Research & Implementation of Uclinux-Based Embedded Browser
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
Red Hat Enterprise Linux 6 Developer Guide
Red Hat Enterprise Linux 6 Developer Guide An introduction to application development tools in Red Hat Enterprise Linux 6 Dave Brolley William Cohen Roland Grunberg Aldy Hernandez Karsten Hopp Jakub Jelinek Developer Guide Jeff Johnston Benjamin Kosnik Aleksander Kurtakov Chris Moller Phil Muldoon Andrew Overholt Charley Wang Kent Sebastian Red Hat Enterprise Linux 6 Developer Guide An introduction to application development tools in Red Hat Enterprise Linux 6 Edition 0 Author Dave Brolley [email protected] Author William Cohen [email protected] Author Roland Grunberg [email protected] Author Aldy Hernandez [email protected] Author Karsten Hopp [email protected] Author Jakub Jelinek [email protected] Author Jeff Johnston [email protected] Author Benjamin Kosnik [email protected] Author Aleksander Kurtakov [email protected] Author Chris Moller [email protected] Author Phil Muldoon [email protected] Author Andrew Overholt [email protected] Author Charley Wang [email protected] Author Kent Sebastian [email protected] Editor Don Domingo [email protected] Editor Jacquelynn East [email protected] Copyright © 2010 Red Hat, Inc. and others. The text of and illustrations in this document are licensed by Red Hat under a Creative Commons Attribution–Share Alike 3.0 Unported license ("CC-BY-SA"). An explanation of CC-BY-SA is available at http://creativecommons.org/licenses/by-sa/3.0/. In accordance with CC-BY-SA, if you distribute this document or an adaptation of it, you must provide the URL for the original version. Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert, Section 4d of CC-BY-SA to the fullest extent permitted by applicable law. -
The Kdesvn Handbook
The kdesvn Handbook Rajko Albrecht The kdesvn Handbook 2 Contents 1 Introduction 7 1.1 Terms . .7 2 Using kdesvn 8 2.1 kdesvn features . .8 2.2 Beginning with subversion and kdesvn . .8 2.2.1 Creating a working copy . .9 2.2.2 Committing local changes . .9 2.2.3 Update working copy . .9 2.2.4 Adding and Deleting from working copy . .9 2.2.4.1 Add items . 10 2.2.4.2 Deleting items from working copy and unversion . 10 2.2.5 Displaying logs . 10 2.2.5.1 The log display dialog . 10 2.3 Working on repositories . 11 2.3.1 Restoring deleted items . 11 2.3.2 Importing folders . 11 2.3.2.1 With drag and drop . 11 2.3.2.2 Select folder to import with directory-browser . 11 2.4 Other Operations . 11 2.4.1 Merge . 11 2.4.1.1 Internal merge . 12 2.4.1.2 Using external program for merge . 12 2.4.2 Resolving conflicts . 12 2.5 Properties used by kdesvn for configuration . 13 2.5.1 Bugtracker integration . 13 2.6 The revision tree . 13 2.6.1 Requirements . 14 2.7 Internal log cache . 14 2.7.1 Offline mode . 14 2.7.2 Log cache and revision tree . 14 The kdesvn Handbook 2.8 Meaning of icon overlays . 14 2.9 kdesvn and passwords . 16 2.9.1 Not saving passwords . 16 2.9.2 Saving passwords in KWallet . 16 2.9.3 Saving to subversion’s own password storage . -
CA Network Flow Analysis Release Notes
CA Network Flow Analysis Release Notes Release 9.1.3 This Documentation, which includes embedded help systems and electronically distributed materials, (hereinafter referred to as the “Documentation”) is for your informational purposes only and is subject to change or withdrawal by CA at any time. This Documentation may not be copied, transferred, reproduced, disclosed, modified or duplicated, in whole or in part, without the prior written consent of CA. This Documentation is confidential and proprietary information of CA and may not be disclosed by you or used for any purpose other than as may be permitted in (i) a separate agreement between you and CA governing your use of the CA software to which the Documentation relates; or (ii) a separate confidentiality agreement between you and CA. Notwithstanding the foregoing, if you are a licensed user of the software product(s) addressed in the Documentation, you may print or otherwise make available a reasonable number of copies of the Documentation for internal use by you and your employees in connection with that software, provided that all CA copyright notices and legends are affixed to each reproduced copy. The right to print or otherwise make available copies of the Documentation is limited to the period during which the applicable license for such software remains in full force and effect. Should the license terminate for any reason, it is your responsibility to certify in writing to CA that all copies and partial copies of the Documentation have been returned to CA or destroyed. TO THE EXTENT PERMITTED BY APPLICABLE LAW, CA PROVIDES THIS DOCUMENTATION “AS IS” WITHOUT WARRANTY OF ANY KIND, INCLUDING WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NONINFRINGEMENT. -
Security Analysis of Firefox Webextensions
