Recommendations for security-related QA?

Hey all,

I've been asked to look into how to effectively test our site pages for problems such as SQL injection attacks, cross-site scripting, XSS, etc. So I wanted to put out a call to the LJ knowledge base: who all out there has experience defending against this kind of thing?

Things I want to know:

What tools, open source or otherwise, are good for this kind of testing?

What sources of information can you recommend for learning about how to defend against these attacks?

I know a big part of this will lie with our engineers coding their stuff correctly to begin with, but I want to think of this from the QA standpoint as well--what tests we can run to doublecheck. So if you had to test someone else's code to look for these things, how would you go about it?

Thanks in advance for any enlightenment, folks.

Book Log #37: Bridge of Dreams, by Chaz Brenchley

It's always a little weird reviewing books written by people who are on my Friends list and/or who I know to be reading this journal. However, in this case, I can say with assurance that there will be nothing in this review which should disconcert desperance in the slightest. ;)

Bridge of Dreams is set in the city of Sund, crushed under the might of the city of Maras, whose inhabitants have raised a bridge to cross the river between them--a bridge shaped by magic from the dreams of captured children. The bridge has corrupted the river it spans, and in turn the water-magic of the Sundain--yet the magic still lingers in scattered practitioners, and in a young boy who makes his living as a waterseller on the streets. Issel's magic has been tainted by the Shine, the corruption that the bridge has caused within the river, and he lives in fear of further corruption warping him physically to match the tainting of his gift. Yet his power's a strong one. As he becomes apprentice to one of the last surviving adepts of the Sundain, he begins to learn that he may indeed be the only way that his people can throw off the yoke of their conquerors.

Meanwhile, Jendre, daughter of a Marasi general, becomes the latest wife of the Sultan while her beloved little sister is forced into the ranks of the children whose dreams maintain the bridge. Jendre must contend with the politics of the harem as well as an attempt on her husband's life--and her own illicit love for the son of the pasha, who escorted her to be wed. Through it all, she is determined to somehow find and save her sister.

Water is prominent all throughout this story, and like water, the pacing of it slowly builds: a few scattered trickles at first, then a thin stream, and finally the promise of a shattering tide when the peak of the action is reached. The tales of Issel and Jendre are two separate currents, not yet merging by the end of this story--I'm sure that's to come in the next book, since resolution is not yet achieved at the end of this one. But I will be greatly looking forward to picking up River of the World, and in the meantime, for Bridge of Dreams, four stars.

Eddie Izzard at the Paramount, Friday 7/11/08

A bit belated, this--but as requested, here's my report on the Eddie Izzard show this past Friday, the 11th! In attendance: spazzkat, solarbird, mamishka, and me. We also bumped into tiggymalvern and spoomeister while we were there, too--and in the case of the latter, this was the first time we'd actually met in person, so yay!

Eddie had a fairly casual and butch look going by his standards, but he still looked pretty fabulous with some eyeliner and a very dashing tailed black jacket on over a red striped shirt. And in casual contrast to that, jeans. It was amusing too that he got a standing ovation just by walking out onto the stage (Seattle being pretty easy that way, hee), which took him distinctly aback and prompted him to make a crack about whether he should actually be there.

More importantly, he most definitely brought the Funny. And he was very aware of the nature of the audience he was playing to here in Seattle. There are I suspect few other places in the country where he could have opened the act with ten minutes of looking up Chief Sealth on his iPhone on Wikipedia, and making it work. Complete with side cracks about the iPhone (and asking if anyone in the audience had one of the new ones), being text-messaged by audience members, and the history of Wikipedia ("Founded by Mr. and Mrs. Wikipedia...").

Once he got into the main act, though, it was all about some territory he's covered before in previous shows: the history of Everything, pretty much. He made lots of commentary about the rise of civilization, about religion, and the development of language, all stuff he's milked for fodder before, though for me it was no less funny this time around.

My favorite bits:

Miming his way through a bunch of Neolithic hunters boxing bison, until one of them finally says 'fuck it', picks up a stone, and hits his prey with it.

Vehement insistence that the Romans could not possibly have conquered the known world as successfully as they did with a language like Latin. Included a comparison between the Latin version of a conversation between a messenger and a centurion about the imminent attack of Hannibal (complete with ad-libbed pseudo-German, pseudo-French, and pseudo-Latin), and the much shorter English version.

The entire sequence involving the noises that animals make, and hypothesizing how this must affect how giraffes warn other giraffes about imminent attack: "*coughcough* tiger *cough*". And, how they manage to hide on the plains of Africa: behind other giraffes. Insert obligatory mental image of Eddie miming a hundred giraffes in a line here. ;)

Announcing himself as part of the "Cult of Mac", then proceeding to lament how he has to agree to the License Agreement every time he re-installs iTunes. And how nobody reads these things anyway: "We'll set your grandmother on fire!" "I AGREE! I AGREE!"

Jokes about Galadriel being the mother of Jesus, and how she'd buggered off to the Grey Havens before Jesus went down to Earth. Also, how he noticed that only a few of us in the audience actually got that joke, including Dara and me, over there in our side-section seats laughing hysterically.

Getting in one shameless plug for The Riches, complete with noting that it's streaming on hulu.com. (And yeah, heh, this is me perpetuating the plug.)

ETA 10:07pm: OH YEAH forgot this bit: the bit where Eddie is extremely dubious about frogs as one of the Plagues of Egypt. Locusts, he could buy. Flies, oh yes. But frogs? Not so much. "AAAH! We have MORE FROGS THAN USUAL!"

So, yeah. Mostly familiar stuff to any Eddie fan who's seen his previous performances, particularly Glorious and Dress to Kill. But still highly, highly enjoyable. Worth the ticket price as well as the T-shirt from the swag table!

Jam Report #78--Needs More Brains Edition

In which summer schedules give us a somewhat reduced group, but in which we nevertheless have extremely tasty key lime pie; in which we play "Mari-Mac" faster than Great Big Sea, which is to say, way too damned fast; in which we explore how to up the zombie quotient in a zombie shanty; and in which we throw in some frog lyrics for good measure. Songs: "Chemical Worker's Song (Process Man)", "The Shanty Formerly Known as General Taylor", "The Clockwork Waltz", "Mari-Mac", "Hot Frogs on the Loose", "Pirate Bill and Squidly", "Captain Kidd".

( Read more... )

Next Jam: August 3rd!