Khao

Thanks for that! Not being a native English speaker I couldn't really grasp what the author was trying to describe when he started talking about a "trough with a cross-sectional area of 0.1 mm2" and the following paragraph. This image made everything clear!

I've used android for years and never knew you could do this. This is one of the things I hate most about all those gestures : there's no way to know about them unless you just try a bunch of random things, or you google for "android browser gestures" or something like that. Give me buttons to do the same things those gestures do! Hide them behing menu if you want, but give me functionality that I can use right now without having to hunt for them on the web.

I doesn't seem available in Canada at all, that looks more like it's the international roaming coverage (from T-Mobile or Sprint)

Your username is so appropriate for this :)

Seems like you can't add a system.webServer node on the machine.config, but you could add it to applicationHost.config (source: http://www.iis.net/learn/get-started/planning-your-iis-archi... ) so yes, that would be faster. You have to make sure that none of your web.config files override that setting though!

Can't edit the top comment anymore :( but it has been found that indeed no rules are needed to exploit this (my previous answer is outdated and wrong!)

If you can't afford to reboot your servers right now to install the patch, at least you can add this to your web.config and deploy your websites ASAP :

<configuration> <system.webServer> <caching enableKernelCache="false"/> </system.webServer> </configuration>

You're right! Even with no rule having kernal caching enabled will crash it! I think IIS assumes it should cache all static content even when there are no rules specifically for them. Somehow I can't edit my comment anymore but I'll leave this here :

EVEN WITH NO RULES, YOU ARE VULNERABLE! My previous answer has been proven to be wrong!

Damnit. I'll double-check on my side too and update my answer accordingly. I don't want people to think they're safe if they're not!

Did you have to configure any rule in the Output Caching or that's completely default values?

Do you happen to have a screenshot of the BSOD, or could test it a second time to take a screenshot? I don't really have a free test server that I can crash anymore since I tested this morning when not a lot of people were at the office yet.

Specifically after enabling Output Caching for all .png files I send this :

curl -v http://example.com/image.png -H "Range: bytes=18-18446744073709551615"

Even if you have Kernel Caching enabled (as it is by default) if you haven't created any rule for it you're safe.

I created a rule to cache all .png files and I changed the curl request to request a .png image on the server. I got a BSOD!

Yep. I tried curl -v to get all the raw headers line by line and the payload is there, and I also tried in telnet, both return a 200 page.

I read the microsoft security bulletin and it says that your IIS server is protected if Kernal Caching is off, maybe that's why our servers are neither blocking the request nor crashing with the request.

I tried to send the bad curl request to our servers (test env, obviously) and I didn't get any error. It seems I should be getting "Requested Range Not Satisfiable" if the server is vulnerable and "The request has an invalid header name" if it's patched. I'm getting neither, simply a normal response HTTP 200 with the requested page. Anyone knows how to really test it?

EDIT : It is indeed related to "Output Cache" setting in IIS as I said I was suspecting in another comment. I managed to crash our servers by going to IIS Management, select the website I wanted to test, go to Output Caching, enable the feature AND also add a rule (I added a rule for .png just to test). If you have NO rules it is the same as having the feature disabled so you are safe. If you add a rule and check "Enable Kernal Caching" you are vulnerable!

EDIT 2 : As some have asked, this is the command I used to crash our test server. I tested it after having created a new Output Caching rule to cache all .png files in kernel mode.

curl -v http://example.com/image.png -H "Range: bytes=18-18446744073709551615"

I didn't take a screenshot of the BSOD and I don't plan on crashing our test env a second time today because people are using it (I tested it early enough that not a lot of people were at the office yet).

I use window 8's built-in scaling to put everything at 125% too because my laptop screen is a 15-inch 1920x1080 and I find with that kind of pixel density I need to make things a little bit bigger. It's ridiculous how many things are broken when doing this.

So can we consider our paychecks to be gifts then?

Mirror/cached version : http://webcache.googleusercontent.com/search?q=cache:4RhIBeM...

The only apps I'm aware of that did this to me are IE and the Windows Store whenever you do an update (8.0 to 8.1, not security updates of course). So the Windows folks are saying you shouldn't do this but they're the ones doing it?

In other news "This hammer is trash because it doesn't screw in nails properly!"

I'm not interested in compilers, I hate writing code in low level languages, I cannot for the life of me understand assembly and Go works extremely well for what I want to do. I've used PHP/C#/Javascript my whole life and I'm more concerned about writing software than writing code. I don't want to nitpick on the tiny details of a running software with memory registers, cpu cycles, cache miss, etc unless there is an obvious bug or performance issue I need to fix. Those things should be abstracted away from me as a developer and go is a great compiled language that looks and feels like an interpreted language from a developer point of view.

I'm wondering why it's using 6-star rating. It got me really confused for a moment since my mind is used to ratings out of 5 stars, not 6.

Why can't the website tell what it actually does? It's honestly a terrible landing page for an app.

If this is the case, it would seem pretty insulting to me as a developer and user of Docker that "time-saving" is more important that security and validating images. I'd rather use a slower tool that is secure.

it was either GREETING or greeting since it's case-insensitive

But that's no use if you use the default TTL of 2-3 hours that I always see whenever I configure new dns entries. Sensible TTL should be at least 24-48 hours, maybe even more for your returning users to not be affected by those kind of outages.

So when those new native api functions arrive, jQuery will start using them and gain some performance boost (using native vs. custom js code) while at the same time remaining backwards compatible (by doing feature detection). No one wants to write their own feature detection code so this whole page about using native apis is instead of jQuery is ridiculous.

If the point of that website was to educate people on the apis that jQuery calls under the hood, it chose a really poor name.

Your second link gives me an error.

I think the hard part will be to try and stay focused and establish milestones. If everyone is giving input at the same time, it'll be extremely spread out and inefficient. Working towards the first few releases (0.1, 0.2, etc..) you need to be really focused on your priorities and not distracted by the big picture too much.

I can't give a very complete answer as I've been using AWS to work on a side project for about a whole week.

I try to design my app with 12-factor in mind (http://12factor.net/) so all the configuration is passed to the app at run time (either ENV vars, config files, args or pulled from etcd). I'm trying to run the exact same code while in dev and while deployed in prod. For example I will absolutely try and avoid having "if Env == Test" or "if Env == Prod" in my code.

For example, my service connects to S3 to store/retrieve files. The access key, secret key and even the bucket name are all passed as ENV variables so I can work on a test bucket easily with a test api key without changing code. Some services I can run locally (memcache or redis are really easy to spin up locally) and some services I'll rely on Amazon to provide like S3 even in dev/test. Of course this requires a reliable internet connection but it's the best way to deal with this for me as a single developer/devops.

I'm sure bigger teams handling larger projects could give a lot of valuable information on the subject, I would love to hear about it too.

Having the full cloud ecosystem on AWS/google is great. Launch a server that store files in S3, talks to a DynamoDB and memcache server and has a CDN and load balancer. The amount of back-end work required to make that is minimal and coordinating all those services (scaling, configuration, redundency) is so easy you don't even need a sys admin to do it.

This discussion got me thinking and I started working on a side project to do exactly that. Let me know if you'd like to be notified when it's ready for beta. My e-mail is in my profile if you're interested