OWASP and ADFS 2.0 - asp.net

Is there a security resource / Blog post which demonstrates the goodness of ADFS 2.0(or general SSO) with the OWASP - Top 10 list of vulnerabilities?
There are few good resources for ASP .NET (the best one from Troy Hunt). But none of them speaks about ADFS 2.0. Is there any value add with ADFS 2.0 w.r.t to OWASP (Definitely there are !!) ? A constructive discussion will also be appreciated.

Your best bet is to talk to Gunnar Peterson (search for 1raindrop). He's the SSO/SAML go to guy. Troy is also good value and is definitely aligned with the Microsoft stack.
The Top 10 methodology is about what researchers found the year prior to publication (so OWASP Top 10 2007 was a summary of 2006 weaknesses). For better or worse, researchers don't often come across enterprise applications, stacks or core technologies, such as ADFS. Those that do are paid to look at them, and unfortunately, that usually entails a NDA.
A better approach is the one I'm adopting for the Application Security Verification Standard, and the OWASP Developer Guide - is to provide builders with building assistance, so a positive, verifiable set of steps you should take to protect yourself.
The Top 10 is a great education piece to get discussions started, but as I wrote in the introduction to the Top 10 2007, The Top 10 2007 (and all of them really) are not standards! Do not use them as such.
Jim Manico is working on a cheat sheet series with a zillion authors. If you have an interest in contributing to OWASP, maybe consider an ADFS or SSO cheat sheet?
thanks,
Andrew

Related

Best Technology suited for building E-Commerce Applications and the review on Supported Frameworks

This may appear as a subjective question but i am asking from an technical architect point of view.
What would be your choice if you were building E-Commerce based Application to help giant companies carry out their marketing and sales campaigns. I looked into open source frameworks such as Magento that works with ZendFramework using the PHP,MySQL And Apache stack. Other basic frameworks like OSCommerce seem reasonable. Whats the leading E-Commerce framework for .Net Technologies? I also looked into Zoho and it seems like using their applications most of the requirements can be knocked off but I also feel I may face flexibility issues down the line with what they provide.
Please try to mention what architectural benefits do you see in the frameworks you know about. Thanks, as always, and its always great to hear the expert opinions on stackoverflow.
For "Giant companies" your question is formed badly and has no information to actually answer it.
For micro and middle sized companies (10 -500 persons in company) go for Magento EE or Magneto CE version and Magento optimized hosting solution

ASP.NET developer looking to get into SharePoint - 2007 or 2010?

I've been working with ASP.NET for about 5 years now and I'm looking to get into SharePoint development.
Would it make more sense to get up to speed on SP 2007 first or just dive straight into SP 2010?
Seems like learning SP 2007 would give me a better understanding of the "story" and broaden my work opportunities.
What do we think? Is a grasp of SP 2007 a must for any SP developer at this point?
Thanks
Thanks for the helpful and encouraging answers. Seems the unanimous recommendation is to skip SP 2007 and dive straight into SP 2010 as the dev tools are much better, so I'll probably do that :)
As I wrote in a previous answer I think people starting should focus on 2010. Depending on your work situation, it may limit you in the types of contract jobs you can take, but the development environment is significantly better in 2010. The only reason to start with 2007 is so you can appreciate how much easier 2010 makes it :)
SharePoint 2010 is a completely new architecture and is fundamentally different in many ways. For example, SharePoint Services Provider is no more and the sandbox has been added.
I started with 2007 because that's where we are at work. I think the version being used in your workplace should dictate your decision (unless you're a consultant).
IMHO, starting with SP 2010 would be easier - the support for SP 2010 development comes built in with VS 2010.
I don't think you would gain that much from starting with SharePoint 2007. As the others have said, the development environment with 2010 is much friendlier and doesn't require as many 3rd party tools.
More importantly though, the object model is almost the same. While it is true that SharePoint Service Provider is gone, it is not something that you play with a lot when you develop (in my experience anyway). The important objects and concepts (content types, web parts, lists, list items, etc.) are pretty much the same, which is why I don't think there is much of a "story" to get.
Make your life easier and go with 2010.
SharePoint 2010 is a much easier way to start as others have already suggested. From an analogy perspective, there isn't a lot reason today to learn COM+ programming for instance. You can work with .NET and be happy most of the times.
A couple of real good resources that would help you bring up to speed with SharePoint 2010 are listed below...
http://technet.microsoft.com/en-us/sharepoint/ee518660.aspx
http://technet.microsoft.com/hi-in/sharepoint/ff420396(en-us).aspx