6.857: Computer and Network Security Due: May 16, 2018 Security Analysis of Firefox WebExtensions Srilaya Bhavaraju, Tara Smith, Benny Zhang srilayab, tsmith12, felicity Abstract With the deprecation of Legacy addons, Mozilla recently introduced the WebExtensions API for the development of Firefox browser extensions. WebExtensions was designed for cross-browser compatibility and in response to several issues in the legacy addon model. We performed a security analysis of the new WebExtensions model. The goal of this paper is to analyze how well WebExtensions responds to threats in the previous legacy model as well as identify any potential vulnerabilities in the new model. 1 Introduction Firefox release 57, otherwise known as Firefox Quantum, brings a large overhaul to the open-source web browser. Major changes with this release include the deprecation of its initial XUL/XPCOM/XBL extensions API to shift to its own WebExtensions API. This WebExtensions API is currently in use by both Google Chrome and Opera, but Firefox distinguishes itself with further restrictions and additional functionalities. Mozilla’s goals with the new extension API is to support cross-browser extension development, as well as offer greater security than the XPCOM API. Our goal in this paper is to analyze how well the WebExtensions model responds to the vulnerabilities present in legacy addons and discuss any potential vulnerabilities in the new model. We present the old security model of Firefox extensions and examine the new model by looking at the structure, permissions model, and extension review process. We then identify various threats and attacks that may occur or have occurred before moving onto recommendations. -
Inlined Information Flow Monitoring for Javascript
Inlined Information Flow Monitoring for JavaScript Andrey Chudnov David A. Naumann Stevens Institute of Technology Stevens Institute of Technology Hoboken, NJ 07030 USA Hoboken, NJ 07030 USA [email protected] [email protected] ABSTRACT JS engines are highly engineered for performance, which has Extant security mechanisms for web apps, notably the\same- led some researchers to argue for inlined monitoring for IFC. origin policy", are not sufficient to achieve confidentiality The main contribution of this paper is an inlined IFC mon- and integrity goals for the many apps that manipulate sen- itor that enforces non-interference for apps written in JS. sitive information. The trend in web apps is \mashups" We present the main design decisions and rationale, together which integrate JavaScript code from multiple providers in with technical highlights and a survey of state of the art al- ways that can undercut existing security mechanisms. Re- ternatives. The tool is evaluated using synthetic case studies searchers are exploring dynamic information flow controls and performance benchmarks. (IFC) for JavaScript, but there are many challenges to achiev- ing strong IFC without excessive performance cost or im- On IFC. Browsers and other platforms currently provide practical browser modifications. This paper presents an in- isolation mechanisms and access controls. Pure isolation lined IFC monitor for ECMAScript 5 with web support, goes against integration of app code from multiple providers. using the no-sensitive-upgrade (NSU) technique, together Access controls can be more nuanced, but it is well-known with experimental evaluation using synthetic mashups and that access control policies are safety properties whereas IF performance benchmarks. -
Novell Corporate Presentation Template 2009
AD/Linux Desktop Improving the Experience Jim McDonough Novell/SuSE Labs Samba Team Lead [email protected] [email protected] AD Linux Desktop: The Current State Current State: Basic integration • User and group definitions – Trusts – Nested groups • Login authentication • Domain-based password policies • Ticket creation • Offline logins 3 © Novell, Inc. All rights reserved. Current State: User experience • Common Userid and Password • Password policy messages • Authentication through Kerberized applications – Firefox – Commandline utilities • Automatic access to shared folders – Through desktop > Gnome: Nautilus, gvfs, stored in gconf > KDE: Konqueror, kwin, kio – Through text-based logins > Automount > pam_mount 4 © Novell, Inc. All rights reserved. Current State: Admin Experience • User and group definition through AD tools – Common authentication possible for some apps • Secure DNS updates • Application settings for Desktops (and even Linux servers) independent of AD – Combination of text files, XML, LDAP, scripts – Parallel administration of Linux systems 5 © Novell, Inc. All rights reserved. Current State: Examples • Automatic shares – By user: > desktop window managers – By administrator: > Automounter: » stores plaintext passwords » Unmount is timeout based > pam_mount: » Obtain password through pam stack or: » Use kerberos tickets » Unmount on logout 6 © Novell, Inc. All rights reserved. Current State: Examples • Apache + mod_auth_kerb – Net ads keytab create/add HTTP – .htaccess: > AuthType Kerberos > AuthName "Krb5 Auth" > KrbServiceName HTTP > KrbVerifyKDC On > Krb5Keytab /etc/krb5.keytab > KrbAuthRealms EXAMPLE.COM > KrbMethodNegotiate on > KrbMethodK5Passwd on > require valid-user 7 © Novell, Inc. All rights reserved. Current State: Examples • Firefox – about:config or prefs.js: > network-negotiate-auth.delegation-uris > network-negotiate-auth.trusted-uris 8 © Novell, Inc. All rights reserved. Centralizing Administration Centralizing Administration • CIM/WBEM (e.g. -
