Maths (simple sum) based form security for preventing spam

I'm looking at possibly implementing a math/arithmetic type of spam prevention solution (within a few forms on our site) and have been led to believe the solution is a rather complex one that requires knowledge of php to write.
However, I believe I've found a ready-made solution that simply requires the user to insert suggested bits of code on your form/page and it should work.
Before I start investing time in it, could anybody with some knowledge of these php anti-spam solutions confirm for me whether the following solution is likely to work, and is it as simple as it's suggested in the article? This solution can be found on the following page: http://www.lateralcode.com/basic-math-security/
Also, could that math security code work well in conjunction with the 'honeypot' code (that I'm already trying out) or is it likely to create a problem with the two clashing? Would you recommend using them together? Thanks.

Max Miguta wrote:
I'm looking at possibly implementing a math/arithmetic type of spam prevention solution (within a few forms on our site) and have been led to believe the solution is a rather complex one that requires knowledge of php to write.
However, I believe I've found a ready-made solution that simply requires the user to insert suggested bits of code on your form/page and it should work.
Before I start investing time in it, could anybody with some knowledge of these php anti-spam solutions confirm for me whether the following solution is likely to work, and is it as simple as it's suggested in the article? This solution can be found on the following page: http://www.lateralcode.com/basic-math-security/
Also, could that math security code work well in conjunction with the 'honeypot' code (that I'm already trying out) or is it likely to create a problem with the two clashing? Would you recommend using them together? Thanks.
I don't know why you would need to go to the lengths of that article to be honest creating this function and that function. In my opinion is really rather overkill.
You can set this up really rather simply - Heres a form with randomly generated numbers:
<?php session_start();?>
<?php
$_SESSION[firstNo] = rand(1,10);
$_SESSION[secondNo] = rand(1,10);
?>
<!DOCTYPE HTML>
<html>
<head>
<meta charset="UTF-8">
<title>Website Form</title>
</head>
<body>
<form id="mailForm" method="post" action="validate.php">
<p>
<label for="name">Name</label><br>
<input type="text" id="name" name="name">
</p>
<p>
<label for="email">Email Address</label><br>
<input type="text" id="email" name="email">
</p>
<p>
<label for="address">Address</label><br>
<input type="text" id="address" name="address">
</p>
<p>
<label for="comments">Comments</label><br>
<textarea id="comments" name="comments"></textarea>
</p>
<p>
<label for="number"><?php echo $_SESSION[firstNo]." + ".$_SESSION[secondNo]." ="; ?></label><br>
<input name="number" type="text">
</p>
<p>
<input type="submit" name="submit" id="submit" value="submit">
</p>
</form>
</body>
</html>
Heres the validate php file that will check that the number entered on the form is correct and if it is will send the post. If it isn't the script will stop running. Just change $to = "[email protected] to your email address
<?php session_start();?>
<?php
$correctNo = $_SESSION[firstNo] + $_SESSION[secondNo];
// get name
$name = trim($_POST['name']);
// get email address
$email = trim($_POST['email']);
// get address
$address = trim($_POST['address']);
// get comments
$comments = stripslashes(trim($_POST['comments']));
$to = "[email protected]";
$subject = "Comments from website";
$headers = "From: $email\r\n";
$headers .= "Reply-To: $email\r\n";
$message = "Name: $name\n\n";
$message .= "Email Address: $email\n\n";
$message .= "Address: $address\n\n";
$message .= "Comments: $comments\n\n";
if($_POST['number'] == $correctNo) {
mail($to, $subject, $message, $headers);
else {
exit;
?>
As for the honeypot in conjunction with the maths solution, yes you can leave that in as it will do no harm

Similar Messages

How to develop simple time based ramp driver for lab view VI

how do I develop simple time based ramp driver for lab view VI

Here it is converted to LabVIEW 2010. However it is missing the AO and AI read and write vis since I don't have that package.
Attachments:
SRI_TimeProportion.vi ‏70 KB

Making a PDF Form secure for emailing

I have created an enrollment form with LiveCyle. The employer will send the application to a new employee for them to fill out and they would like it emailed back to them. I tried the submit button but that doesn't work because while the information they input is received in a .xml file the electronic signature does not transfer which is required. Can I set it up encrypted so that only the information that is input is encrypted? I am VERY new to creating forms and using LiveCycle. Thank you!

