DPS: need to have multitple certificate mappings/search methods
My 6.3 DPS is configured to authentificate end-users through SASL binds and to request a client certificate.
I need to use 4 user attributes (cn,sn,givenname,ou) defined in the backend LDAP directory to map certificates to LDAP entries.
The problem is that some servers are also connecting through DPS but their certificate doesn't contain any givenname attribute.
So, they can not be authenticated by DPS which rejects their connections.
I wish we could define multiple certificate mapping strategies in DPS (or at least a prefered and a default strategy) in order to have
a workaround in such a situation.
Any plan to implement that feature or any suggested workaround (other than creating new server certificates and entries with a givenname) ?
My 6.3 DPS is configured to authentificate end-users through SASL binds and to request a client certificate.
I need to use 4 user attributes (cn,sn,givenname,ou) defined in the backend LDAP directory to map certificates to LDAP entries.
The problem is that some servers are also connecting through DPS but their certificate doesn't contain any givenname attribute.
So, they can not be authenticated by DPS which rejects their connections.
I wish we could define multiple certificate mapping strategies in DPS (or at least a prefered and a default strategy) in order to have
a workaround in such a situation.
Any plan to implement that feature or any suggested workaround (other than creating new server certificates and entries with a givenname) ?
Similar Messages
-
2nd try - DPS: need to have multitple certificate mappings/search methods
My 6.3 DPS is configured to authentificate end-users through SASL binds and to request a client certificate.
I need to use 4 user attributes (cn,sn,givenname,ou) defined in the backend LDAP directory to map certificates to LDAP entries.
The problem is that some servers are also connecting through DPS but their certificate doesn't contain any givenname attribute.
So, they can not be authenticated by DPS which rejects their connections.
I wish we could define multiple certificate mapping strategies in DPS (or at least a prefered and a default strategy) in order to have
a workaround in such a situation.
Any plan to implement that feature or any suggested workaround (other than creating new server certificates and entries with a givenname) ?Here's what I see in the access and error log:
Access log:
[07/Jan/2010:15:48:35 +0100] - CONNECT - INFO - conn=309 client=217.108.164.186:47961 server=rct-31.gipc.hst.fluxus.net:1636 protocol=LDAPS
[07/Jan/2010:15:48:35 +0100] - PROFILE - INFO - conn=309 assigned to connection handler cn=Gestionnaire de connexion ultime,cn=connection handlers,cn=config
[07/Jan/2010:15:48:35 +0100] - OPERATION - INFO - conn=309 op=0 BIND dn="" method="SIMPLE" version=3
[07/Jan/2010:15:48:35 +0100] - OPERATION - INFO - conn=309 op=0 BIND RESPONSE err=0 msg="" etime=0
Error log:
[07/Jan/2010:15:48:01 +0100] - EXCEPTION - DEBUG - Exception thrown from thread Connection Handler 1 for Listener Thread 0.0.0.0:1389
javax.net.ssl.SSLException: Inbound closed before receiving peer's close_notify: possible truncation attack?
