Review by Steve Hardwick

No Starch Press, November 2011, 320 pp., $49.95

In a recent survey by Veracode in December 2011 found that more than 80 percent of approximately 10,000 web applications examined failed security testing. This data shows that web applications provide a fertile ground for hackers to launch their malware. Obviously web developers still have some work to do to make their applications secure. The Tangled Web by Michal Zalewski is targeted toward web application developers and security professionals that have a solid understanding of the web and browser operations at an operational level. The author will go into fairly technical details assuming that the reader has the necessary skills to understand the technology discussed.

After an introductory chapter outlining some security fundamentals, the book is split into three parts. The first part covers browser and web technologies. Specific attention is paid to vulnerabilities and how they became to be part of the infrastructure. The second part covers browser security and highlights some of the ways to mitigate the inherent holes in the current technology. The final portion covers some of the new vulnerabilities that are expected to come in the near future. With a couple of exceptions, most chapters are concluded with a security engineering cheat sheet. This gives a summary of the topics covered in the chapter and serves as a guide to implementing some of the technology discussed. It provides a useful quick reference to the books contents after the reader has completed their read through and can be used as a design aid on future projects.

Part One goes into some depth on the various technologies used by browsers, both their inherent operating infrastructure and the services used over the web. Attention is paid to areas of the technology that are open to exploitation. In many cases the author outlines how some of the weaknesses came into being and provides a good view into the difficulty of building this technology. Part One is broken down into chapters that cover the different pieces of the browser function. Both internal processes, HTML and CSS parsing for example, are covered plus external processes, HTML and URL parsing, are reviewed. Two chapters cover additional programming capabilities of the browser i.e. JavaScript and plug-ins.  Throughout this section many examples are given on how the vulnerabilities can be exploited. This gives the reader a better understanding on how a hacker would go about using these weaknesses. In some cases a chapter has a limited discussion of the topic due its wide complexity. The author does include references to other works that cover the topic in greater detail and then focuses on key areas that are relevant to web security.

Read the rest of this entry »

Wallace Wang's My New iPad from No Starch Press

My New iPad was written by a stand-up comic, but the advice in this thorough book is no joke. The 350 pages of this manual ($24.95 print plus ebook, $19.95 ebook) from No Starch Press don’t overlook a thing in the iPad user experience. It’s a guide to the 1st generation of the iPad, written in Deb. 2010. iPad 2 users can look forward to another edition in May, but this book does include specifics on the recent iOS 4.2 release. Apple rolled out version 4.3 of the iOS today.

The new iPad user can rely on this book like a novice cook reading The Joy of Cooking. The tasks explained, from setting up email accounts to synchronizing contacts, all include a novel What You’ll be Using feature.

For example, to transfer ebooks and audiobooks to the iPad, you’ll need 1. The iPad’s USB cable; 2. iTunes on your computer; 3. The iBooks app. The range of possible ingredients is vast these days for Apple owners, with some software on desktop/laptops, and other programs on iPads. This feature keeps things well-sorted-out. There’s a generous layout that leaves plenty of room for screen shots — very important for new-user books.

Another element that’s extraordinary is the “Additional Ideas” wrap-ups for each chapter. After you’ve learned how to do something like set up and customize an email account, it’s good to see the bigger picture and deploy what you’ve learned to do. Establishing separate accounts for work and home, or customizing your signature, may seem obvious to some. But a user who’s new to the Mail in iPad, coming from a Web-based mail service, can find this deeper dive aspect useful.

If you own an iPad already, this book will provide the training to take it to another level. I’ve learned that every onscreen keyboard key can be held down to reveal its alternative characters. Great for speeding up your typing.

Bookmark management is another insider kind of task you might have overlooked if you already own this device. A lot of this kind of technique is hidden away in the Settings app of the iPad. You’ll feel a lot more comfortable with Settings by using this book. Read the rest of this entry »

Through tomorrow, Jan. 17, the MacTech Boot Camp conference is offering $100 discount on its deep-tech training for the Mac and Apple’s mobile solutions, iPhone and iPad. That cuts the nine hours of classes to $395, including lunch and break snacks.

