cf.Objective

Speaking at cf.Objective

Twitter

Twitter is resting...

Recommended Books

Blog

CF.Objective Recap

CF.Objective is over, I'm at the airport waiting for my flight home (and hoping that this "tornado warning" doesn't affect things too much...yikes!). I've finished posting my notes from all the presentations I attended; hopefully some of you find those useful.

Overall CF.Objective was a huge success for me. Being a consultant, I'm always somewhat tweaked when I have to shell out money for a hotel, flights, and a conference pass. The money adds up quickly! But as always, as the conference ended, I was quite happy I spent the money! Most everyone I spoke to said they had an absolute great time at the conference, and found it worth the investment. I completely agree.

Some general thoughts on the conference...

Matt Gifford / Ray Camden's deep-dive into PhoneGap! Ray was originally scheduled to give this talk but had to fly home early, unexpectedly, so Matt stepped in to give the presentation instead. It did not show! If Matt hadn't said anything, I would have believed it was he who wrote the slide deck and put together the presentation. A great high/medium level look into the various facets of PhoneGap.

Dan Vega's presentation on Bootstrap had the best slide deck of all the talks I attended. The trend lately is to make the slide decks more humorous, and not contain so many talking points / bullets that just get read aloud. While Dan's slides very much WERE those things, they were formatted in a way that I felt really added value to the talk. The code samples and other info was very well presented and complimented Dan's presentation nicely.

The new hotel seemed to work really well, and the staff are incredibly helpful. Once or twice it showed that they weren't very technical, and didn't quite understand what location I was asking for, leading me into the wrong room. I approached one staff person and said "I was told the CFML Open Summit was in the room behind the bar, correct?", to which his response was "The Adobe thing? Yes, that's over here"...and ended up walking me into an closed-door meeting by accident. Ooops! But that was definitely the exception; staff were consciously looking for attendees that needed help, offering assistance, and were extremely friendly at all times.

I wish I'd discovered that there were roller coasters in the Mall Of America (walking distance from the conference!) sooner. That was fun. :)

I really wanted to attend the Angular talk, but must have missed the mention that the timeslot was changed for that session. On a semi-related note, it would have been nice to have the deep-dives scheduled after the 1-hour sessions (for ex: put Dan Vega's talk on Bootstrap earlier in the week, then have Kurt's Bootstrap/Angular talk on Saturday) but I'm sure it's not always possible to do such things, as many people are flying in/out at different times.

Speaking of flying in/out, why wasn't anyone from Adobe at the Closing Remarks? Why leave "the only ColdFusion conference" early if you are indeed trying to show that you still support ColdFusion? It was various things like this that caused a lot of comments by the attendees about what Adobe truly is/isn't planning for the future.

Though Adobe did also take CFO as the opportunity to announce the CF Summit, a ColdFusion conference happening this October in Las Vegas! I truly hope this conference is a huge success. I hope Adobe realizes that (especially because Max now conflicts with CFO, and there is no longer a ColdFusion UnConference at Max) that a CF "conference" should NOT be just a show-and-tell sales pitch about CF. People taking time out of their lives to fly to a conference need more than that as a return on their investment. And that probably means making sure Railo can participate in the conference as well.

Speaking of Railo, I love that both they and Adobe were able to have general sessions. It was incredibly informative seeing how the 2 companies are approaching their next versions of ColdFusion. Railo is coming at it from the perspective of "what language features can we add to make developers more productive?" whereas Adobe is (at least presently) going with the mindset of "what will make managing a team of developers/servers easier?" Both have their place, but at a conference for CF developers, I think the Railo approach may have yielded better results.

On a totally different note, it was good to see several friends again. Given some scheduling issues (I'm on vacation the week of NC Dev Con and can't attend that this year) CFO was my only chance this year to chat in person with many folks. It was great talking again with the likes of Scott Stroz, Rob Brooks Bilson, Ben Nadel (though I didn't get a chance to take a picture with him!), Jason Dean, and so on (in my sleep-deprived state, I know I'm forgetting many of you). I met several new people, made some new friends, and was happy to meet several folks that have an abundance of ColdFusion projects on their calendars these days!

Last but not least, a huge thank you to all of the CFO staff, CAB, presenters, etc. Several of the CFO team were sick this year (to the point where some could barely talk) but the conference still ran without a hitch, which just goes to show how hard everyone was working, and how well organized everything was.