The way I think you are trying it in Reader won't give you want you need. If you want to hide the data in the XML email submission (from email submit button), you need the newer capabilities in Designer 10.x to encrypt the submission. The XML contents will look like this after it is encrypted:
<?xml version="1.0" encoding="UTF-8"?>
<xfa:data xmlns:xfa="http://www.xfa.org/schema/xfa-data/1.0/"
><EncryptedData xmlns="http://www.w3.org/2001/04/xmlenc#" Id="encrypteddata_2" Type="http://www.w3.org/2001/04/xmlenc#Element"
><EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"
/><KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#"
><EncryptedKey xmlns="http://www.w3.org/2001/04/xmlenc#"
><EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"
/><KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#"
><X509Data
><X509Certificate
>MIICRTCCAa6gAwIBAgIKNvzDsAiaeyPYFDANBgkqhkiG9w0BAQUFADBTMREwDwYDVQQDEwhKb2hu
IERvZTEJMAcGA1UEChMAMQkwBwYDVQQLEwAxGzAZBgkqhkiG9w0BCQEWDGpkb2VAYWJjLmNvbTEL
MAkGA1UEBhMCVVMwHhcNMTExMTAzMjA1MjAwWhcNMTYxMTAzMjA1MjAwWjBTMREwDwYDVQQDEwhK
b2huIERvZTEJMAcGA1UEChMAMQkwBwYDVQQLEwAxGzAZBgkqhkiG9w0BCQEWDGpkb2VAYWJjLmNv
bTELMAkGA1UEBhMCVVMwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAL12YAntp+1ZzsNpew5H
+s5fwLjK3TdiFfMrJuV1jEG2xlvJPOvKujSeR+4iHlBTQbYxkZ5nvhkwQi9KDgeriuMjg/TclkJP
CD0h//4fnP4tQqTUAZ92r6nMRqFxviEhysETMQl01SGDUlmSjhvWJctPU+krq+wwuwVbPJgU8Iu5
AgMBAAGjIDAeMA8GCSqGSIb3LwEBCgQCBQAwCwYDVR0PBAQDAgSQMA0GCSqGSIb3DQEBBQUAA4GB
AK+TIhyZZtYtxrVz5lq/zl8mczRnUCsJcapXJhY/oJnN2izALPAYnA4eBr7LBbl1Hf12op+LJuoU
j5FHhB+eQzKlhqkC/alFwmGdxCBYUfpZKWGBUuuW+00mTCStsmTIaSi/XS6K+Y5+0fqAJ48y56lb
o/kjbxSjzHWszfeOzafF</X509Certificate
></X509Data
></KeyInfo
><CipherData
><CipherValue
>ADk2Kxut+M84Pi4B1ZC9znKFCz2rAfHYZNZ76fWK/eRE5QMC0NhCnQ5gFfrOLU9Wl/5FOTZMwQab
F1PjdKaVys0TjOR51HH1A6D/ZUf7baBQ1XnKRW5kQR8xePwwDaRoyBopF8+XeWA6d8yRXvyZdLJa
Hju2/gUR/M2HArKCtso=</CipherValue
></CipherData
></EncryptedKey
></KeyInfo
><CipherData
><CipherValue
>uiKSewcq2Of8cIk7hRnjFmOpTo+XxN6AZM5PyT+k2d1mUuBlbJWxCk37EFiwVHRH5n4oOQkuFFhv
+jopOPQLbthkdhiDzWHmAJhstaPcbvA=</CipherValue
></CipherData
><EncryptionProperties
><EncryptionProperty xfa:processingRule="replacementContent"
><form1
/></EncryptionProperty
></EncryptionProperties
></EncryptedData
><signatures
><Signature xmlns="http://www.w3.org/2000/09/xmldsig#" Id="datasignature_2"
><SignedInfo
><CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#WithComments"
/><SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"
/><Reference URI="#idbfea09cc-7f34-11e1-9c29-002710682eb5" Type="http://www.w3.org/2000/09/xmldsig#SignatureProperties"
><Transforms
><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#WithComments"
/></Transforms
><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"
/><DigestValue
>O9E5XR6E+tkicSPa6HTZgkE9qhE=</DigestValue
></Reference
><Reference URI=""
><Transforms
><Transform Algorithm="http://www.w3.org/2002/06/xmldsig-filter2"
><XPath xmlns="http://www.w3.org/2002/06/xmldsig-filter2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" Filter="intersect"
>here()/ancestor::dsig:Signature[1]/../..//. |
here()/ancestor::dsig:Signature[1]/../..//@* |
here()/ancestor::dsig:Signature[1]/../..//namespace::*</XPath
></Transform
><Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"
/><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#WithComments"
/></Transforms
><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"
/><DigestValue
>v9suUKmCN2M3JeTTr2y5/L6ZY64=</DigestValue
></Reference
></SignedInfo
><SignatureValue
>DYCW4mlxVOr+EmleCo56aohSGw93gtk2Wc5Rb7zlB8ukTSC9lozQM1rGLv4GykpQ+Ln+XhKCzVqv
Z7jcISv2l+1rWWpBSyhve+szoWSoY90SEtPUwnJMwxeOy6fOyGx5MWCqVj6D308Pcu2dw7r3UMqc
i6rSWUezvsPjfCBrcW8=</SignatureValue
><KeyInfo
><X509Data
><X509Certificate
>MIICRTCCAa6gAwIBAgIKNvzDsAiaeyPYFDANBgkqhkiG9w0BAQUFADBTMREwDwYDVQQDEwhKb2hu
IERvZTEJMAcGA1UEChMAMQkwBwYDVQQLEwAxGzAZBgkqhkiG9w0BCQEWDGpkb2VAYWJjLmNvbTEL
MAkGA1UEBhMCVVMwHhcNMTExMTAzMjA1MjAwWhcNMTYxMTAzMjA1MjAwWjBTMREwDwYDVQQDEwhK
b2huIERvZTEJMAcGA1UEChMAMQkwBwYDVQQLEwAxGzAZBgkqhkiG9w0BCQEWDGpkb2VAYWJjLmNv
bTELMAkGA1UEBhMCVVMwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAL12YAntp+1ZzsNpew5H
+s5fwLjK3TdiFfMrJuV1jEG2xlvJPOvKujSeR+4iHlBTQbYxkZ5nvhkwQi9KDgeriuMjg/TclkJP
CD0h//4fnP4tQqTUAZ92r6nMRqFxviEhysETMQl01SGDUlmSjhvWJctPU+krq+wwuwVbPJgU8Iu5
AgMBAAGjIDAeMA8GCSqGSIb3LwEBCgQCBQAwCwYDVR0PBAQDAgSQMA0GCSqGSIb3DQEBBQUAA4GB
AK+TIhyZZtYtxrVz5lq/zl8mczRnUCsJcapXJhY/oJnN2izALPAYnA4eBr7LBbl1Hf12op+LJuoU
j5FHhB+eQzKlhqkC/alFwmGdxCBYUfpZKWGBUuuW+00mTCStsmTIaSi/XS6K+Y5+0fqAJ48y56lb
o/kjbxSjzHWszfeOzafF</X509Certificate
></X509Data
></KeyInfo
><Object
><SignatureProperties Id="idbfea09cc-7f34-11e1-9c29-002710682eb5"
><SignatureProperty Target="datasignature_2"
><PROP_Sig xmlns="http://ns.adobe.com/pdf/2006" type="cabinet"
><M type="text"
>D:20120405113353-04'00'</M
><Name type="text"
>John</Name
></PROP_Sig
></SignatureProperty
></SignatureProperties
></Object
></Signature
></signatures
></xfa:data
>
In the Designer version you have (8.2), you only have the capability to sign the data or the entire form, which will not hide its values in the XML file that gets sent.

