There is good news for e-book lovers from Amazon.
Amazon’s kindle, a wireless electronic portable reader which facilitates e-book reading has now become more capsuled, making it more convenient for people on the go. Black Berry users no longer need to carry a separate kindle to read their favorite e-books. Amazon, has now launched a Kindle app for Black Berry, enabling the readers to purchase and read e-books. (more…)
QBurst introduces “theapps.mobi” which gives you instant access to your favorite iPod/iPhone apps without installing itunes. theapps.mobi brings you a faster and easier to use platform with different categories of iPhone and iPod touch apps, ranging from Education, Business and Entertainment to Travel, Weather, Lifestyle and Games. (more…)
After months of anxiety and speculation Apple has finally launched their latest creation, the iPad Tablet. Apple’s CEO, Steve Jobs, unveiled the breakthrough product in a grand meet held at San Francisco on 27th Jan 2010. Apple’s iPad is developed for people on the go to ease their online usage and other PC related tasks.The iPad is neither an iPhone nor a PC but a gadget that bridges the gap between the two. With its small size and touch screen technology, Apple’s iPad is all set to create a new era of Tablet Computing. Although the device lacks complex functionalities when compared to a PC, it is equipped with much desired functions like web browsing, delivering media, capsuling literature, video gaming etc.
The 9.7 inch device with half an inch thickness weighs just 1.5 pounds. It features a touch screen and is available in 16, 32 or 64 gigabytes of flash memory storage. (more…)
Make your smartphone work even smarter!
Mophie, the powerhouse of iPhone and iPod gadgets and batteries is unveiling the hottest iPhone-centric Credit Card Reader at the 2010 International CES proposed to be held at Las Vegas from 7th to 10th Jan this year. To gear up for an even smarter shopping experience you just need to swipe your credit card into the Mophies iphone compatible credit card reader. The transaction will be processed with the help of a third party application.
The Credit Card Reader can be slipped into your iPhone just like the Mophie Juice Pack Air, the external rechargeable battery introduced in the mid 2009. The detailed information including its functioning and pricing is yet to be unveiled at the CES 2010.
Almost a year back (Aug 15th, ‘08, to be precise), AUTOMATTIC released WordPress 2.6.1 fixing over 60 bugs. Also the version featured with the introduction of ‘right to left’ typing for Hebrew and Farsi language administrators. In a very short period of time (may be around one month), the company alerted 2.6.1 version users of security holes in using the same. Here, in this small article, we are going to analyze those vulnerabilities that made AUTOMATTIC release an upgrade for WordPress version 2.6.1 so soon.
Ok, let’s be clear and to the point. The problem is created by the nature of:
1. mt_rand () function of PHP and
2. the truncation method that MySQL adopts
mt_rand ():
PHP has two random number generating functions: rand (), mt_rand (). The former uses GNU C library and the latter uses Mersenne Twister algorithm. Mersenne Twister algorithm was created by Takuji Nishimura and Makoto Matsumoto of Japan. mt_rand () is predominantly used in most of the PHP applications and most importantly, WordPress 2.6.1 uses it.
Normally a seed is used to initiate the generation of random numbers. If it is possible to determine that seed, we will be able to generate the same sequence for any number of times. In other words, we will be able to hack the working of random generation. Seed can be determined using a lookup. Now, once the seed is found, anyone can generate the sequence that the application generates. If you want to know how this is possible, you got to learn random number generation in PHP or there’s an alternative: bow to the fact that it is the nature of mt_rand () function.
Now, make a request for admin password which would send an activation link to the actual admin. But since we have the seed, we will be able to calculate the same activation link by enabling Keep Alive HTTP request. Activating this link and using a different email ID in the form will allow creation of a new WordPress admin password and thereby complete control.
MySQL Truncation:
Let’s see the next one. When the string input given in a query is longer than the defined maximum length, MySQL, by default, truncates the string to the defined maximum length. For example, if the maximum value of the string column is defined to be 8 then, the input value, “qburst_expressions” will be truncated to “qburst_e”. There will be a warning displayed but, applications are normally not configured to handle those warnings. And importantly, WordPress version 2.6.1 was not.