Building Enterprise level Line of Business application in silverlight Pros and Cons

Currently i am working on developing one Warehouse solution from scratch, i am planning to build it in silverlight (as this solution will take around 8-10 months) and the programming will start from Feb 2010.
I need to develop this application for one organization. Certain parts needs to be accessed by public which we are planning to build in ASP .Net 3.5
Now i just wanted to start a thread here for pros and cons of using silverlight, some of them i have already analyzed
Pros :
Rich UI
Excellent user experience
Reduction of scalability concerns
New set of features like data binding, control template etc..
Speed of development (After initial learning curve..my experience says it is faster to develop it in silverlight)
Other rich set of features coming up with SL 4.0 (SL 4.0)
Cons :
Cross platform issues (moonlight is there but it may take some time)
Cross browser issues (Chrome or other browsers)
Learning curve
Any other unknown risk (As there are not many enterprise level application developed in silverlight...or may be i am not aware)
I have also got one link for Pros and cons of silverlight(here) some of the cons might not be relevant with SL 4.0
Also i am having one good link for comparison between ASP .Net Ajax with Silverlight (here)
EDIT :
I have also found Technical Article series in code project (Just Type # google "Adventures while building a Silverlight Enterprise application" and you will get it, i am trying to analyze this series as well)
Please add some pros and cons if you find as i am trying to analyze it from all the angles. It will be of great help if you find any whitepaper on it.
The Pros and Cons have to be weighed against your own requirements.
Rich UI
Compared to what? Its not really a Pro, other tools can deliver Rich UI, where does one draw the line that allows a UI to call itself Rich? A Pro can't be a Pro if can't be measured.
Excellent User Experience
That isn't a Pro either. I wish I could buy product that delvers such a thing out of the box. The reality is it's up to you to deliver the UX. E.g. Stackoverflow delivers an excellent user experience, it doesn't use a tool like SL and it's entirely down to good design not the tool (ASP.NET-MVC+various other tools).
Reduction of Scalability Concerns
Compared to what? Early ASP.NET Forms with extensive use of callbacks then yes. However plain old HTML with Javascript frameworks can deliver this same "Pro".
Speed of Development
Well that depends on how you measure speed and how you weigh the importance of the UX. Currently SL developement isn't any better at ticking off business function points than other tech like poor old ASP.NET Forms and is probably worse. However delivering those same function points with a slick, imaginative UI may tip the balance more in WPF/SL's way. In reality SL allows you deliver more UX with some (but importantly not prohibative) extra effort.
Other Rich Features in SL4
Only a Pro if they would actually add value to your requirement.
Cross Platform
Do you really have a Cross Platform requirement? Within a warehouse business how many Linux and Mac desktops are there? That should answer your cross platform question.
Cross Browser
Is this a Con? Does the company in question allow the use of a variety of browsers? If so which? You can compare that to the browsers SL4 supports and out pops your answer but its your answer not everyones answer. Isn't cross-browser a bigger concern for the Extranet-esq part of the app?
Learning Curve
In all of these factors what are you already versed in is by far and away the most important. I'm guessing its MS tools and in particular .NET, right?
If you're not familiar with WPF already there is some learning curve but its not very steep. However you should definitely make sure you take the time to perform some training projects before you even start designing your real product. That process should help you measure how long it will really take and whether it is really feasable.
Other Known Risks
SL is still very young and it won't sit still. Frustrating "issues" will eat time.
Other questions to ponder
What UX ideas do you have that can't be delivered by a browser?
Why deliver the app via a browser hosted app at all? A WPF application not an option?
Silverlight 4
Considering your timescales if you do choose Silverlight you should target SL4.
Since you are developing solution for the warehouse, you may need consider building a web service with wcf pollDuplex (basically push data from server to the client periodically), just a note on it: it is not (yet) a very scalable and reliable (prior to SL4). Default concurrent connection is 10 (if I remember well), and you have the option to overwrite this default number, however, I haven't find a way to dynamically change this number which turns out to be a scalability issue.
One cool feature I like about SL 4 is the added support of printing, now you have the built-in ability to print the content.
Anyone bulding an Enterprise LOB with a Silverlight client should take a look at John Papa's PDC video.
However, IMHO the initial release of RIA Services was too limited. Now that the next version is buit on top of WCF Services, and the endpoints can be switched out to make them more accessible by more UI clients RIA Service is probably a very sensible investment too.