Error in generating PDF Based form - SUI Report

Hi,
We are running Quarterly reports for Unemployment reporting at USA using tax reporter.
We are not able to see the complete spool output for the Wage Type Listings but only just 1 page. In the tax reporter log we get the error "Error in generating PDF Based form HR_F_WLIST_CA" for respective states.
Any idea how to resolve this.
We are on ERP 6.04.
Thanks,

Hi,
I think its Basis problem.Ask basis gyus to repair the connection and try again.
Regards,
Manoj.

Generate Turing Number for form submission to prevent automated registraton

Hi,
How I want to have a script to generate and check a turing number. A turing number is a number the user has to read and copy in order to be able to validate a form. This avoids automated submissions. Just like when you register for yahoo mail etc it asks for this number to prevent automated registrations. Any help is appreciated.
Thanks

Just so happens 3 days ago, I took a few hours to research and write a few methods that generate a "turing" sequence of characters and numbers or custom and write an image, I call them viverification (vivo = life , verify = proof) images. Very simple, I have different methods for different needs in my client application code. Here are the methods:
     * Returns a random character chosen from the input charset. If the charset is an empty string returns a char
     * from the set:
     *"1AaBb2CcDdEe3FfGgHh4IiJjKk5LlMmNn6OoPp7QqRr8SsTt9UuVvWw0XxYyZz"
     * Implicit use of the java.util.Random() provides the pseudo random selection algorithm. Iteration of provided set
     * means that efficiency decreases with char set length, so use of very long charsets will incur a performance penalty.
     * If you desire simply to have a random roman letter provided , the getRandomRomanLetter(boolean) allows returning upper case
     * or mixed case chars.
     *@param String charset -- The set of characters to use as random selection items. If you provide "eaAVB456" the output will be randomized
     * about those 8 characters returning. "e" or "B" or "4" ...in a random fashion.
     *@returns char -- A randomly selected char from the string provided as charset.
    public static char getRandomCharFromString(String charset) {
        if(charset.trim().equals("")) charset = "1AaBb2CcDdEe3FfGgHh4IiJjKk5LlMmNn6OoPp7QqRr8SsTt9UuVvWw0XxYyZz";
        java.util.Random ur = new java.util.Random();
        java.text.StringCharacterIterator sci = new StringCharacterIterator("");
        sci.setText(charset);
        sci.setIndex(ur.nextInt(charset.length()));
        return sci.current();
     * Returns a random character chosen from a character set as defined by the boolean mixed case.
     * Implicit use of the java.util.Random() provides the pseudorandom selection algorithm. Iteration of provided set
     * means that efficiency decreases with char set length, so use of very long charsets will incur a performance penalty.
     * If you desire simply to have a random letter from an arbitrary string of characters, the getRandomCharFromString(String)
      *a char from a user provided set.
     * @param boolean mixed case -- If false, returns only chars from the set [A...Z] if true returns char from set. [aAbB...zZ]
      *@returns char -- A randomly selected char from the string provided as charset.
    public static char getRandomRomanLetter(boolean mixedcase) {
        String set = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
        if(mixedcase) set = "AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVvWwXxYyZz";
        return Utilities.getRandomCharFromString(set);
     * Generates a 7 character Viverification Image used to confirm that only in vivo agents are filling out forms presented with the image.
     * The generated characters have forced capital roman letters at start and ends with 5 numerals in the center like: <p>
     * S35872F or R87356H
     * In conjunction with a confirmation field, the characters generated in the image can be matched against the returned string
     * value of those characters returned by this method to ensure a human agent filled out the form. An obfuscation diagonal line is
     * drawn across the embedded sequence to obfuscate the image from OCR discovery techniques. This prevents bots from
     * being programmed to fill out forms or create accounts on systems built using the framework.
     * @param String path -- The fully qualified file path on the system to write the generated jpeg image file along with the file name.
     * @param int width -- The width of the generated image. Must be long enough to accommodate the 7 characters as rendered on the generating platform to avoid truncation.
     * @param int height -- The height of the generated image.
     * @returns String -- If the Image generation succeeded, the string of the randomly generated character embedded in the generated image, empty string otherwise.
    public static String createViverificationImageAtPath(String path,int width, int height) throws IOException {
        String out = "";
        java.awt.image.BufferedImage bi = new java.awt.image.BufferedImage(width,height,BufferedImage.TYPE_INT_RGB);
        String viver = (int)((float)Math.random() * 100000) + "";
        viver = Utilities.getRandomRomanLetter(false) + viver + Utilities.getRandomRomanLetter(false);
        Graphics2D g2d = bi.createGraphics();
       // g2d.setBackground(new Color(200,200,200));
        g2d.drawString(viver,3,height - 5);
        g2d.drawLine(0,height,width,0);
        ImageIO.write(bi,"jpeg",new File(path));
        return viver;
     * Generates a n character Viverification Image used to confirm that only in vivo agents are filling out forms presented with the image.
     * Where n is the length of the input message string.
     * In conjunction with a confirmation field, the characters generated in the image are matched against the returned string
     * value of those characters returned by this method to ensure a human agent filled out the form. This prevents bots from
     * being programmed to fill out forms or create accounts on systems built using the framework. Provides a boolean to enable
     * or disable character obfuscation using a line drawn diagonally across the image text. This prevents OCR automated tools
     * from being used to divine the characters. Accepts a custom desired string rather
     * than generating a random string as is done in createViverificationImageAtPath().
     * @param String path -- The fully qualified file path on the system to write the generated jpeg image file along with the file name.
     * @param String messg -- The desired message string to insert into the image, input image width must be long enough to accomodate the text or it will be truncated.
     * @param int width -- The width of the generated image.messg character string must be less than this width otherwise it will be truncated.
     * @param int height -- The height of the generated image.
     * @returns String -- If the Image generation succeeded, the string of the randomly generated character embedded in the generated image, empty string otherwise.
    public static String createViverificationImageAtPathWithString(String path,String messg,int width, int height,boolean obfuse) throws IOException {
        String out = "";
        java.awt.image.BufferedImage bi = new java.awt.image.BufferedImage(width,height,BufferedImage.TYPE_INT_RGB);
        String viver = messg;
        Graphics2D g2d = bi.createGraphics();
        g2d.drawString(viver,3,height - 5);
        if(obfuse) g2d.drawLine(0,height,width,0);
        ImageIO.write(bi,"jpeg",new File(path));
        return viver;
    }You'll just need to import the requisite java packages used and you are good to go. If you want to make more complex images you can investigate the image API's further to get a more fancy (though it really is pointless to do so) minimally visually obfuscated images are all you need to thwart even the best subversive OCR (optical character recognition) algorithms that might be used by nefarious agents to spoof viverification.
Use:
Ideally you'd call the method as part of generating a page for an authentication or form in a dynamic fashion. (jsp /servlet) The returned string will allow the method to verify the sequence generated against the value returned by the vivo agent viewing the form. As part of validation you would write simple code to check if the string returned during the image generation doesn't match the form field for agent entry. If so you can deny the action, otherwise you can authorize it.
Enjoy!
Regards,
David