Suppose I know the WordPress admin name, (let’s say, “godfrey”) and the maximum length of the username in MySQL is set as 32. When I register as a new user with the same name “godfrey”, obviously, MySQL will return an error as there already exists an username godfrey. Now, I try with “godfrey “(with 2 spaces after the name), MySQL will truncate the string to “godfrey” and again return an error due to the same reason. Suppose I try with “godfrey g” (with 25 spaces between godfrey and g) then MySQL will not be able to identify a similar username and also truncate the name to “godfrey” to be inserted into the database column. This happen because the username exceeds the defined maximum length of 32 and the system will not be able to find a match in the database. Now we have 2 admin usernames in the table. This is sufficient to pass the validation and gain access to the password of the original admin, thereby complete control.
| Username | Length | Max Length | After Truncation | Database Change |
|
“godfrey” |
7 |
32 |
“godfrey” |
No change |
|
“godfrey “ |
9 |
32 |
“godfrey” |
No change |
|
“godfrey g” |
33 |
32 |
“godfrey” |
Truncated string (godfrey) inserted as new username into DB |
These holes in security made AUTOMATTIC to work on an upgrade at the earliest. And the next release fixed all these errors. So if you are planning to use WordPress, make sure you use the latest version and remain safe. WordPress 2.8.4 is available for download now. It is the latest stable version of WordPress according to the AUTOMATTIC’s last release.
Replication has now become an essential feature for most MySQL users. The good news I can share at the same time is that the working and implementation of this concept is also less complicated. It involves a minimum of 2 servers: a master and a slave (in most cases). The slave makes use of the binary logs created by the master to update its database thereby keeping both of them in exact synchronization.
Issues Leading to the Need of Replication
Heavy Load:
Lets consider a website with an exponentially increasing number of users regularly. There will arrive a state in which the single database server could no longer handle the load anymore. If the server receives more number of read queries rather than write queries (which will be the normal case for most of the websites) then, the best choice will be to adopt replication into the current architecture. Here, the read queries refer to SELECT statements and the write queries refer to INSERT, UPDATE and DELETE statements.
Now I am going to explain how replication solves the issue of heavy load. When the concept of replication is implemented we will be having more than one server. Among these servers, the one named as master will receive queries related to write and make changes to its database immediately. Consequently, when the binary log is updated, the slaves update their database reading from the log files. The slaves on the other hand receive all read queries. Depending on the number of queries received, the number of slaves can be increased or decreased. Now by using any scheduling algorithm (Round Robin is an example), we can effectively load balance the incoming read queries to different slave servers so that all of them get equal workloads.
Backup: Anytime and Without Client Disturbance
During backup requirements, we normally stop MySQL or lock the read queries to get an exact backup. This may sometimes result in the annoyance of the clients who access the website during the process. Although there are a few clever techniques with which you may do this without the notice of the clients, things become very simple with replication.
The slaves always remain in exact synchronization with the master. In other words, the slaves will have another copy of the entire repository that the master processes. And hence backing up of a slave is similar and as good as backing up of the master. Also the presence of slaves as exact replicas will in most cases help avoid the need for backup of the master. This is because we always have the slaves as a spare in case of any misfortunes to the master.
Distribution of Data Without Respect to Distance:
Next issue I am to focus on deals with distributing copies of data in various locations that are geographically very apart which is not a trivial task. But the replication factor gives the flexibility that we require to make it trivial.
The master provides no errors even if the slave remains disconnected for some time. So in spite of the poor connection and other factors that may influence the link between the different destinations, a synchronized copy of the master can be made to exist in a geographically distant region.
Architectures of Replication
There are a few rules that I recommend to be kept in mind to better understand the different architectures.
Master: Slave
This architecture best suits an environment, which has low number of write queries and high number of read queries. Effective load balance can be achieved by spreading the workload among the different servers. Here is an illustration.
Dual Master:
This kind of architecture is particularly useful when servers are geographically far apart. Although during interruptions, neither will have access to their data both will catch up from each other when the connection is reestablished. An extension of this architecture will be to have a slave on either side that is also diagrammatically shown below.
.
Pyramid:
In a large organization where there is diverse distribution in a hierarchical manner, a possible architecture like this will be the best suit. There is no necessity to configure every slave with the master as the slave above in the hierarchy can act as their master.
Although replication solves problems, it demands so much precision, which if not taken care of, can even result in the crash of the master database. Slaves are not always in synchronized state with their master. But with proper monitoring systems this can be detected. The concept of replication is provided by MySQL and can definitely improve overall performance if dealt with proper caution.