com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:166)
com.sun.net.ssl.internal.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1356)
com.sun.net.ssl.internal.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1324)
com.sun.net.ssl.internal.ssl.SSLEngineImpl.closeInbound(SSLEngineImpl.java:1263)
com.sun.directory.proxy.extensions.LDAPClientConnection.disconnect(LDAPClientConnection.java:1541)
com.sun.directory.proxy.extensions.LDAPClientConnection.disconnect(LDAPClientConnection.java:1482)
com.sun.directory.proxy.extensions.LDAPConnectionHandler.runThread(LDAPConnectionHandler.java:457)
com.sun.directory.proxy.util.DistributionThread.run(DistributionThread.java:225)
[07/Jan/2010:15:48:36 +0100] - EXCEPTION - DEBUG - Exception thrown from thread Connection Handler 1 for Listener Thread 0.0.0.0:1636
java.io.IOException: Received CLOSED during initial handshaking
com.sun.directory.proxy.extensions.LDAPClientConnection.doHandshake(LDAPClientConnection.java:398)
com.sun.directory.proxy.extensions.LDAPClientConnection.read(LDAPClientConnection.java:1229)
com.sun.directory.proxy.extensions.LDAPConnectionHandler.runThread(LDAPConnectionHandler.java:346)
com.sun.directory.proxy.util.DistributionThread.run(DistributionThread.java:225)
[07/Jan/2010:15:48:36 +0100] - EXCEPTION - DEBUG - Exception thrown from thread Connection Handler 1 for Listener Thread 0.0.0.0:1636
java.io.IOException: Received CLOSED during initial handshaking
com.sun.directory.proxy.extensions.LDAPClientConnection.doHandshake(LDAPClientConnection.java:398)
com.sun.directory.proxy.extensions.LDAPClientConnection.disconnect(LDAPClientConnection.java:1547)
com.sun.directory.proxy.extensions.LDAPClientConnection.disconnect(LDAPClientConnection.java:1482)
com.sun.directory.proxy.extensions.LDAPConnectionHandler.runThread(LDAPConnectionHandler.java:457)
com.sun.directory.proxy.util.DistributionThread.run(DistributionThread.java:225)
Unfortunately, since I don't have access to the back-end DS access log, should I see more details (of interest !) on the DPS side
with a higher log level ?
From my understanding and with my DPS config, when DPS chooses the "Gestionnaire de connexion ultime" connection handler, it means
it hadn't been able to map the certificate's owner to an LDAP entry. (This connection handler has the lowest priority in my DPS configuration).
I've to check (with my customer), but it could be that with the existing back-end DS content, the problem is that when DPS searches for the certificate's owner LDAP entry with only 3 attributes, it's returned more than a single entry.
Actually, otherwise, since I don't see any obvious problem in the error log, and thanks to your feedback, I can't see any other possible problem,
provided that the customer is confident in the fact that there's an entry with the right certificate in the DS back-end . -
Need for NPS server certificate with PEAP-MS-CHAPv2
Hi,
I have a question about a small setup I'm currently testing. In a Wireless access with 802.1X authentication based on PEAP/MS-CHAPv2, and a NPS server (MS server 2012R2), I've noted reading technet documentation that the NPS server or other RADIUS server
do have a certificate (issued by a 3rd party CA or by an AD CS environment).
However, it remains for me a point I would like to clarify (sorry I surely have a bad understanding of documentation). If my client is configured for not "validate server certificate", do I still need to have a certificate on the NPS server ?
Well, I know it is not secured, but this will permit me to test without configuring an AD CS, and without buying a certificate.
Many thanks in advance for your answer.
Regards,
FabriceYou also need a server certificate in this case as the protection in Protected EAP is due to the encryption of the TLS session.
Not validating the server certificate just means that no additional check of the name is done, so the client would be able to connect to any RADIUS server - given that its certificate chain is valid. But the certificate chain as such is checked as in every
SSL handshake.
You don't need a certificate issued by a commercial CA though - you could use an inhouse PKI. For tests you could use a self-signed certificate as well.
Edit: If you want to test self-signed certificates the easiest way is probably to install the web server role and use its built-in option to create a self-signed certificate.
Elke -
Hi again,
I have problems about my search method at the below. It always create ArrayIndexOutOfBounds Exception. According to this error, the index(38) equals to the size of my arraylist. So how can I fix it ??
import java.util.*;
* ...Listdescription...
* @author ...yourname...
