a bit far-fetched and has to do with combating phishing attacks specifically. A common phishing attack is to harvest the usernames and passwords of a given site; an attack typically poses a fake login form of some well-known web site (MySpace, eBay, Bank Of America, etc.) that is convincing enough to users to trick them into entering their credentials. The fact that such attacks are currently succeeding means people aren't using browser security zones, or are ignoring them, since the facade login forms will definitely not trigger Trusted zone status (and the corresponding status message in the browser's status bar). So what's needed is a way to prevent such logins when they aren't in the correct trusted zone--and that's the solution.

User logins typically involve a username and a password/PIN. In HTML, the password/PIN uses a password input type; this causes some dots/asterisks to appear as a user types in their password, rather than the actual password. The concept of hiding a typed password is not new--it's used to prevent shoulder surfing (looking at someone's password over their shoulder as they type it). Now, if something is important enough to warrant the use of a password input box, then it's a feasible assumption to say that it must be security-sensitive to some degree, and because of that, it should only be given to trusted web sites. And if that password input box is not being sent to a trusted site, well, then something fishy is going on...after all, why would the user want to send a security-sensitive password to a site they don't trust? Thus the recommended browser change: warn/stop a user from submitting a form which contains a password input type if the form action is submitted to a non-trusted site. Require the user to explicitly trust the site that receives the password (by having the site's domain listed in the Trusted sites list). If the site is not already trusted , then pop up enough warning dialogs to get them to understand that they are sending their password to an untrusted site...which could help expose phishing attacks. Most browsers already implement this feature when an HTTPS submission redirects to a non-secure HTTP location--this would be nearly identical, except the browser alerts when data is going to a non-trusted web site rather than a non-secure (i.e. non-HTTPS) web site. Sure, users could still ignore this feature, or phishers could use regular input boxes instead of the password input boxes, but at least in both cases something will be drastically different and could serve to warn the user.

As great as security zones are, they are not the final solution. Since security zones are domain-based, there are problems when you only want to trust a small part of a much larger web site. This can be problematic for multi-user web systems, such as forums, blogs, etc. By trusting a host in order to access your blog, you are also trusting the content of everyone else's blog on the system. Thus you are not only trusting the system, but all users of the system as well; an attacker capable of compromising one user account and uploading malicious Javascript content will have the Javascript execute within a trusted zone (assuming you wander across that page).

In the end, there still is no perfect web browser security solution that is people-proof...which is why every little bit helps. So if web sites and browser vendors pitched in a little bit, we just might be a little better off in this ongoing cat-and-mouse dance between normal users and phishers/attackers.

Surf safely!

Flock Browser Terlengkap Untuk Blogger

noreply@blogger.com (SPiRiT) — Tue, 11 Aug 2009 18:53:00 +0000

Baru nemu lagi nih. Sebuah browser “pintar” yang memiliki fasilitas selain pembuka situs, bisa juga mengupload foto, video, bahkan menulis dan mempublikasikan artikel ke blog. Menarik, bukan? Kali ini, saya akan mencobanya untuk mengupload artikel. Artikel ini tentu saja.:)
Caranya sebagai berikut.

Klik Post to My Blog.

Klik Setup Account.

Pilih blog milik Anda, misalnya: Blogger.

Login ke akun Anda.

Klik Create a new blog post.

Akan keluar jendela posting. Tinggal diisi, lalu klik Publish jika sudah siap dipublikasikan.

Hebat, ya? Kalau Anda susah menginstal Windows Live Writer, aplikasi ini sangat bermanfaat.

Jika sudah membuat akun, tidak perlu lagi membuatnya jika ingin mempublikasikan artikel lagi di kemudian hari. Cukup klik Post to My Blog, jendela posting akan langsung ke luar.

Kalau Anda ingin mencobanya, silakan klik di sini untuk mendownload browser tersebut

Kasasi Prita Telah Didaftarkan

noreply@blogger.com (SPiRiT) — Mon, 10 Aug 2009 16:04:00 +0000

Kasasi Prita Mulyasari yang diperkarakan atas pencemaran nama baik
akhirnya didaftarkan di Pengadilan Negeri Tangerang, Banten. Pengajuan
Kasasi terkait putusan Pengadilan Tinggi Banten yang menerima verzet
(perlawanan) yang diajukan jaksa.

"Kita tadi sudah daftarkan
kasasi Prita melalui PN Tangerang," kata kuasa hukum Prita, Slamet
Yuwono saat dihubungi detikcom, Senin (10/8/2009).

Kasasi
Prita diajukan tim kuasa hukum karena putusan Pengadilan Tinggi Banten
membuatnya kembali bersidang. Seperti diberitakan detikcom sebelumnya, memori kasasi diserahkan kuasa hukum pada pukul 10.00 WIB.

"Kita akan serahkan pukul 10.00 WIB, kita minta keadilan ke MA," jelas Slamet saat dihubungi kemarin, Minggu (9/8/2009).

Kasasi, menurut Slamet, dengan harapan agar sidang Prita dapat ditunda.
Pihaknya yakin, Ibu dua orang anak tersebut tidak bisa dijerat dengan
UU Informasi dan Teknologi yang selama ini didakwakan.

"Kami berharap sidang ditunda dulu sampai ada putusan dari Mahkamah Agung," pungkasnya.

Blogged with the Flock Browser

Live is Grace

noreply@blogger.com (SPiRiT) — Wed, 17 Dec 2008 07:18:00 +0000

Hidup tuch kasih karunia
Kadang kita tidak menyadari hidup tuch berharga, kadang hanya karena masalah sepele kita tidak mao hidup lagi, so what?Betapa banyak orang ingin hidup but coz something they can't live much long time... so? jgn siakan2 hidup anda... Sering x byk org berkata : saya tidak mao hidup lagi.. sesungguhnya mereka tidak pernah serius dengan perkataan mrk, pernahkah berpikir setelah mati.. Kita nich kemana? byk org tidak percaya neraka tuch tempat yang mengerikan... but percaya tidak percaya... PERCAYALAH, neraka tuch tempat paling mengerikan yang tidak ingin kalian kunjungi apalagi hidup disana selama-lamanya... So, mao dibawa kemana hidup kita?Kita sendiri yang menentukan.. But only one way to out from hell... Come To Jesus Christ.. Open your heart n call his name

Ada satu lagu yang bener2 menggambarkan seperti apa sich hidup kita... so guyz n girl

Hidupmu berharga bagi Allah..
Tiada yang tak berkenan dihadapan-Nya..
Dia ciptakan kau s'turut gambarnya..
Sungguh terlalu indah kau bagi Dia..
Dia berikan kasih-Nya bagi kita..
Dia t'lah relakan segala-galanya..
Dia disalib tuk tebus dosa kita..
Karna hidupmu sangatlah berharga..
Bulu yang terkulai ..
Takkan dipatahkan-Nya..
Dia kan jadikan indah..
Sungguh lebih berharga..
Sumbu yang t'lah pudar..
Takkan dipadamkan-Nya..
Dia kan jadikan indah untuk kemuliaan-Nya..

Wahh... lagu nich merhema sekali..

1st Time To Blog

noreply@blogger.com (SPiRiT) — Wed, 17 Dec 2008 07:13:00 +0000

Sebenar na da lama pengen buat blog..
tp nda tau knp koq ga jadi2...
But this time the 1st d...
Blog nich isi na sama seperti judul na : just share...
Mao share apa ? masih lom tau hahaha...
tp yo wes d belajar ngeblog dolo ar...

Met nikmati blog ni, biar blog nich blessed u :)