Five principles for meaningful meetings

I came across this post, http://www.codinghorror.com/blog/2012/02/meetings-where-work-goes-to-die.html. The author presented five good principles for successful meetings:

1. No meeting should ever be more than an hour, under penalty of death.
   

   The first and most important constraint on any meeting is the most precious imaginable resource at any company: time. If you can't fit your meeting in about an hour, there is something deeply wrong with it, and you should fix that first. Either it involves too many people, the scope of the meeting is too broad, or there's a general lack of focus necessary to keep the meeting on track. I challenge anyone to remember anythingthat happens in a multi-hour meeting. When all else fails, please keep it short!

2. Every meeting should have a clearly defined mission statement.
   

   What's the mission statement of your meeting? Can you define the purpose of your meeting in a single succinct sentence? I hesitate to recommend having an "agenda" and "agenda items" because the word agenda implies a giant, tedious bulleted list of things to cover. Just make sure the purpose of the meeting is clear to everyone; the rest will take care of itself.

3. Do your homework before the meeting.
   

   Since your meeting has a clearly defined mission statement, everyone attending the meeting knows in advance what they need to talk about and share, and has it ready to go before they walk into the room.Right? That's how we can keep the meeting down to an hour. If you haven't done your homework, you shouldn't be in the meeting. If nobody has done their homework, the meeting should be cancelled.

4. Make it optional.
   

   "Mandatory" meetings are a cop-out. Everyone in the meeting should be there because they want to be there, or they need to be there. One sure way to keep yourself accountable for a meeting is to make everyone optional. Imagine holding a meeting that people actually wanted to attend, because it was … useful. Or interesting. Or entertaining. Now make it happen!

5. Summarize to-dos at the end of the meeting.
   

   If your meeting never happened, what would the consequences be? If the honest answer to that is almost nothing, then perhaps your meeting has no reason to exist. Any truly productive meeting causes stuff to happen as a direct result of the decisions made in that meeting. You, as a responsible meeting participant, are responsible for keeping track of what you need to do – and everyone in the room can prove it by summarizing their to-do list for everyone's benefit before they leave the meeting.

However, it is very difficult for number 3 and number 4 to happen in real time. It is too often for some guys showing up at the meeting without bothering to read agenda or do their homework at all. At the same time, there are lots of meetings that you need to have certain people from certain areas to show up, otherwise, nothing can be achieved. In some companies, if meetings are made "optional", people might choose to skip them. The key for the successes of meetings are tied with company culture, which is another tough topic.

Let the meetings begin.

CVE-2012-0053

According to http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0053, protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with crafted web script.

Here is the exploit script from http://downloads.securityfocus.com/vulnerabilities/exploits/51706.js

In this experiment, Apache/2.2.21 windows version was tested. The popular open source project phpMyAdmin was deployed as part of XAMPP.

As shown in this screencopy, the application set three httponly cookies: phpMyAdmin, pma_lang, pma_collation_connection.

Once the exploit script is run, the request contains a couple of generated cookies like this screen copy. 

Since the total length of cookie header exceeds the server limit. This request generated a 400 error on the server. But the response from the server contained those three HttpOnly cookies. This test showed that the server is vulnerable to this security issue.

A JavaScript Obfuscations Contest

There is a JavaScript Obfuscations Contest. It was fun but I did not win the iPad.

Real and useful security help for software developers

Real and useful security help for software developers.

Manual download Flash player

This is frustrating, you want to download Flash player from adobe. You google and find a page http://get.adobe.com/flashplayer/

On this page, there is a nice notice, "You may have to temporarily disable your antivirus software.". So, you click "Download Now" button and your browser just crashed because of your antivirus software. However, you can not disable it because you do not have permission.

So, you just want to manual download Flash player. In addition, you might hate Adobe download manager. Here is the rescue link:
http://kb2.adobe.com/cps/191/tn_19166.html#main_ManualInstaller

In order to get this link, you need to go to http://www.adobe.com/support/flashplayer/, click "Windows troubleshooting", click "Download Flash player with manual installer".

Kind of wondering why they do not provide this link on their download page.

No more 'unable to find valid certification path to requested target'

If you kept running into 'unable to find valid certification path to requested target' problem while trying to create a SSL connection to a host using JSSE, this small tool will help you trouble shoot and solve the problem.

http://blogs.sun.com/andreas/entry/no_more_unable_to_find

It will add the certificate of the host into the keystore with your trusted certificates. So, use it with caution.

Certified Application Security Specialist

If you want to become a Certified Application Security Specialist, here is a way to become one:

http://www.asscert.com/


If you do not want to spend money and still want to get PCI compliance, here is the way:
http://www.scanlesspci.com/