* @version 1.00, 2006/05/19
public class List
// properties
ArrayList store;
int index = 0;
// constructors
public List(){
store = new ArrayList();
// methods
public void add(Object e,int node){
store.add(node, e);
public void addHead(Object e){
store.add(0, e);
public void addTail(Object e){
store.add(e);
// recursive method
public void toString(int a){
if(store.size() == a )
System.out.println( "");
else{
System.out.println(store.get(a));
toString(a + 1);
// recursive method
public int search(Object e){
// if(index == store.size())
// return -1;
if(e == store.get(index)){
return store.indexOf(e);
else{
index++;
return search(e);
public static void main( String[] args)
List myList = new List();
for(int a = 0; a < 35; a++ )
myList.add(a,new Integer(a));
myList.add(35,new Integer(35));
myList.addHead(new Integer(36));
myList.addTail(new Integer(39));
myList.toString(0);
System.out.println(myList.search(new Integer(3)));
} // end of class ListDo you think that the following can run for all object types ?
public int search(Object e){
if(index == store.size())
return -1;
if(e.equals(store.get(index))){
return store.indexOf(e);
else{
index++;
return search(e);
} -
I teach Continuing education classes to Real Estate agents and I need to issue them certificates at the class, whihc need to be signed by me and it needs to contain their info on the certificate. The certificate is currently saved in a word format.What i'm trying to accomplish is to do a "mail merge " ( as some classes i have as many as 150 attendees) for the document, digitally sign each one with my signature on the certificate and then e-mail it out to the respective attendees. can this be done? if so How?
This is the step that I took after inputting my signature.
On the right, after saving my document, I click "Get Others to Sign." I was confused because it says that it's powered by EchoSign. Like I stated before, my clients are able to sign this document when I send it to them, but it is returned to me with their signature (not in the signature field, but at the end of the document), and my signature is missing. I tested this on myself - my signature is missing when they receive it. -
Hello:
Just today, I was working on a Mac system that does not have any of the applications that I would have expected to need to have installed in order to do more than just decompress movie files compressed with Apple ProRes 422.
I was expecting to have to install Final Cut Studio 3, Final Cut Pro X, Compressor 4, and/or QuickTime 7 with the QuickTime Pro key; however, none of those applications are installed and I am able to create custom QuickTime Apple Pro Res422 Sequences in Premiere Pro as well as export using Apple ProRes 422. After Effects and Adobe Media Encoder also show all the Apple ProRes variations.
Does CC 2014 eliminate the need to have Final Cut Pro and/or Compressor installed to access Apple ProRes 422? Is it something happening on the OS or QuickTime level that would affect CC or CS6 in the same way?
I've done a web search, but haven't really come up with anything other than older articles about needing to have FCP installed (and I typically work on systems with Final Cut Studio 3 installed as well as CS6, CC, or CC 2014). If more detailed information is available, it would be great to be able to read up on it.
The system is a 21.5-inch iMac running Mac OS X 10.8.5, QuickTime Player 10.2, and Adobe Premiere Pro CC 2014 (8.0.0 - I know an update is available for PrPro, but it's not my system to make that change).
Thanks in advance,
Warren HeatonHi Emil:
I use ProRes all the time as well, but I have Final Cut Studio on my workstations.
I had not come across MindPower009's YouTube video. That explains how ProRes could be showing up without FCP or Compressor.
So, the answer to my question would be, "No, CC 2014 does not eliminate the need to have Final Cut Pro and/or Compressor installed to access Apple ProRes 422; however, if you are willing to be in violation Apple's terms of use, you can install the ProRes codecs anyway."
Even though MindPower009's YouTube video comments claim "FREE and LEGAL", it's clear from both the Apple download page and the ProRes codecs installer that Apple expects you to own at least one of their applications.
Thanks again for the link!
-Warren -
Qtn: I have 10 standard elementary search helps in collective standard search help, how to deactivate the 10th elementary search help?
Hello,
this topic is still a problem for me, does anybody have an idea.
Just to show what's my problem:
Collective Search help KRED does include a SAP append-search help ASH_KRED which holds the elementary search helps KREDC, KREDE, KREDM, KREDW.
The search helps KREDE, KREDM, KREDW should not be displayed, so I added another Serach-Help-Append ZKRED_CUST at the end of CSH KRED which holds these 3 SH's with the hidden flag.