Silverlight Install Base - How big is it?

Silverlight v2.0 is getting closer and closer to RTM but I have yet to hear any stats as to how many browsers are running Silverlight. If I ask Adobe (by googling "Flash install base") they're only too happy to tell me that 97.7% of browsers are running Flash player 9 or better.
Not that I believe everything I read, but where are these statistics from Microsoft or some other vendor about Silverlight? I'm going to be making a technology choice soon and a little bit of empirical evidence would be an asset at this point...
All you Silverlight developers out there, show me your stats!
Quick Answer: www.riastats.com
This site compares the different RIA plugins using graphical charts and graphs.
It gets its data from small snippets of javascripts running on sites accross the web (approx 400,000 last time I looked)
At the time of this post, Silverlight 2 was sitting at close to 11%.
I would not take this as the end-all, be-all in RIA stats, but it's the best site I've found so far.
If you are developing something for a general audience, I would highly recommend against Silverlight as you immediately cut out Linux users.
I went to watch videos for the Olympics (and I run exclusively Linux), and I couldn't watch the video on their site because they were in Silverlight. On top of that, they actively removed all videos from YouTube, so I had no alternative but to try and scrounge up a Windows boot. This only served to give me a very negative opinion of NBC, and consider them quite amateurish to pick such a restricting technology for something that should be available for everyone.
While Flash has it's problems, it works fine in Linux, so I would say (at this point), it is a much superior technology choice.
If you KNOW your audience is entirely on Windows (maybe Mac).... then you can consider Silverlight with knowing you won't be cutting out part of your audience.
if you're that concerned about locking out potential users, you should be building a low-bandwidth HTML only version of your site anyways...regardless of whether you use Flash or Silverlight.
I struggled with this for a while. Ultimately, I chose to develop my site using Silverlight for the major components. I did a good bit of research, and I reached the following bottom-line conclusion:
If Silverlight fails, it will not
be for lack of installed base. There
are simply too many levers for MS to
pull (windows update, embedding it in
IE8, or even paying highly trafficed
sites to use it.
I will add this from Alexa - microsoft.com has pretty impressive daily reach and it uses SL on the main page. I would also not be surprised at all if Outlook Web Access is moved to Silverlight - thereby turning every single office outlook user who wants to access email from home/other into a roaming SL installer.
Alexa Link comparing microsoft.com/ebay.com/amazon.com
I will add this from ScottGu's blog entry:
In addition to powering the Olympics
experience in the US, Silverlight was
also used in France (by FranceTV), the
Netherlands (by NOS), Russia (by
Sportbox.ru) and Italy (by RAI). In
addition to video quality, a big
reason behind these broadcasters
decision to use Silverlight was the
TCO and streaming cost difference
Silverlight provided. In the August
2008 edition of Web Designer Magazine
(a Dutch publication) a NOS
representative reported that they were
able to serve 100,000 concurrent users
using Silverlight and 40 Windows Media
Servers, whereas it would have
required 270 servers if they had used
Flash Media Servers.
Over the last month we've seen several
major new deployments of Silverlight
for media scenarios. For example: CBS
College Sports is now using
Silverlight to stream NCAA events from
its 170 partner colleges and
university. Blockbuster is replacing
Flash with Silverlight for its
MovieLink application. And Netflix two
weeks ago rolled out its new Instant
Watch service using Silverlight.
At the 2009 Microsoft Professional Developers Conference, Scott Guthrie said that Silverlight was installed on "45% of the world's Internet-connected devices"
http://www.betanews.com/article/PDC-2009-Live-from-the-Day-2-keynote/1258561992 (quote taken from "9:28am PT") entry
This was the weekly poll over on CP a few weeks back. Out of the 1463 developers responding, aprox. 62% had Silverlight installed on at least one system.
So... if you're making a site targeted at Windows developers... and don't mind locking out a third of your potential market...
I haven't been able to get stats. I'd assume they might release some at PDC in late October. If you're building a site which needs to target a non-developer audience who won't want to install another plugin, you might want to wait for Silverlight.
I have done a good amount of testing with Moonlight on Linux, and it works well for sites which use either use Silverlight 1.0 functionality (pretty much 100% supported) or which happen to use the Silverlight 2.0 bits which Moonlight currently supports. The caveat is that some websites explicitly check the user agent and won't offer content if you're not on a "supported" platform. That's poor website coding, not a fault of the Silverlight plugin.