Now, I just need to get home, regroup, and figure out a way to put all the things I learned to good use. :)

-nolan

CFObjective Notes: Responsive Apps using Bootstrap 2.0 - Dan Vega

Responsive Apps using Bootstrap 2.0 - Dan Vega

(I didn't take a ton of notes on this preso. Dan's slide deck was SO good, it wasn't really necessary to take a lot of notes, so I eventually stopped and just listened to him talk. At the end of this entry, I have listed the URL for Dan's blog; just go there and get his slide deck, it is extremely well put together.)

Today's web developer
html5, css3, javascript,
server side language
DBMS
NOSQL databases

after we figure out all of that, we have content we have to delivery to a huge variety of devices

mobile traffic will outnumber desktop traffic by 2014

different OS's, and different screen resolutions

NOT considering all those factors is a death sentence

So what is our answer to this problem?
dedicated apps (which sometimes is the right solution, but not in all cases)
device specific apps
Responsive Apps...built w/ Bootstrap

What is Bootstrap?
Scaffolding - to create our layouts, grid systems, fluid grid system, responsive design
Base CSS - typography, tables, forms, buttons, icons
Components - Dozens of reusable components
dropdowns
navbar
breadcrumbs
alerts
progress bars

Documentation is great.
for all skills levels

2 requirements to use it
html5 doctype
include bootstrap.css

starter templates included

Fixed Layout vs Fluid Layout
<div>
or
<div class="container-fliud">

Grid system - to put things on the page.
...inside here is a 12-column grid:

view plain print about
1<div class="row">
2<div class="span4">...</div>
3<div class="span7">...</div>
4<div class="span1">...</div>
5</div>

or to do that w/ fluid grid, do this:
<div class="row-fliud">
that's it!

(Bootstrap 3.0 will have "row-fluid" on by default.)

Responsive Design
uses media quires
modify the width of the column in the grid

Plugins
include bootstrap.min.js
-- gets you ALL the plugins
-- or you can do a custom download to just pick/choose which ones you want.

You can use ALL the plugins thru the API so you can use them all via TAGS, and never have to write a single line of JS code.

Less CSS
Bootstrap is built on LESS
Variables
Mixins
-- like function calls in CSS
...and the way Dan explained it, it actually makes sense!

Preso files will be up on Dan's site later (The slides are GREAT and really informative. )
www.danvega.org/presentations

Google HTML5 Slides are also good (on code.google.com)

CFObjective Notes: GIT: Choosing workflows that make sense - Tim Cunningham

GIT: Choosing workflows that make sense - Tim Cunningham

Git is not a hammer, it's a hardware store
know which tool you need to use.

Everything stored in Git is an "object"

Forking
different than a clone
when you fork it, you're taking the code to do your own thing
not planning to integrate it back into the original place you copied it from

Rebase
different from a merge
takes changes in your current branch that are NOT in the remote branch...
grabs all the changes from others
applies all of them
puts YOUR changes at the END

Cherry Picking
takes a commit and sticks it somewhere else
For those RARE cases when you have to change code in the Master branch, then roll it into the Staging branch later
if you're doing this a LOT, rethink your work flow.

How Git Communicates
http/https
Easy to set up in Linux
Harder in IIS
SSH -- most common setup
-- secure
-- simple in Linux, harder in IIS

or you can just outsource all of that to GitHub

Centralize workflow
simplest
if you're new to Git do this one first
you'll have a Master branch, you pull from Master, do your work, and commit it
This is basically how Google uses Git.

(these work flows are all just by convention, everyone agreeing to work this way. it's not a "feature" you turn on/off in Git)

Feature / Branch Flow
Master = production
create a "feature branch" off of master, do all my work here. if i have a team, EVERYone working on the feature is in that same branch
not a "per developer" thing, it's a "per feature" thing.
deem someone "branch master"
-- creates the branch, tells the team were it is so they know where to write code

The GitHub Flow
will find this one more often than not, if you do a Google search on Git workflows
master branch (permanent)
development branch (permanent)
create feature branches off of development
when features are done, they're merged into Dev
Then take Dev, make a NEW branch for a Release
do your UAT and hot fixes on Release
after testing/fixes are done, merge Release back into Dev and Master

(You don't NEED to fork a project to do a pull request)

Custom workflow
build any work flow that makes sense for your project,
but make sure you understand the principles of Git.