That works, the SH's are not shown anymore.
I also added some other of the Original SAP SH's (e.g. KREDA) with the hidden flag and added changed copies of these (e.g ZKREDA) there to be shown instead.
All this can be done modification free by appends.
The folders of the elementary search helps are shown in the order as they are found included in the KRED SH and the append to this SH.
This means that the not hidden Sh KREDC from ASH_KRED is shown before all the "custimized" ZKREDx -SH's. But we need this SH not very often, so that I want it to displayed al the right-most position of the folders of SH's or at the most down postition of the drop-down-selection of SH's.
But I have not found any way to do this modification free.
The only way to archive this is to modify ASH_KRED by setting the Hidden-Flag for KREDC and add this SH at the end of append-SH ZKRED_CUST again.
But I want avoid this modification.
So, is there any way to do this without modifing any of the original SAP SH's ?
Helmut Fischer -
Need a quick answer on advanced search parameters
I am an IT professional, but am not a regular Thunderbird user. I have an e-discovery need to search for multiple terms in a mailbox. The best solution I have found for this is to export the mailbox from Google Apps as an .mbox, and use the importexporttools extension for Thunderbird to import the .mbox.
I then have the mails in a local folder, and right-click on the folder and click on search messages. A number of filters appear, and I put in my terms, select to search within body, for Any results.
This works fine for me but I have two questions:
1. How can I search for something with an apostrophe in it?
For example, if I needed to search for:
'123abc
How would I do it? Quotes? Is there an escape character to state that that needs to be taken literally and isn't a quote or part of a command?
2. Does the search I am performing, or any other way of searching, search within attachments? In Google Apps I can search within attachments - such as text files, or Microsoft Office documents. Is this possible to do?
I searched through the help files and FAQs, but I am not sure if I am using quick filter, or global search etc.
Thanks!There are different methods of searching.
'''Quick Filter:'''
The Quick Filter can be used to search in the selected folder. There are additional filters to refine the search.
* https://support.mozilla.org/en-US/kb/quick-filter-toolbar
'''Global Search: '''
The Global Search can be used to search all accounts. There are additional filters to refine the search.
* https://support.mozilla.org/en-US/kb/global-search
'''Account and folder specific Search:'''
'Edit' > 'Find' > 'Search Messages'
or
'Menu Icon' > 'Find' > 'Search Messages'
A new window opens.
At the top you will see: 'Search for messages in' and you can select the mail account or specific folder from the drop down selection. You can choose to 'Search subfolders' if required.
If you are using one search criteria (condition) or more than one but they all must be true, then select 'Match all of the following' option If you are using more than one condition, but any, not necessarily all, can be true, then use 'Match any of the following'.
example test:
Using Account and folder specific Search method.
I set it to search a particular folder.
selected: 'Body' and 'Contains' and typed: "new
click on 'Search' button
It returned only one message.
when I removed the quote mark so it only said: new (not "new)
clicked on search and it returned several possibilites.
So this worked, returning exactly as required.
When I used the 'Global Search' on same folder typing: "new
It returned a search only on : new
Quick filter method also failed to recognise the " used before new.
So in this instance of searching on: "new
neither Global Search nor Quick filter returned the best result although the message required was included in the selection returned.
The best method which worked as required was Using Account and folder specific Search method.
You can search to return any emails with attachments using 'Account and folder specific Search' method.
Quick Filter and Global filter will search on whether the word 'attachments' is in the eg: Body of email, but not necessarilly locate emails with attachments.
Global search will search to include attachment filenames.
Quick filter does not.
As far as I'm aware, you cannot search the contents of an attachment. -
All receivers of my certified PDF need to verify my certificates
Can anyone tell me of a nice clean way to tell people how they can easily verify my certificates without losing my audiance?