During the keynote # ReMIX UK when ScottGu gave the figure of 1.5 million installs/day I was sat next to Andrew Shorten, one of the Adobe platform evangelists (and also a good chum). He was telling me Adobe have independant evidence of an AVERAGE of 12 million installs a day, with over 40 million downloads.
It would appear 1.5 million is a tiny amount of what it could be.
Well 6 million watched the Olympics on NBC, which used a silverlight player. So at least 6 million. I've never seen exact stats, but you can be pretty certain that it is pretty small still.
Also, there is an implementation of silverlight for linux called moonlight.
I think an interesting stat comes from this site itself. Have a look at how many silverlight questions there are! And how many responses - it's not the most active topic!
I think you'll see a dramatic increase in the Silverlight install base after Silverlight 2.0 officially comes out. Right now it's still in beta. Silverlight 1.0 is out and runs quite well from what I've seen in Moonlight on Linux, but it's much harder to create full-scale applications for than version 2.0. According to Microsoft, Moonlight will be "100% compatible" at release time. See Scott Guthrie's blog (note: 2.0 was called 1.1 at the time).
Nick R, as for the fact that there isn't much Silverlight activity on these forums, I think the biggest reason for that is the very active community on the silverlight.net forums.
Scott Guthrie said (at Remix UK Sept 18 2008) that Silverlight is currently downloaded 1.5 million times per day. Over 115 million downloads since the version 1 release.
The Version 1 installed base will automatically update to version 2 when it is out of beta.
Wow! Scott said the same thing at Mix in February 08 about run rate - 1.5m. So it seems that a daily run rate of 1.5m per day for 6 months would add 270m installs to the installed base. So their numbers are not exactly clear in their meaning.
If one assumes the 115m installed base is correct, then it implies a run rate around 700k per day in the six months since SL2. Of course, many users are upgrading versions B1 to B2 as an example.
Either way, it is gaining some steady installs. It would be nice to see the run rate improve. By 2nd quarter of next year, it should be dramatically higher due to v2 shipment, application/web site adoption, pre-installation on various computers (like HP) and any unannounced distribution mechanisms.
While in general I support the idea of developing a site using silverlight and feel that that, depending on your audience, you should not have too much trouble getting users to download the plug in I would caution you against assuming that Microsoft will release the plugin built into IE or as a part of windows update.
I have had two separate Microsoft Technology Evangelists tell me that the company is reluctant to do that due to Anti-Trust reasons.
This was over a year ago and their strategy has probably evolved since then, but it enough to make me not count on that as an option for greater market penetration.
Don't forget that the Silverlight 2 install base will never include PPC Mac users. It doesn't look like the Moonlight people are targetting them at all, despite the heroic effort to add PIC streaming for Silverlight 1.0 users for the Obama inauguration.
The larger question is how many users will your site lose if implemented in Silverlight. And, it very much depends on your audience.
If you're running a site about the joys of Linux kernel hacking or the virtues of Internet security, you'll probably lose a significant chunk of your audience. If you're running a more mainstream site, my experience is that, sadly, people will download anything they're told to most of the time. That's why spyware and malware work. And, as the NBC/Olympics deal shows, Microsoft will aggressively push its partners to use Silverlight until it's fairly ubiquitous.
I won't be using Silverlight until it's more mature because I do cater to a fair number of Linux users, but I might for a less technically-oriented site.

Innovative uses of social networking in a commercial environment

I am looking for some examples of innovative uses of social networking for a purely commercial environment. I can see the uses that Twitter might have for micro blogging for anything (application event logs springs to mind amongst other ideas).
Does anyone have any further examples or ideas they may want to share for ways that we can embed this kind of technology in our infrastructure.
For reference we are are an organisation which uses primarliy Microsoft technology (SharePoint, VS 2008, ASP.Net etc.).
Feel free to reference specific code examples, tutorials or just to make subjective comments on the concept of Social Networking for the business environment.
Sites currently being looked at include: Facebook, Twitter, LinkedIn and Google Maps.
GREAT EXAMPLE here http://brandonhallawards.com/08/958-BLOGS-Sun.doc
by the way, are there any others?
I am also interested.
- Echo
With a little effort, you may use Captcha for Air Force recruiting instead of these old-fashioned color blind cards.
You can even do it online!
Don't forget the very common practice to use IM in corporate settings. It's often much easier than phone or mail, even if it is often not allowed by the IT security staff. Granted, it may not be truly innovative but the subversive factor counts, IMHO.

Resources