Why Be a KDE Project? Martin Klapetek David Edmundson
Why be a KDE Project? Martin Klapetek David Edmundson What is KDE? KDE is not a desktop, it's a community „Community of technologists, designers, writers and advocates who work to ensure freedom for all people through our software“ --The KDE Manifesto What is a KDE Project? Project needs more than just good code What will you get as a KDE Project? Git repository Git repository plus „scratch repos“ (your personal playground) Creating a scratch repo git push –all kde:scratch/username/reponame Git repository plus web interface (using GitPHP) Git repository plus migration from Gitorious.org Bugzilla (the slightly prettier version) Review Board Integration of git with Bugzilla and Review Board Integration of git with Bugzilla and Review Board Using server-side commit hooks ● BUG: 24578 ● CCBUG: 29456 ● REVIEW: 100345 ● CCMAIL: [email protected] Communication tools Mailing lists Wiki pages Forums Single sign-on to all services Official IRC channels #kde-xxxxx (on Freenode) IRC cloak me@kde/developer/mklapetek [email protected] email address Support from sysadmin team Community support Development support Translations (71 translation teams) Testing support (Active Jenkins and EBN servers, plus Quality Team) Project continuation (when you stop developing it) KDE e.V. support Financial and organizational help Trademark security Project's licence defense via FLA Promo support Stories in official KDE News site (Got the Dot?) Your blog aggregated at Planet KDE Promo through social channels Web hosting under kde.org domain Association with one of the best -
Designing a Browser to Benefit from Multi-Core Silicon
Designing a Browser to Benefit from Multi-core Silicon Ekioh Ltd, Cambridge UK. [email protected] Abstract This paper investigates the impact of the evolution in processor technology upon HTML browser performance, highlighting some limitations in current browser design and ways in which these limitations can be overcome. It asserts that overcoming these limitations is key to offering 4K UIs on mass-market consumer products in the very near future. Introduction HTML browsers are increasingly being used for Trends of CE Processor Speeds application rendering and user interface (UI) 25 presentation. The driving reasons behind this are that single core dual core quad core browsers reduce UI authoring complexity and provide a 20 level of hardware abstraction which enables authoring to happen in parallel with hardware design. 15 Browser technology has also allowed the application 10 authoring community to grow beyond embedded DMIPS Headline Performance software engineers to include creative designers. This has 5 led to a marked improvement in the visual quality of user Per core Performance interfaces and the look and feel of applications. 0 This flexibility and increased visual quality comes at a Time → cost; the browser is one of the most demanding components within a device and achieving the necessary The headline processing speed of multi-core devices responsiveness directly drives CPU selection benefits from increases in the number of cores and, requirements. indirectly, from reductions in process size. Year on year improvements of around 30% were achieved in headline processing speed over a five year period despite the Processor evolution relatively small performance improvements of each core. -
The Kate Handbook
The Kate Handbook Anders Lund Seth Rothberg Dominik Haumann T.C. Hollingsworth The Kate Handbook 2 Contents 1 Introduction 10 2 The Fundamentals 11 2.1 Starting Kate . 11 2.1.1 From the Menu . 11 2.1.2 From the Command Line . 11 2.1.2.1 Command Line Options . 12 2.1.3 Drag and Drop . 13 2.2 Working with Kate . 13 2.2.1 Quick Start . 13 2.2.2 Shortcuts . 13 2.3 Working With the KateMDI . 14 2.3.1 Overview . 14 2.3.1.1 The Main Window . 14 2.3.2 The Editor area . 14 2.4 Using Sessions . 15 2.5 Getting Help . 15 2.5.1 With Kate . 15 2.5.2 With Your Text Files . 16 2.5.3 Articles on Kate . 16 3 Working with the Kate Editor 17 4 Working with Plugins 18 4.1 Kate Application Plugins . 18 4.2 External Tools . 19 4.2.1 Configuring External Tools . 19 4.2.2 Variable Expansion . 20 4.2.3 List of Default Tools . 22 4.3 Backtrace Browser Plugin . 25 4.3.1 Using the Backtrace Browser Plugin . 25 4.3.2 Configuration . 26 4.4 Build Plugin . 26 The Kate Handbook 4.4.1 Introduction . 26 4.4.2 Using the Build Plugin . 26 4.4.2.1 Target Settings tab . 27 4.4.2.2 Output tab . 28 4.4.3 Menu Structure . 28 4.4.4 Thanks and Acknowledgments . 28 4.5 Close Except/Like Plugin . 28 4.5.1 Introduction . 28 4.5.2 Using the Close Except/Like Plugin . -
On the Disparity of Display Security in Mobile and Traditional Web Browsers