Arbitrary people need to be able to verify the digital time stamp and my digital certificates for use in Adobe Reader. From time to time I would like to send out certified PDFs to complete strangers. I use a personal digital certificate under a Trusted Root with a digital timestamp from a trusted source (e.g. Digistamp.com).
As it stands every method I have been able to figure out is either so laborious for the reader that almost nobody will ever import the certificates.
The easiest way I have found is suspect because it means importing the certificates directly through the PDF, which is really is a rubber stamp process rather than an independent verification process.
It seems to me that there should be a very simple idiot proof way of enabling readers to import the certificates from a trusted source free so that with a couple of key presses they can have the certificates and be able to see the certification at the top of the document in the acrobat reader application or browser.Is your Individual Developer Account as a person or as a company?
From iOS Dev Center / Support / Account Management
If I am enrolled as an individual, can I change to a company membership?
Yes. To convert your iOS Developer Program membership from an individual to a company, please contact us. You can make this change only if you are the founder/co-founder of the company. As part of the conversion process, you may be asked to submit business documents to verify your company's identity.
-=- -
Hi All,
I am using CUIT to write automated UI test cases. I have a dialog containing few edit control and buttons.
While running the test it is able to click the button.
However I am getting few warnings as below.
The target element "Technology Name: 'MSAA';Search Configuration: 'VisibleOnly'; Search Properties - ControlType : 'Button',Name : 'OK'" was not found, so all intermediate elements were ignored. As a result, an incorrect element that matches the target
element's search properties can be found. Verify that all intermediate elements in Query Id have valid and unique search properties.
Technology Name: 'MSAA'
Search Configuration: 'VisibleOnly'
Search Properties -
ControlType : 'Button'
Name : 'OK'
Mouse button : 'Left'
I need to resolve these warning. Can anybody suggest me how to resolve these warnings.Hi sanjay_t,
From these warning message as you provide, I doubt that maybe the button control did not be found successfully by the searchproperties when you playback the Coded UI test.
So I suggest you can try to use DrawHighlight Method to check if the button control
is found before you perform actions on the button target control.
(2)I suggest you can try to use
FindMatchingControls Method on the button control to check if there are more than one control which matches the specified searchproperties and filterproperties.
In addition, as you said that you are using CUIT to write automated UI test. it means that you record the UI action by handing code, am I right?
If yes, I suggest that you can create a simple coded UI test through recording actions using Coded UI Test Builder. Then
generate the code and then try to playback. If playback succeeds, then cross check the properties from UIMap.Designer.cs file. You can reference the code about entering values in the text edit in the UIMap.Designer.cs file to write
your own code.
For more information about how to find a control for coded UI test, I suggest you can refer the following blog.
http://blogs.msdn.com/b/balagans/archive/2009/12/28/9941582.aspx
Best Regards,
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click
HERE to participate the survey. -
I need to have a GOOD Video tutotial on using Elements 11 Magic Wand
I need to have a GOOD Video tutotial on using Elements 11 Magic Wand.
I use Windows 8 onmy laptop. I can't find any good tutorials for Magic want that shows the process to remove backgrounds that works! None of the steps I've seen work for me. HELP. I've wasted a full day trying to find some good videos, which Adobe DOES NOT HAVE on this subject. What's up with that?https://www.google.co.uk/search?q=adobe+tv+magic+wand
https://www.google.co.uk/search?q=photoshop+elements+remove+background
Twenty seconds rather than a whole day.
Cheers,
Neale
Insanity is hereditary, you get it from your children
If this post or another user's post resolves the original issue, please mark the posts as correct and/or helpful accordingly. This helps other users with similar trouble get answers to their questions quicker. Thanks. -
Is there any way to block PDF files sharing from iPad to any another device or cloud? We need to have certain PDFs visible and readable only from iPad.
There are "container" apps emerging for the iPad. Enough searching & I suspect there would be one for your needs.
All in one Application that emphasize security
Good Collaboration Suite Secure mobile app-to-app collaboration.
