I am such a person. I have a lot of experience with web development, but when it comes to developing software for the desktop I am absolutely hopeless. The Open Source community, however, has many individuals—developers—who are willing to give up their free time to help a worthy cause and to build the codebase for such applications under the guidance of a project manager. This is advantageous for both parties because the project manager gets to realise his creative concept and the developers receive some fame and recognition for their work, particularly in the Open Source community. They may also be offered incentives such as a share of the donation money; a steady source of income out of gratitude for the work they have accomplished.

However, many Open Source projects fall apart before they see the light of day, mostly due to management reasons. You are receiving this directly from someone who has had an Open Source project disintegrate (by the name of HyperGet) and has had to pick up the pieces, so the common pitfalls listed below are frighteningly genuine and happen to the most motivated of project managers. They all, ultimately, result in developer dropout and thus the death or dormancy of the project.
(more…)

The programmer in question can be blamed to a certain extent for not reading up on how to secure their web application, but the problem is that many new programmers are not aware of the fact that they need to escape and clean the data they receive from the application’s inputs in order to stop it from doing what it was not designed to do. They are probably unaware that such types of attacks exist anyway. However, PHP provides limited, complex and slightly obscure functions to secure input handling which are usually insufficient and lack the functionality required to prevent certain attacks. Worse still, many books and tutorials written to teach people with no previous experience how to code in PHP usually omit secure data handling techniques or tips, and provide examples thoughout the book/tutorial which are vulnerable to the attacks mentioned above! This is irresponsible on the authors’ behalf: it’s no wonder that PHP application vulnerabilities accounted for 43% of the security issues found in 2006.

However, all hope is not lost. The Open Web Application Security Project (OWASP) have produced a set of PHP filters which allow the newest of PHP programmers to secure their input data handling methods. Doing so is a simple as downloading the filters, including them in the web app (with a command such as require_once(’sanitize.inc.php’)), storing the input into a variable and then sanitizing the data as shown on the project’s homepage.

It would be better if the PHP developers added functions such as OWASP’s PHP filters into the PHP code itself and if the authors of PHP instruction material added sections on securing input handling, but these filters are far better than nothing

Although the LSB Packaging group is working hard to produce a universal package format to make it easier for third-party developers to distribute packages, I suspect it shall be at least another few months (if not longer) until such a package format and its related management system appear and are implemented by most Linux distributions. So, HyperGet will be safe until then - and, after that, we may even be able to alter HyperGet to work with that package format instead of the current .deb, although that will depend on the specification of the package format and management system (ie. how dependencies are handled) that the LSB create.

And, before I finish, I must give my thanks to llama love (now HyperGet’s Lead Developer) for inspiring me and for working so diligently on our project. Keep up the great work

I can’t reveal too many details (ie. anything), so I’ll just say this: I thought of it by following some advice I read somewhere - by lying down on a sunbed with my notepad and a pen and just waiting for the thought to hit me.. Oddly enough, it did, and from there I developed the idea into a grander project.

I haven’t finished coding it yet and I’ve only got seven days until it debuts - crap, I better get coding

(more…)