CRM 2011: Can you control which form is used based not security roles, but on a field value?

I see that you can control which form is used based on security roles, but can you control it based on other field values? I'd like a new record to use a different form until a given status is updated. I have a status of draft and active. So
it would be nice if I could use form1 for those in draft, form2 for those that are active. But I only see where you can control that via the security roles.
I can code all of this via JavaScript, but having the ability to use two separate forms would be nice. Is that even possible.
Best regards,
Jon Gregory Rothlander

Hello,
Recheck following article - http://gonzaloruizcrm.blogspot.com/2014/11/avoiding-form-reload-when-switching-crm.html
Dynamics CRM MVP/ Technical Evangelist at SlickData LLC
My blog

I am using Numbers on my iPhone5 and cannot get the app to do a simple (SUM) calculation. It shows the formula correctly in the cell, but all I get for my long list of numbers to add is 0. How can I get this to work?

I am using Numbers on my iPhone5 and cannot get the app to do a simple (SUM) calculation. It shows the formula correctly in the cell, but all I get for my long list of numbers to add is 0. How can I get this to work?

Oaky, at least we got that far. Next step is to determine if all those "numbers" are really numbers. Changing the format to "number" doesn't necessarily change the string to a number. The string has to be in the form of a number. Some may appear to you and me as numbers but will not turn into "numbers" when you change the formatting from Text to Number. Unless you've manually formatted the cells to be right justified, one way to tell if it is text or a number is the justification. Text will be justified to the left, numbers will be justified to the right.
Here are some that will remain as strings:
+123
123 with a space after it.
.123

PDF-based forms for cash-book documentation

Dear colleagues,
Can you please help us with one guestion:
Are there any ready PDF-based forms for cash-book documentation (forms KO-3 and KO-4) in SAP?

Hello,
I am facing the same problem, working with ERP 60
Did you get a response about KO-3 and KO-4 pdf-based forms for cash-book documentation?
Best Regards,
Ernesto.

Is there a utility to import security for Forms?

I have used the importsecurity.exe utility to successfully import entity, account, and other dimension security. But it doesn't work for Form security. Is there another way or a way to trick the utility and use it for forms?
Version 9.2.1 Windows environment. SQL server is the database
Thanks
Wags

Thanks John.
I have over 200 forms for one application with over 700 lines of security.
As a test, I manually added a few rows of security directly into the HSP_access_control table and restarted the planning service and that worked. So it looks like I could load all the data directly via a SQL query to accomplish this. I merely need to match-up my object names and related object security from PROD to the object_id's and group ID's in Dev (which are slightly different due to dev and prod security being out of sync)
Any thoughts on what could go wrong??
Jeff

Developer 6i Forms/Reports for AIX-Based 5L

Hi,
Where can I find the download link for Developer 6i Forms/Reports for AIX-Based 5L (64-bit) from Oracle website?? I can only find Developer 6i for Linux/Solaris/Windows..
Thanks,
Kelvin

Quick links to latest patchsets ==> Oracle Developer ==> <platform> ==> 6i ==> voilà!
Werner

Replacing Adobe forms with Smart Forms for printing FPM based forms

Hello All,
This pertains to HCM Process and Forms with Floor Plan Manager (FPM) based forms.
SAP has provided Adobe Forms as the standard print option for FPM based forms, as can be seen in the attached screenshot.
We want to use the FPM based forms without using Adobe Document Services (ADS). I am checking the feasibility of replacing the PDF forms with Smart Forms, either through configuration or customization.
System Landscape: ECC 6.0 EhP6
Any inputs or suggestions would be greatly appreciated.
Regards,
Arun.

Hi Ketul,
Irrespective of the process or scenario, we would like to use Smart Forms instead of Adobe Forms. As seen in the screenshot, SAP has provided the default option of generating a PDF form. This requires installing and using Adobe Document Services. We would like to remove this dependency on Adobe Document Services.
Instead, we would like to use Smart Forms for printing purposes.
This requirement is not tied to any specific process or scenario, but to any business process implemented using HCM Process and Forms framework.
Let me know if you need any further clarifications.
Regards,
Arun.

Can anyone suggest a app or programme for creating a simple text based logo with a font I already own?

Hi.
I run my own company and would like to create my own simple text based logo using a font I've downloaded. Can anyone suggest an app or programme that will be simple enough for a dunce like me to create vectored graphics and reliable enough to create something professional and usable, please?
Thanks.

I believe if you copy the font into the font folder, any application should be able to use that font.

It was advised on a radio program to get Security for Macs as they are becoming a target. Is this the case?

It was advised on a radio program to get Security for Macs as they are becoming a target. Is this the case?