The Good Collaboration Suite includes Good for Enterprise, Good Share and Good Connect secure mobile apps, simplifying access to email, calendar, contacts, tasks, instant messaging, browsing and document sharing. These apps are built using Good’s next-gen containerization that includes secure data sharing between any Good secured app as well as app-level encryption independent of the device used."
http://www1.good.com/applications/ -
Do I need to have an anti-virus in my mac?
Do I need to have an anti-virus in my mac?
1. This comment applies to malicious software ("malware") that's installed unwittingly by the victim of a network attack. It does not apply to software, such as keystroke loggers, that may be installed deliberately by an intruder who has hands-on access to the victim's computer. That threat is in a different category, and there's no easy way to defend against it. If you have reason to suspect that you're the target of such an attack, you need expert help.
If you find this comment too long or too technical, read only sections 5, 6, and 10.
OS X now implements three layers of built-in protection specifically against malware, not counting runtime protections such as execute disable, sandboxing, system library randomization, and address space layout randomization that may also guard against other kinds of exploits.
2. All versions of OS X since 10.6.7 have been able to detect known Mac malware in downloaded files, and to block insecure web plugins. This feature is transparent to the user, but internally Apple calls it "XProtect." The malware recognition database is automatically checked for updates once a day; however, you shouldn't rely on it, because the attackers are always at least a day ahead of the defenders.
The following caveats apply to XProtect:
It can be bypassed by some third-party networking software, such as BitTorrent clients and Java applets.
It only applies to software downloaded from the network. Software installed from a CD or other media is not checked.
3. Starting with OS X 10.7.5, there has been a second layer of built-in malware protection, designated "Gatekeeper" by Apple. By default, applications and Installer packages downloaded from the network will only run if they're digitally signed by a developer with a certificate issued by Apple. Software certified in this way hasn't necessarily been tested by Apple, but you can be reasonably sure that it hasn't been modified by anyone other than the developer. His identity is known to Apple, so he could be held legally responsible if he distributed malware. That may not mean much if the developer lives in a country with a weak legal system (see below.)
Gatekeeper doesn't depend on a database of known malware. It has, however, the same limitations as XProtect, and in addition the following:
It can easily be disabled or overridden by the user.
A malware attacker could get control of a code-signing certificate under false pretenses, or could simply ignore the consequences of distributing codesigned malware.
An App Store developer could find a way to bypass Apple's oversight, or the oversight could fail due to human error.
For the reasons given above, App Store products, and other applications recognized by Gatekeeper as signed, are safer than others, but they can't be considered absolutely safe. "Sandboxed" applications may prompt for access to private data, such as your contacts, or for access to the network. Think before granting that access. OS X security is based on user input. Never click through any request for authorization without thinking.
4. Starting with OS X 10.8.3, a third layer of protection has been added: a "Malware Removal Tool" (MRT). MRT runs automatically in the background when you update the OS. It checks for, and removes, malware that may have evaded the other protections via a Java exploit (see below.) MRT also runs when you install or update the Apple-supplied Java runtime (but not the Oracle runtime.) Like XProtect, MRT is effective against known threats, but not against unknown ones. It notifies you if it finds malware, but otherwise there's no user interface to MRT.
5. The built-in security features of OS X reduce the risk of malware attack, but they're not absolute protection. The first and best line of defense is always going to be your own intelligence. With the possible exception of Java exploits, all known malware circulating on the Internet that affects a fully-updated installation of OS X 10.6 or later takes the form of so-called "trojan horses," which can only have an effect if the victim is duped into running them. The threat therefore amounts to a battle of wits between you and the malware attacker. If you're smarter than he thinks you are, you'll win.
That means, in practice, that you never use software that comes from an untrustworthy source, or that does something inherently untrustworthy. How do you know what is trustworthy?
Any website that prompts you to install a “codec,” “plug-in,” "player," "extractor," or “certificate” that comes from that same site, or an unknown one, is untrustworthy.
