Behind the Curtain at TCG

AJAX and Windows

There's a discussion on Slashdot about the potential for disruption in the operating system marketplace, especially Windows, as more applications can be ported to the Web using AJAX (Asynchronous JavaScript and XML). The consensus seems to be that AJAX doesn't threaten the existence of Windows (surprise!) but it does represent a shift in thinking: what was once impossible to achieve on a Web interface is now feasible, and the richness of client-server applications can be reproduced in the browser.

HHS seeking Deputy Assistant Secretary for Grants

HHS is advertising the post of Deputy Assistant Secretary for Grants. The person in this Senior Executive Service (SES) position will have some very important responsibilities:

• Full authority for the day to day operations of the Office of Grants.
• Through subordinate supervisors and managers, be responsible for the activities of three subordinate staff offices: (1) the Immediate Office, Office of Grants, which includes the Grants.gov Program Management Office,(2) Division of Grants Policy, and (3) Division of Grants Oversight and Review.
• Provide leadership, policy, guidance and supervision, as well as coordinating long and short-range planning to constituent organizations.
• Provide technical assistance to the Operating Divisions and evaluate the
  effectiveness of their grant programs, including the development of performance standards.
• Serve as a representative and spokesperson for HHS's grants management
  interests and as an advocate for grants streamlining and electronic grants across the government.

So this person will have control over P.L. 106-107, Grants.gov, a large swathe of the Grants Management Line of Business, HHS OPDIV grants operations, and more besides. As far as I know, this is a new position, created as a consequence of breaking out the role of Deputy Assistant Secretary for Grants and Acquisition Management into two separate positions. (Check out this page for information on the other new position, "Director, Office of Acquisition Management and Policy".)

The National Grants Partnership White Paper Series Committee mentioned the idea of creating Chief Grants Officers for each grant-making agency in its recent white paper [PDF], and this position sounds like it would fit the bill. (Disclosure: I co-chaired the group that wrote the paper).

Discussion about Wikipedia on Slashdot

Apparently there's been an announcement about tighter editorial controls being implemented by the founders of Wikipedia, one of my favorite Internet resources. The point of a wiki is to enable anyone to edit any content as they wish, creating information that benefits from the collaborative process. Some idiots choose to use this liberty to vandalize some entries, or are pig-headed enough to insist that only their version of facts can be true. The change in editorial policy, which is a direct response to this idiocy, has engendered a very interesting discussion on Slashdot, including comments like this one from Chris_Mahan in response to a claim that "Wikipedia is a fundamentally flawed idea" because the accuracy of its content is doubted due to its origins in the wiki community:

Assuming that information is correct is always asking for trouble, regardless of where the infomration comes from. What wikipedia allows you to do is more easily contact the authors to validate or invalidate, as the case may be, the factual nature of the information.

This topic has broader implications than just Wikipedia, of course. It speaks to fundamental socio-economic theories, such as the Tragedy of the Commons, and the cultural implications of innovative technology. Well worth a read.

DefCon: Web Service Intrusion - Same Security Holes, New Technology

At DefCon 13, Alex Stamos of iSec Partners gave a very interesting talk entitled "Attacking Web Services".  In summary, there are currently three known web service attack techniques:

• Injecting XML into an input box, overwriting tags set earlier in the SOAP XML stream
• Injecting XPath search queries into an input box, thwarting the select Boolean logic
• Creating a valid but very deep and complex SOAP header, causing the web service to consume a large amount of system resources (a denial of service attack).

The XML and XPath injection techniques are very similar to common SQL injection techniques used to infiltrate web applications that build SQL queries directly from user input (see http://www.securiteam.com/securityreviews/5DP0N1P76E.html for a good review of SQL injection).  The solution to XML and XPath injections is the same: remove or escape special characters (brackets and quotes) from user input before processing the data.  While data cleaning issues have been known for a long time, new tutorials and examples still do not do them, leading to a whole new generation of programmers who write insecure code.

A simple technique to counteract a complex SOAP header DoS attack is to limit the maximum size of a web service request.  The following Microsoft TechNet article describes how to limit request size in IIS:  http://support.microsoft.com/default.aspx?scid=kb;en-us;310156&sd=tech.  For limiting the request size in Apache see: http://perl.apache.org/docs/2.0/api/Apache2/SizeLimit.html.

The full presentation on "Attacking Web Services" is available at: http://www.isecpartners.com/documents/iSEC-Attacking-Web-Services.DefCon.pdf.