On the Disparity of Display Security in Mobile and Traditional Web Browsers Chaitrali Amrutkar, Kapil Singh, Arunabh Verma and Patrick Traynor Converging Infrastructure Security (CISEC) Laboratory Georgia Institute of Technology Abstract elements. The difficulty in efficiently accessing large pages Mobile web browsers now provide nearly equivalent fea- on mobile devices makes an adversary capable of abusing tures when compared to their desktop counterparts. How- the rendering of display elements particularly acute from a ever, smaller screen size and optimized features for con- security perspective. strained hardware make the web experience on mobile In this paper, we characterize a number of differences in browsers significantly different. In this paper, we present the ways mobile and desktop browsers render webpages that the first comprehensive study of the display-related security potentially allow an adversary to deceive mobile users into issues in mobile browsers. We identify two new classes of performing unwanted and potentially dangerous operations. display-related security problems in mobile browsers and de- Specifically, we examine the handling of user interaction vise a range of real world attacks against them. Addition- with overlapped display elements, the ability of malicious ally, we identify an existing security policy for display on cross-origin elements to affect the placement of honest el- desktop browsers that is inappropriate on mobile browsers. ements and the ability of malicious cross-origin elements Our analysis is comprised of eight mobile and five desktop to alter the navigation of honest parent and descendant el- browsers. We compare security policies for display in the ements. We then perform the same tests against a number candidate browsers to infer that desktop browsers are signif- of desktop browsers and find that the majority of desktop icantly more compliant with the policies as compared to mo- browsers are not vulnerable to the same rendering issues. -
Presto: the Definitive Guide
Presto The Definitive Guide SQL at Any Scale, on Any Storage, in Any Environment Compliments of Matt Fuller, Manfred Moser & Martin Traverso Virtual Book Tour Starburst presents Presto: The Definitive Guide Register Now! Starburst is hosting a virtual book tour series where attendees will: Meet the authors: • Meet the authors from the comfort of your own home Matt Fuller • Meet the Presto creators and participate in an Ask Me Anything (AMA) session with the book Manfred Moser authors + Presto creators • Meet special guest speakers from Martin your favorite podcasts who will Traverso moderate the AMA Register here to save your spot. Praise for Presto: The Definitive Guide This book provides a great introduction to Presto and teaches you everything you need to know to start your successful usage of Presto. —Dain Sundstrom and David Phillips, Creators of the Presto Projects and Founders of the Presto Software Foundation Presto plays a key role in enabling analysis at Pinterest. This book covers the Presto essentials, from use cases through how to run Presto at massive scale. —Ashish Kumar Singh, Tech Lead, Bigdata Query Processing Platform, Pinterest Presto has set the bar in both community-building and technical excellence for lightning- fast analytical processing on stored data in modern cloud architectures. This book is a must-read for companies looking to modernize their analytics stack. —Jay Kreps, Cocreator of Apache Kafka, Cofounder and CEO of Confluent Presto has saved us all—both in academia and industry—countless hours of work, allowing us all to avoid having to write code to manage distributed query processing. -
Superhacks: Exploring and Preventing Vulnerabilities in Browser Binding
Short Paper: Superhacks Exploring and Preventing Vulnerabilities in Browser Binding Code Fraser Brown Stanford University [email protected] Abstract Browser binding code is different from—and more com- In this paper, we analyze security vulnerabilities in the binding plicated than—other multi-language systems such as foreign layer of browser code, and propose a research agenda to function interfaces (FFIs). This difference arises for three main prevent these weaknesses with (1) static bug checkers and (2) reasons. First, browser binding code must reconcile different new embedded domain specific languages (EDSLs). Browser runtimes instead of making simple library calls. Second, since vulnerabilities may leak browsing data and sometimes allow the binding layer sits between JavaScript application code and attackers to completely compromise users’ systems. Some of the rest of the browser, browsers often rely on binding-layer these security holes result from programmers’ difficulties with code to implement the same-origin policy [2]. For example, managing multiple tightly-coupled runtime systems—typically binding code must enforce isolation between the JavaScript JavaScript and C++. In this paper, we survey the vulnerabilities running in a page and any cross-origin iframes the page may in code that connects C++ and JavaScript, and explain how embed. Finally, the binding layer must defend against poten- they result from differences in the two languages’ type systems, tially malicious code, since the JavaScript running in browsers memory models, and control flow constructs. With this data, we comes from many disparate parties. design a research plan for using static checkers to catch bugs A buggy binding layer introduces browser vulnerabilities.