A web operator who tells you that you have a “virus,” or that anything else is wrong with your computer, or that you have won a prize in a contest you never entered, is trying to commit a crime with you as the victim. (Some reputable websites did legitimately warn visitors who were infected with the "DNSChanger" malware. That exception to this rule no longer applies.)
Pirated copies or "cracks" of commercial software, no matter where they come from, are unsafe.
Software of any kind downloaded from a BitTorrent or from a Usenet binary newsgroup is unsafe.
Software that purports to help you do something that's illegal or that infringes copyright, such as saving streamed audio or video for reuse without permission, is unsafe. All YouTube "downloaders" are in this category, though not all are necessarily harmful.
Software with a corporate brand, such as Adobe Flash Player, must be downloaded directly from the developer’s website. If it comes from any other source, it's unsafe.
Even signed applications, no matter what the source, should not be trusted if they do something unexpected, such as asking for permission to access your contacts, your location, or the Internet for no obvious reason.
6. Java on the Web (not to be confused with JavaScript, to which it's not related, despite the similarity of the names) is a weak point in the security of any system. Java is, among other things, a platform for running complex applications in a web page, on the client. That was always a bad idea, and Java's developers have proven themselves incapable of implementing it without also creating a portal for malware to enter. Past Java exploits are the closest thing there has ever been to a Windows-style virus affecting OS X. Merely loading a page with malicious Java content could be harmful.
Fortunately, client-side Java on the Web is obsolete and mostly extinct. Only a few outmoded sites still use it. Try to hasten the process of extinction by avoiding those sites, if you have a choice. Forget about playing games or other non-essential uses of Java.
Java is not included in OS X 10.7 and later. Discrete Java installers are distributed by Apple and by Oracle (the developer of Java.) Don't use either one unless you need it. Most people don't. If Java is installed, disable it — not JavaScript — in your browsers.
Regardless of version, experience has shown that Java on the Web can't be trusted. If you must use a Java applet for a task on a specific site, enable Java only for that site in Safari. Never enable Java for a public website that carries third-party advertising. Use it only on well-known, login-protected, secure websites without ads. In Safari 6 or later, you'll see a lock icon in the address bar with the abbreviation "https" when visiting a secure site.
Follow the above guidelines, and you’ll be as safe from malware as you can practically be. The rest of this comment concerns what you should not do to protect yourself from malware.
7. Never install any commercial "anti-virus" or "Internet security" products for the Mac, as they all do more harm than good, if they do any good at all. Any database of known threats is always going to be out of date. Most of the danger is from unknown threats. If you need to be able to detect Windows malware in your files, use one of the free anti-virus products in the Mac App Store — nothing else.
Why shouldn't you use commercial "anti-virus" products?
Their design is predicated on the nonexistent threat that malware may be injected at any time, anywhere in the file system. Malware is downloaded from the network; it doesn't materialize from nowhere.
In order to meet that nonexistent threat, the software modifies or duplicates low-level functions of the operating system, which is a waste of resources and a common cause of instability, bugs, and poor performance.
By modifying the operating system, the software itself may create weaknesses that could be exploited by malware attackers.
8. An anti-malware product from the App Store, such as "ClamXav," doesn't have these drawbacks. That doesn't mean it's entirely safe. It may report email messages that have "phishing" links in the body, or Windows malware in attachments, as infected files, and offer to delete or move them. Doing so will corrupt the Mail database. The messages should be deleted from within the Mail application.
An anti-virus app is not needed, and should not be relied upon, for protection against OS X malware. It's useful only for detecting Windows malware. Windows malware can't harm you directly (unless, of course, you use Windows.) Just don't pass it on to anyone else.