Mac users often ask whether they should install "anti-virus" software. The answer usually given on ASC is "no." The answer is right, but it may give the wrong impression that there is no threat from what are loosely called "viruses." There is a threat, and you need to educate yourself about it.
1. This is a comment on what you should—and should not—do to protect yourself from malicious software ("malware") that circulates on the Internet and gets onto a computer as an unintended consequence of the user's actions. It does not apply to software, such as keystroke loggers, that may be installed deliberately by an intruder who has hands-on access to the computer, or who has been able to take control of it remotely. That threat is in a different category, and there's no easy way to defend against it.
The comment is long because the issue is complex. The key points are in sections 5, 6, and 10.
OS X now implements three layers of built-in protection specifically against malware, not counting runtime protections such as execute disable, sandboxing, system library randomization, and address space layout randomization that may also guard against other kinds of exploits.
2. All versions of OS X since 10.6.7 have been able to detect known Mac malware in downloaded files, and to block insecure web plugins. This feature is transparent to the user. Internally Apple calls it "XProtect."
The malware recognition database used by XProtect is automatically updated; however, you shouldn't rely on it, because the attackers are always at least a day ahead of the defenders.
The following caveats apply to XProtect:
☞ It can be bypassed by some third-party networking software, such as BitTorrent clients and Java applets.
☞ It only applies to software downloaded from the network. Software installed from a CD or other media is not checked.
As new versions of OS X are released, it's not clear whether Apple will indefinitely continue to maintain the XProtect database of older versions such as 10.6. The security of obsolete system versions may eventually be degraded. Security updates to the code of obsolete systems will stop being released at some point, and that may leave them open to other kinds of attack besides malware.
3. Starting with OS X 10.7.5, there has been a second layer of built-in malware protection, designated "Gatekeeper" by Apple. By default, applications and Installer packages downloaded from the network will only run if they're digitally signed by a developer with a certificate issued by Apple. Software certified in this way hasn't necessarily been tested by Apple, but you can be reasonably sure that it hasn't been modified by anyone other than the developer. His identity is known to Apple, so he could be held legally responsible if he distributed malware. That may not mean much if the developer lives in a country with a weak legal system (see below.)
Gatekeeper doesn't depend on a database of known malware. It has, however, the same limitations as XProtect, and in addition the following:
☞ It can easily be disabled or overridden by the user.
☞ A malware attacker could get control of a code-signing certificate under false pretenses, or could simply ignore the consequences of distributing codesigned malware.
☞ An App Store developer could find a way to bypass Apple's oversight, or the oversight could fail due to human error.
Apple has so far failed to revoke the codesigning certificates of some known abusers, thereby diluting the value of Gatekeeper and the Developer ID program. These failures don't involve App Store products, however.
For the reasons given, App Store products, and—to a lesser extent—other applications recognized by Gatekeeper as signed, are safer than others, but they can't be considered absolutely safe. "Sandboxed" applications may prompt for access to private data, such as your contacts, or for access to the network. Think before granting that access. Sandbox security is based on user input. Never click through any request for authorization without thinking.
4. Starting with OS X 10.8.3, a third layer of protection has been added: a "Malware Removal Tool" (MRT). MRT runs automatically in the background when you update the OS. It checks for, and removes, malware that may have evaded the other protections via a Java exploit (see below.) MRT also runs when you install or update the Apple-supplied Java runtime (but not the Oracle runtime.) Like XProtect, MRT is effective against known threats, but not against unknown ones. It notifies you if it finds malware, but otherwise there's no user interface to MRT.
5. The built-in security features of OS X reduce the risk of malware attack, but they are not, and never will be, complete protection. Malware is a problem of human behavior, not machine behavior, and no technological fix alone is going to solve it. Trusting software to protect you will only make you more vulnerable.
The best defense is always going to be your own intelligence. With the possible exception of Java exploits, all known malware circulating on the Internet that affects a fully-updated installation of OS X 10.6 or later takes the form of so-called "Trojan horses," which can only have an effect if the victim is duped into running them. The threat therefore amounts to a battle of wits between you and Internet criminals. If you're better informed than they think you are, you'll win. That means, in practice, that you always stay within a safe harbor of computing practices. How do you know when you're leaving the safe harbor? Below are some warning signs of danger.
Software from an untrustworthy source
☞ Software with a corporate brand, such as Adobe Flash Player, doesn't come directly from the developer’s website. Do not trust an alert from any website to update Flash, or your browser, or any other software. A genuine alert that Flash is outdated and blocked is shown on this support page. Follow the instructions on the support page in that case. Otherwise, assume that the alert is fake and someone is trying to scam you into installing malware. If you see such alerts on more than one website, ask for instructions.
☞ Software of any kind is distributed via BitTorrent, or Usenet, or on a website that also distributes pirated music or movies.
☞ Rogue websites such as Softonic, Soft32, and CNET Download distribute free applications that have been packaged in a superfluous "installer."
☞ The software is advertised by means of spam or intrusive web ads. Any ad, on any site, that includes a direct link to a download should be ignored.
Software that is plainly illegal or does something illegal
☞ High-priced commercial software such as Photoshop is "cracked" or "free."
☞ An application helps you to infringe copyright, for instance by circumventing the copy protection on commercial software, or saving streamed media for reuse without permission. All "YouTube downloaders" are in this category, though not all are necessarily malicious.
Conditional or unsolicited offers from strangers
☞ A telephone caller or a web page tells you that you have a “virus” and offers to help you remove it. (Some reputable websites did legitimately warn visitors who were infected with the "DNSChanger" malware. That exception to this rule no longer applies.)
☞ A web site offers free content such as video or music, but to use it you must install a “codec,” “plug-in,” "player," "downloader," "extractor," or “certificate” that comes from that same site, or an unknown one.
☞ You win a prize in a contest you never entered.
☞ Someone on a message board such as this one is eager to help you, but only if you download an application of his choosing.
☞ A "FREE WI-FI !!!" network advertises itself in a public place such as an airport, but is not provided by the management.
☞ Anything online that you would expect to pay for is "free."
Unexpected events
☞ A file is downloaded automatically when you visit a web page, with no other action on your part. Delete any such file without opening it.
☞ You open what you think is a document and get an alert that it's "an application downloaded from the Internet." Click Cancel and delete the file. Even if you don't get the alert, you should still delete any file that isn't what you expected it to be.
☞ An application does something you don't expect, such as asking for permission to access your contacts, your location, or the Internet for no obvious reason.
☞ Software is attached to email that you didn't request, even if it comes (or seems to come) from someone you trust.
I don't say that leaving the safe harbor just once will necessarily result in disaster, but making a habit of it will weaken your defenses against malware attack. Any of the above scenarios should, at the very least, make you uncomfortable.
6. Java on the Web (not to be confused with JavaScript, to which it's not related, despite the similarity of the names) is a weak point in the security of any system. Java is, among other things, a platform for running complex applications in a web page, on the client. That was always a bad idea, and Java's developers have proven themselves incapable of implementing it without also creating a portal for malware to enter. Past Java exploits are the closest thing there has ever been to a Windows-style virus affecting OS X. Merely loading a page with malicious Java content could be harmful.
Fortunately, client-side Java on the Web is obsolete and mostly extinct. Only a few outmoded sites still use it. Try to hasten the process of extinction by avoiding those sites, if you have a choice. Forget about playing games or other non-essential uses of Java.
Java is not included in OS X 10.7 and later. Discrete Java installers are distributed by Apple and by Oracle (the developer of Java.) Don't use either one unless you need it. Most people don't. If Java is installed, disable it—not JavaScript—in your browsers.
Regardless of version, experience has shown that Java on the Web can't be trusted. If you must use a Java applet for a task on a specific site, enable Java only for that site in Safari. Never enable Java for a public website that carries third-party advertising. Use it only on well-known, login-protected, secure websites without ads. In Safari 6 or later, you'll see a padlock icon in the address bar when visiting a secure site.
Stay within the safe harbor, and you’ll be as safe from malware as you can practically be. The rest of this comment concerns what you should not do to protect yourself.
7. Never install any commercial "anti-virus" (AV) or "Internet security" products for the Mac, as they are all worse than useless. If you need to be able to detect Windows malware in your files, use one of the free security apps in the Mac App Store—nothing else.
Why shouldn't you use commercial AV products?
☞ To recognize malware, the software depends on a database of known threats, which is always at least a day out of date. This technique is a proven failure, as a major AV software vendor has admitted. Most attacks are "zero-day"—that is, previously unknown. Recognition-based AV does not defend against such attacks, and the enterprise IT industry is coming to the realization that traditional AV software is worthless.
☞ Its design is predicated on the nonexistent threat that malware may be injected at any time, anywhere in the file system. Malware is downloaded from the network; it doesn't materialize from nowhere. In order to meet that nonexistent threat, commercial AV software modifies or duplicates low-level functions of the operating system, which is a waste of resources and a common cause of instability, bugs, and poor performance.
☞ By modifying the operating system, the software may also create weaknesses that could be exploited by malware attackers.
☞ Most importantly, a false sense of security is dangerous.
8. An AV product from the App Store, such as "ClamXav," has the same drawback as the commercial suites of being always out of date, but it does not inject low-level code into the operating system. That doesn't mean it's entirely harmless. It may report email messages that have "phishing" links in the body, or Windows malware in attachments, as infected files, and offer to delete or move them. Doing so will corrupt the Mail database. The messages should be deleted from within the Mail application.
An AV app is not needed, and cannot be relied upon, for protection against OS X malware. It's useful, if at all, only for detecting Windows malware, and even for that use it's not really effective, because new Windows malware is emerging much faster than OS X malware.
Windows malware can't harm you directly (unless, of course, you use Windows.) Just don't pass it on to anyone else. A malicious attachment in email is usually easy to recognize by the name alone. An actual example:
London Terror Moovie.avi [124 spaces] Checked By Norton Antivirus.exe
You don't need software to tell you that's a Windows trojan. Software may be able to tell you which trojan it is, but who cares? In practice, there's no reason to use recognition software unless an organizational policy requires it. Windows malware is so widespread that you should assume it's in every email attachment until proven otherwise. Nevertheless, ClamXav or a similar product from the App Store may serve a purpose if it satisfies an ill-informed network administrator who says you must run some kind of AV application. It's free and it won't handicap the system.
The ClamXav developer won't try to "upsell" you to a paid version of the product. Other developers may do that. Don't be upsold. For one thing, you should not pay to protect Windows users from the consequences of their choice of computing platform. For another, a paid upgrade from a free app will probably have all the disadvantages mentioned in section 7.
9. It seems to be a common belief that the built-in Application Firewall acts as a barrier to infection, or prevents malware from functioning. It does neither. It blocks inbound connections to certain network services you're running, such as file sharing. It's disabled by default and you should leave it that way if you're behind a router on a private home or office network. Activate it only when you're on an untrusted network, for instance a public Wi-Fi hotspot, where you don't want to provide services. Disable any services you don't use in the Sharing preference pane. All are disabled by default.
10. As a Mac user, you don't have to live in fear that your computer may be infected every time you install software, read email, or visit a web page. But neither can you assume that you will always be safe from exploitation, no matter what you do. Navigating the Internet is like walking the streets of a big city. It can be as safe or as dangerous as you choose to make it. The greatest harm done by security software is precisely its selling point: it makes people feel safe. They may then feel safe enough to take risks from which the software doesn't protect them. Nothing can lessen the need for safe computing practices.