Nothing is Unrecoverable on GitHub
if you overwrote something, it's still there somewhere
it's -extremely- hard to delete something entirely, so it can never be recovered

CFObjective Notes: ColdFusion Builder: IDE to Boost Your Productivity - Elishia Dvorak

ColdFusion Builder: IDE to Boost Your Productivity - Elishia Dvorak

CFB 2.01 focus was performance
2.01 has a bit performance improvement over 2.0
plus CF10 support
-- documentation libraries
-- server config is updated for Tomcat
FTP has new "upload on save" feature

Creating projects
several ways
just create a project in your web root
by default, it choses a folder under the /Builder directory
can "promote" a folder that's not a project, TO a CFB project
need to apply a "CF Nature" so you can attach a CF server to that folder

Setting up a project...

Server Settings Popup
"Application Server" setting, can pick between JRun or Tomcat (new w/ CF10)

Don't enable RDS in a Production server
(??? since Production are the only boxes that need a serial #, can we somehow make it so that if you HAVE specified a serial # and marked a box as "Production", that it auto-disables RDS? and then if i really WANT to undo that, i have to jump thru some hoops, so no one does it accidentally?)

Pick "dictionary" first (cf9, 10, etc)
then pick the server i connect to after that
???? -- if we flipped those...and picked a CF server first, couldn't that auto-pick the correct dictionary? based on what CF version that server is running?
that'd shave a little config off the "new project" process

For debugging... on CF server, need to turn on:
1. RDS Debugging
2. Line Debugging

Remote debugging
just slightly different than local debugging

To set a breakpoint, remember to click to the LEFT of the line-numbers, clicking to the right won't do anything.

Cyclic Code Assist
ctrl-space once = list of all the available variables/scopes
ctrl-space 2 times = list of all the methods available
..and it will keep going, giving you options for whatever is available at that point in your code

Really revamped all the Code Assist functionality
ORM Code Assist, for browsing files/dirs, relevant tags, etc.

Q: "how many people are using extension?"
...NO hands went up!

All the builder extensions are available on www.riaforge.org

Every version of CFB becomes more and more reliant on CF server
CF11 and CFB will be released together (tho technically she called them "Thunder" and "Splendor"). :)

CFObjective Notes: Mobile but Secure - Bilal Soylu

Mobile but Secure - Bilal Soylu

Insecure Data Storage
we have all these files for storage - sql lite database, log files, xml, cookie stores, etc
how sure am i that NO other application can read it?
confidentially of data is lost
Credentials disclosed
if i have a mobile version of something on my desktop, they should NOT use the same credentials. don't want someone hacking the mobile app to be able to break into the web app too
caches can be read too
if you have to store stuff, store it in the right way, in the right place
use the right kind of encryption
assign permissions to the files that your app generates

Weak Server Side Controls
all the pipes to the back end need to be secure
trust needs to be established
Autenticate, Authorize, Type, and Content

Know Your Basics
OWASP Top 10 list changed in 2013
injection
broken auth and sees
xss
insecure direct object refs
security misconfigs
sensitive data exposure
etc, etc

Thoughts
so you THINK you know all the stuff, you've read the blogs, etc.
we're still trying to learn today how mobile fits into everything

Common API Pattern (bad)
REST API
call comes in via REST, you authenticate and validate, and can request whatever you want
now i do the SOAP api on top, do i do the same thing on top?
now a socket on top of that
...and now i have THREE areas people can attack me thru

Improved Surface Attack
think about a channel as kind of a "transport layer" into our app
normalize the layers
regardless of how the data came in, normalize what goes into your system
then i have ONE service layer to secure, instead of 3 or 4 different ones
REST may be good for convenience, but maybe not good for minimizing attack surfaces
easier to control "1 door" than "many doors"

Insufficient Transport Layer Protection
transporting things OUTside of https isn't a good idea
many transports combine plain text with sensitive data
poor planning about security
ignore errors
-- certificate warnings and expirations

at the airport, make your laptop a hotspot
name it the SAME as the airport wifi
then install Charles
and bam...can sniff everyone's connections. they'll all connect to YOU instead of the real airport wifi. people don't think about this when connecting to wifi

Impact
when you have sensitive data, use SSL
in your mobile app you should "question your connections"
don't ignore errors
even tho it's painful, let's make the app "right"
make sure the servers we're hitting are proper, don't use self-signed certs in Production, etc.