A Windows malware attachment in email is usually easy to recognize. The file name will often be targeted at people who aren't very bright; for example:
♥♥♥♥♥♥♥♥♥♥♥♥♥♥!!!!!!!H0TBABEZ4U!!!!!!!.AVI♥♥♥♥♥♥♥♥♥♥♥♥♥♥.exe
Anti-virus software may be able to tell you which particular virus or trojan it is, but do you care? In practice, there's seldom a reason to use the software unless a network administrator requires you to do it.
The ClamXav developer won't try to "upsell" you to a paid version of the product. Other developers may do that. Don't be upsold. For one thing, you should not pay to protect Windows users from the consequences of their choice of computing platform. For another, a paid upgrade from a free app will probably have the disadvantages mentioned in section 7.
9. It seems to be a common belief that the built-in Application Firewall acts as a barrier to infection, or prevents malware from functioning. It does neither. It blocks inbound connections to certain network services you're running, such as file sharing. It's disabled by default and you should leave it that way if you're behind a router on a private home or office network. Activate it only when you're on an untrusted network, for instance a public Wi-Fi hotspot, where you don't want to provide services. Disable any services you don't use in the Sharing preference pane. All are disabled by default.
10. As a Mac user you don't have to live in fear that your computer is going to be infected every time you install an application, read email, or visit a web page. But neither should you have the false idea that you will always be safe, no matter what you do. The greatest harm done by security software is precisely its selling point: it makes people feel safe. They may then feel safe enough to take risks from which the software doesn't protect them. Nothing can lessen the need for safe computing practices. -
All i need to know is what to search!
I'm actually not trying to duplicate this, but it's the
easiest way to describe it.
I need to know what i should search in order to achieve an
effect similar to the intro of an XBOX consol (the green floaty
ball thing)
I need to know how to manipulate an object so it looks like
its round (photoshop, i bet.) and possibly spinning ( i dont know
what it's called to create objects that can have unseen features
like spinning a ball that has 1 on one side and 2 on the other, so
that both numbers show up at a certain time.)
also i would like to know how i can manipulate an object with
an animation similar (but probably more emphasised) to the
stretching ( i guess) one in place on the console.
So i'm basically looking for terms that decribe what i'm
talking about or tutorials that teach it. Helpful advise is good
too.
Thanks3d animation.
-
I need to have both Next & Back buttons displayed for viewing 20 records at
Hi Everybody,
I have a JSP page which has 2 part: The header (Selection for search with the SEARCH button) and a search result table.
Is it possible to remember the last record printed & start from the next record when I click on "Next" button? When I click on the "Next" button will it create new page? I need to have both Next & Back buttons displayed for viewing 20 records at a time.
The current JSP is using "session.removeAttribute("XXXWorkItemVector") to print out records.
I'm very new to JAVA and JSP, so please help me with my assignment and send me e-mail to [email protected]Check this:
http://forum.java.sun.com/thread.jsp?forum=45&thread=188239
This should be of help to you.
Maybe you are looking for
-
Keychain: cannot add a new item
i'm getting an error now when i try to add an item to my keychain... An error has occurred. Unable to add an item to the current keychain. 1000013 any idea of what's going on? i tried running keychain firstaid... tried restarting keychain... nothing.
-
Fade effect bold text in all IEs
I have created the following page Cnet about and used the spry fade effect on the section of text at the bottom below the "A Sampling of what we offer" graphic. It works fine but in IE6 and IE7 when viewed on an LCD monitor, the bold blue text looks
-
Safari 4.0.3 (Snow Leopard) ExternalInterface crash
The ExternalInterface callbacks on several sites that I've setup have begun crashing the new Safari shipping with Snow Leopard. Anyone else seen anything about this?
-
I just installed Photoshop elements 11. Install of the application was fine. When I clicked to open Organizer, I received a messaging indicating that it was out of date and coudl not be upgraded. How can I address/fix this?
-
Perhaps there is documentation that tells me this, but I only have the changelog and install docs. I need to submit a design document to our security team before CPO will be allowed to run any of our PROD environments. I understand that I can