Is it suggested to use an additional layer of internet security such as ESET Cyber Security Pro - Internet Security for Mac

I just want to make sure I am as safe as possible with all the internet hacking that has been in the Media. I have a Mac Mini that was purchased in Aug. 2013. Is it suggested to use an additional layer of internet security such as ESET® Cyber Security Pro - Internet Security for Mac ???

Mac users often ask whether they should install "anti-virus" software. The answer usually given on ASC is "no." The answer is right, but it may give the wrong impression that there is no threat from what are loosely called "viruses." There is a threat, and you need to educate yourself about it.
1. This is a comment on what you should—and should not—do to protect yourself from malicious software ("malware") that circulates on the Internet and gets onto a computer as an unintended consequence of the user's actions. It does not apply to software, such as keystroke loggers, that may be installed deliberately by an intruder who has hands-on access to the computer, or who has been able to log in to it remotely. That threat is in a different category, and there's no easy way to defend against it.
The comment is long because the issue is complex. The key points are in sections 5, 6, and 10.
OS X now implements three layers of built-in protection specifically against malware, not counting runtime protections such as execute disable, sandboxing, system library randomization, and address space layout randomization that may also guard against other kinds of exploits.
2. All versions of OS X since 10.6.7 have been able to detect known Mac malware in downloaded files, and to block insecure web plugins. This feature is transparent to the user. Internally Apple calls it "XProtect."
The malware recognition database used by XProtect is automatically updated; however, you shouldn't rely on it, because the attackers are always at least a day ahead of the defenders.
The following caveats apply to XProtect:
☞ It can be bypassed by some third-party networking software, such as BitTorrent clients and Java applets.
☞ It only applies to software downloaded from the network. Software installed from a CD or other media is not checked.
As new versions of OS X are released, it's not clear whether Apple will indefinitely continue to maintain the XProtect database of older versions such as 10.6. The security of obsolete system versions may eventually be degraded. Security updates to the code of obsolete systems will stop being released at some point, and that may leave them open to other kinds of attack besides malware.
3. Starting with OS X 10.7.5, there has been a second layer of built-in malware protection, designated "Gatekeeper" by Apple. By default, applications and Installer packages downloaded from the network will only run if they're digitally signed by a developer with a certificate issued by Apple. Software certified in this way hasn't necessarily been tested by Apple, but you can be reasonably sure that it hasn't been modified by anyone other than the developer. His identity is known to Apple, so he could be held legally responsible if he distributed malware. That may not mean much if the developer lives in a country with a weak legal system (see below.)
Gatekeeper doesn't depend on a database of known malware. It has, however, the same limitations as XProtect, and in addition the following:
☞ It can easily be disabled or overridden by the user.
☞ A malware attacker could get control of a code-signing certificate under false pretenses, or could simply ignore the consequences of distributing codesigned malware.
☞ An App Store developer could find a way to bypass Apple's oversight, or the oversight could fail due to human error.
Apple has so far failed to revoke the codesigning certificates of some known abusers, thereby diluting the value of Gatekeeper and the Developer ID program. These failures don't involve App Store products, however.
For the reasons given, App Store products, and—to a lesser extent—other applications recognized by Gatekeeper as signed, are safer than others, but they can't be considered absolutely safe. "Sandboxed" applications may prompt for access to private data, such as your contacts, or for access to the network. Think before granting that access. Sandbox security is based on user input. Never click through any request for authorization without thinking.
4. Starting with OS X 10.8.3, a third layer of protection has been added: a "Malware Removal Tool" (MRT). MRT runs automatically in the background when you update the OS. It checks for, and removes, malware that may have evaded the other protections via a Java exploit (see below.) MRT also runs when you install or update the Apple-supplied Java runtime (but not the Oracle runtime.) Like XProtect, MRT is effective against known threats, but not against unknown ones. It notifies you if it finds malware, but otherwise there's no user interface to MRT.
5. The built-in security features of OS X reduce the risk of malware attack, but they are not, and never will be, complete protection. Malware is a problem of human behavior, and a technological fix is not going to solve it. Trusting software to protect you will only make you more vulnerable.
The best defense is always going to be your own intelligence. With the possible exception of Java exploits, all known malware circulating on the Internet that affects a fully-updated installation of OS X 10.6 or later takes the form of so-called "Trojan horses," which can only have an effect if the victim is duped into running them. The threat therefore amounts to a battle of wits between you and the scam artists. If you're smarter than they think you are, you'll win. That means, in practice, that you always stay within a safe harbor of computing practices. How do you know when you're leaving the safe harbor? Below are some warning signs of danger.
Software from an untrustworthy source
☞ Software of any kind is distributed via BitTorrent, or Usenet, or on a website that also distributes pirated music or movies.
☞ Software with a corporate brand, such as Adobe Flash Player, doesn't come directly from the developer’s website. Do not trust an alert from any website to update Flash, or your browser, or any other software.
☞ Rogue websites such as Softonic and CNET Download distribute free applications that have been packaged in a superfluous "installer."
☞ The software is advertised by means of spam or intrusive web ads. Any ad, on any site, that includes a direct link to a download should be ignored.
Software that is plainly illegal or does something illegal
☞ High-priced commercial software such as Photoshop is "cracked" or "free."
☞ An application helps you to infringe copyright, for instance by circumventing the copy protection on commercial software, or saving streamed media for reuse without permission.
Conditional or unsolicited offers from strangers
☞ A telephone caller or a web page tells you that you have a “virus” and offers to help you remove it. (Some reputable websites did legitimately warn visitors who were infected with the "DNSChanger" malware. That exception to this rule no longer applies.)
☞ A web site offers free content such as video or music, but to use it you must install a “codec,” “plug-in,” "player," "downloader," "extractor," or “certificate” that comes from that same site, or an unknown one.
☞ You win a prize in a contest you never entered.