Client Side Injection
Our old friends -- XSS and XHTML injections
SQL injections
normally in XSS the intent is to hit some other user
still may be the case in your mobile apps.

XSS new target is your device
target is not the server but the app running on the client

Mitigation
how can we get better?
sanitize or escape all inputs
once data has left the server, never ever ever trust it
white lists are good techniques
we aware of the inputs you use
if i'm expecting GPS input, does the data LOOK like GPS input?

XSS via HTML5 forms
HTML5 is cool, but makes some exploits easier
new form elements
form action can be exploited, in banner ads, etc.

XSS via HTML5
check 3rd party code that you display
use reliable partners
the "form action" thing was supposed to be an HTML5 -feature- but features can be exploited too.

how long do people use your application if it's not convenient?
need to strike a balance in convenience and security

multi-factor author is a good idea
out of band does not work if everything is on the same device
if i have a man in the middle attack on my phone, then logging in and calling my phone for auth doesn't solve anything -- it's all the same channel, it's not "OUT of bound"

Improper session handling
difference in sessions on mobile / desktop
sessions on mobile are much LONGER
which increases the chances for it to be insecure

Don't use Device IDs

sometimes you have to ask for re-authentication
-- set expirations for use
build active revocation into your sessions so stolen devices can quickly be disabled
use proper token generation techniques
build a way to DISABLE sessions into your apps

Security Decisions via Untrusted Inputs
some mobile apps introduce extra features, can be invoked by URL schemes,
if I can use the Skype protocol via URL, could i make a phone call just by building that URL?
so i could have an app that just makes phone calls or sends text....without consent!

Side Channel Data Leakage
Don't log credentials or sensitive data
remove sensitive data and screenshots
if you have debug libraries in your app, what are they doing?
review 3rd party libraries
-- what data do they use / transmit
are you taking screenshots with Weinre? With passwords in the screenshots? Or other sensitive data?
remember to delete those screenshtos when you don't need them any more, so they're not on the device for other apps to see and exploit

Apple and iOS - when they started logging where people were in GPS, that data went into a log file. Irritated a LOT of people.

Broken Cryptography
Encoding, Obfuscation and Serialization are NOT encryption
broken encryption = you used short keys rather than proper length keys,, etc. stuff that can be easily bypassed.
do not store keys on the same media you use them on
-- storing the key WITH the encrypted data...bad idea
use proven cryptography libs (don't write your own. it's hard).
-- there are enough libraries out there that do it RIGHT
take advantage of platform libs if possible

Sensitive Information Disclosure

don't store sensitive info on devices
don't transfer them TO the device either
never hardcode passwords
don't store passwords in code -- that's plain text!

Indicating Trust Within Your Code

Keep current with updates
so you're not as easy of a target

Stay vigilant!

Resources:
OWASP www.owasp.org
Security Vendors - Symantec, etc

More Entries

Search

Recent Comments

CFObjective Notes - Mobile Debugging Tips and Tricks, Ray Camden
Raymond Camden said: That makes perfect sense. Ok, I'll try to add that. Thanks! [More]

CFObjective Notes - Mobile Debugging Tips and Tricks, Ray Camden
Nolan Erck said: Hi Ray, The only thing I can think of is (and this is just a... [More]

CFObjective Notes: Errors Are Best When Emailed Said Nobody Ever - Adam Tuttle
Nolan Erck said: No idea, not much time was spent discussing Hoth. Most of th... [More]

CFObjective Notes - Mobile Debugging Tips and Tricks, Ray Camden
Raymond Camden said: That makes perfect sense. Ok, I'll try to add that. Thanks! [More]

CFObjective Notes - Mobile Debugging Tips and Tricks, Ray Camden
Nolan Erck said: Hi Ray, The only thing I can think of is (and this is just a... [More]

CFObjective Notes: Errors Are Best When Emailed Said Nobody Ever - Adam Tuttle
Nolan Erck said: No idea, not much time was spent discussing Hoth. Most of th... [More]



BlogCFC was created by Raymond Camden. This blog is running version 5.9.7. Contact Blog Owner