Daily Archives: June 25, 2008

php, software development

Windows server compromised by PHP application

6 Comments

Susan Bradley has posted her analysis of how her Windows server was hacked.

This is interesting to me, as Bradley is an expert on server administration and patching; I’m glad she has had the courage to post all these details, thus benefiting the community, rather than pretending the server was down for emergency maintenance or the like.

She thinks it was a security bug in IceWarp Web Mail. This appears to be a PHP application. Although the bug has been fixed, she was running an old version because the new one broke some important features.

The explanation sounds plausible to me. So is it applications rather than operating systems that form the most critical security weaknesses today? Yes, but both are involved. I would be interested to know whether the same bug in a Linux installation of IcwWarp would have been equally easy to escalate to the entire OS.

Technorati tags: , , ,
adobe, software development, web authoring

Adobe’s Acrobat.com REST API

1 Comment

I wrote a piece for IT Week on Adobe Acrobat 9. One aspect of the new Acrobat.com collaboration site that has not received much attention (by way of evidence, the developer forum is currently quiescent) is the document services API. This is a REST API which lets you integrate Acrobat.com services into an application. You can use pretty much any programming language that can talk HTTP. There are some similarities with Amazon’s Simple Storage Service: file upload and download, and management of access control lists based on Adobe IDs (email addresses registered with Adobe). The API reference is here; there are also some wrapper libraries for Java, ActionScript, Ruby, Python and Cold Fusion. No C# yet.

It strikes me as a useful API. For example, imagine you have an application that creates a sales report. The application could upload the report to Acrobat.com and email a group of colleagues with the link.

Another obvious application is a utility to synchronize local and online files. While there are no specific synchronization APIs, you can get the last modified date of a file which would be enough for something simple.

The service will get more useful as other pieces emerge. Flash 10 has a rich text editor with some useful features such as multi-columns with text flow, multi-language and bi-directional support. Put this together with AIR and the Acrobat API and you have all you need to make your own cross-platform offline word processor with online storage. Adobe itself intends to provide this in a future offline version of Buzzword.