☞ Someone on a message board such as this one is eager to help you, but only if you download an application of his choosing.
☞ A "FREE WI-FI !!!" network advertises itself in a public place such as an airport, but is not provided by the management.
☞ Anything online that you would expect to pay for is "free."
Unexpected events
☞ A file is downloaded automatically when you visit a web page, with no other action on your part. Delete any such file without opening it.
☞ You open what you think is a document and get an alert that it's "an application downloaded from the Internet." Click Cancel and delete the file. Even if you don't get the alert, you should still delete any file that isn't what you expected it to be.
☞ An application does something you don't expect, such as asking for permission to access your contacts, your location, or the Internet for no obvious reason.
☞ Software is attached to email that you didn't request, even if it comes (or seems to come) from someone you trust.
I don't say that leaving the safe harbor just once will necessarily result in disaster, but making a habit of it will weaken your defenses against malware attack. Any of the above scenarios should, at the very least, make you uncomfortable.
6. Java on the Web (not to be confused with JavaScript, to which it's not related, despite the similarity of the names) is a weak point in the security of any system. Java is, among other things, a platform for running complex applications in a web page, on the client. That was always a bad idea, and Java's developers have proven themselves incapable of implementing it without also creating a portal for malware to enter. Past Java exploits are the closest thing there has ever been to a Windows-style virus affecting OS X. Merely loading a page with malicious Java content could be harmful.
Fortunately, client-side Java on the Web is obsolete and mostly extinct. Only a few outmoded sites still use it. Try to hasten the process of extinction by avoiding those sites, if you have a choice. Forget about playing games or other non-essential uses of Java.
Java is not included in OS X 10.7 and later. Discrete Java installers are distributed by Apple and by Oracle (the developer of Java.) Don't use either one unless you need it. Most people don't. If Java is installed, disable it—not JavaScript—in your browsers.
Regardless of version, experience has shown that Java on the Web can't be trusted. If you must use a Java applet for a task on a specific site, enable Java only for that site in Safari. Never enable Java for a public website that carries third-party advertising. Use it only on well-known, login-protected, secure websites without ads. In Safari 6 or later, you'll see a lock icon in the address bar with the abbreviation "https" when visiting a secure site.
Stay within the safe harbor, and you’ll be as safe from malware as you can practically be. The rest of this comment concerns what you should not do to protect yourself.
7. Never install any commercial "anti-virus" (AV) or "Internet security" products for the Mac, as they are all worse than useless. If you need to be able to detect Windows malware in your files, use one of the free security apps in the Mac App Store—nothing else.
Why shouldn't you use commercial AV products?
☞ To recognize malware, the software depends on a database of known threats, which is always at least a day out of date. This technique is a proven failure, as a major AV software vendor has admitted. Most attacks are "zero-day"—that is, previously unknown. Recognition-based AV does not defend against such attacks, and the enterprise IT industry is coming to the realization that traditional AV software is worthless.
☞ Its design is predicated on the nonexistent threat that malware may be injected at any time, anywhere in the file system. Malware is downloaded from the network; it doesn't materialize from nowhere. In order to meet that nonexistent threat, commercial AV software modifies or duplicates low-level functions of the operating system, which is a waste of resources and a common cause of instability, bugs, and poor performance.
☞ By modifying the operating system, the software may also create weaknesses that could be exploited by malware attackers.
☞ Most importantly, a false sense of security is dangerous.
8. An AV product from the App Store, such as "ClamXav," has the same drawback as the commercial suites of being always out of date, but it does not inject low-level code into the operating system. That doesn't mean it's entirely harmless. It may report email messages that have "phishing" links in the body, or Windows malware in attachments, as infected files, and offer to delete or move them. Doing so will corrupt the Mail database. The messages should be deleted from within the Mail application.
An AV app is not needed, and cannot be relied upon, for protection against OS X malware. It's useful, if at all, only for detecting Windows malware, and even for that use it's not really effective, because new Windows malware is emerging much faster than OS X malware.
Windows malware can't harm you directly (unless, of course, you use Windows.) Just don't pass it on to anyone else. A malicious attachment in email is usually easy to recognize by the name alone. An actual example:
London Terror Moovie.avi [124 spaces] Checked By Norton Antivirus.exe
You don't need software to tell you that's a Windows trojan. Software may be able to tell you which trojan it is, but who cares? In practice, there's no reason to use recognition software unless an organizational policy requires it. Windows malware is so widespread that you should assume it's in everyemail attachment until proven otherwise. Nevertheless, ClamXav or a similar product from the App Store may serve a purpose if it satisfies an ill-informed network administrator who says you must run some kind of AV application. It's free and it won't handicap the system.
The ClamXav developer won't try to "upsell" you to a paid version of the product. Other developers may do that. Don't be upsold. For one thing, you should not pay to protect Windows users from the consequences of their choice of computing platform. For another, a paid upgrade from a free app will probably have all the disadvantages mentioned in section 7.
9. It seems to be a common belief that the built-in Application Firewall acts as a barrier to infection, or prevents malware from functioning. It does neither. It blocks inbound connections to certain network services you're running, such as file sharing. It's disabled by default and you should leave it that way if you're behind a router on a private home or office network. Activate it only when you're on an untrusted network, for instance a public Wi-Fi hotspot, where you don't want to provide services. Disable any services you don't use in the Sharing preference pane. All are disabled by default.
10. As a Mac user, you don't have to live in fear that your computer may be infected every time you install software, read email, or visit a web page. But neither can you assume that you will always be safe from exploitation, no matter what you do. Navigating the Internet is like walking the streets of a big city. It's as safe or as dangerous as you choose to make it. The greatest harm done by security software is precisely its selling point: it makes people feel safe. They may then feel safe enough to take risks from which the software doesn't protect them. Nothing can lessen the need for safe computing practices.

How to change the values in custom profiles based on security group ??

Hi,
i am facing problem for my requirement, can anybody help me for below scenario...
i have custom check in profiles , there are content types and sub types. sub type nothing but a categories on for particular content type. For example i have News content type , same in the below subtypes drop down list are press release, events, articles etc.
what i want to do is, when i open custom checkin profile, subtype values need to be changed( some values in subtype should hide) based on security group changes .
In the Sub type listed values, some values need to hide only when i choose different security groups.. sub types values should display based on the particular security group only. when ever i change the security group, drop down Values in subtypes needs to change.
hope understand my requirement.
How to achieve this task. Any help would be greatly appreciated.
Thanks,
yt

Hi,
Thanks alot. its working fine
Can we configure DCL Relation two times in one information filed ??? i should not create not more than fields to this requirement.
Type -> subtype = DCL already existed
Now, i want to Create DCL to
Subtype ---> Security group
As per my requirement, if i change the security group in checkin form, values should be change in the SubType drop down list.
Created checkin profile there was DCL relation to " Type and "Sub Type" . now i want to map Relation ( DCL ) for subtype to security group.
i was trying do for DCL for subtype and security group. but there was already existing DCL created for subtype information field (Relation configuration done for content type). even though i was trying to do for DCL in Security group information field. but, i could not find security group information field in configuration manager.
Now what should i do ?? how to create DCL to subtype and security group ??
Help would be appreciated.
yt

Maths (simple sum) based form security for preventing spam

Similar Messages

Maybe you are looking for