The event is aimed at the Apple product user who needs to do maintenance and configuration and management of their own systems. There’s a good business case to be made for learning this stuff, and a classroom setting works well for some kinds of employees or your staff.

MacTech organizer Neal Ticktin offers this summary of the event that takes place in the same week as this month’s Macworld Expo conference in San Francisco; Wed. Jan 26th, 9am-6pm, at the Parc 55 Hotel.  (Badge pickup opens at 8am, while the Macworld event begins in earnest on Jan. 27.) Registration is discounted from the MacTech website, where you register and pay.

Who should attend? Those that already support the home, SOHO (small office home office) and SMB (small to medium business) communities, or that want to become a consultant supporting these areas.

Those interested in becoming Apple Certified can take part in a study session and exam the day prior, Jan. 25.
Read the rest of this entry »

A two for one sale that ends today leads a list of discounted products and services that might make nice gifts for the Apple product user heading into business in 2011. Filemaker has a sale on its flagship Filemaker 11 database that includes a second copy free along with a purchased license.

The database is a genuine value at its list price, and so an extraordinary asset at half-off. Businesses which share contacts and relationships might help one another with this Filemaker deal. It expires on December 22. Details are at the Filemaker website, which lets users obtain a second license code for another business to use.

• Macworld is offering $50 off the Conference Package of your choice, or $25 off a 1-Day Users Conference pass. Discounts expire on Dec. 26. Registration is at the site for Macworld 2011, which runs Jan. 26-29.

• A $14.99 price for the Quickoffice Connect Mobile Suite for iPad is available until Dec. 31. The latest version of the suite to create, edit, and share Microsoft Word and Excel files, and view PowerPoint files adds support for iOS 4.2, multi-tasking, access to Huddle and SugarSync, and external keyboard support. Discounts available at the site.

• Appigo is running a 99-cent sale on its iPad and iPhone apps through January 1. The price is a significant discount off the $4.99 price to ToDo for the iPad, an extensive tool that’s ideal for a mobile business pro tracking projects and tasks. There’s also a Notebook, AccuFuel and Corkulous app on sale, along with an iPhone version of Todo.

The ebook store from Google made its debut today. It’s a Mac, iPad and iPhone resource, even though most of the books sold in the store won’t run inside the iPad’s bookstore, or run at all in any Kindle platform — either the device itself or Amazon’s Apple-based apps and programs. Google’s maintaining this store’s accounts on its web servers, in The Cloud.

Prices range wide at Google, but there's lots of titles

But searching for a best seller like The Four Hour Workweek, a Getting Things Done (GTD) guide, yields a nice cache of business-related titles. Google’s got an iPad/iPhone app for its bookstore that allows reading and searching. It lags behind the Kindle features of its app — won’t auto-rotate a book, for example. And auto-sync, to let you catch up to where you stopped reading on another device, must be coming in a later release.

What’s more, some of the Google titles are scanned pages, which limits your ability to search inside a book. This is a real benefit of Kindle titles as well as those sold in Apple’s bookstore. Prices? Well, Google is matching Amazon, most of the time, but they’re not beating the world’s largest online bookseller. Amazon is in the book business, after all. Google is in the advertising business, although now we know what that lawsuit and abandoned books legal dance was all about last year. Google was grabbing books that had dropped out of print. The authors who’ve got a publishing deal are being cut in for some royalties, somehow.

However, you can read anything you buy, or the free titles, on a Mac, although you need an Internet connection like any other ebook service to get the books onto your computer or mobile device. You don’t need to download a separate program on the Mac to do your reading. It all happens within your browser.

Bottom line, Google presents a way to keep the Amazon ebook experience on your Apple devices price competitive. Although Google’s charging sales tax, something still in the future for Amazon. Meanwhile, Apple’s bookstore falls even further behind, since it doesn’t have Google’s treasures like a copy of the 1990 US Census.

Organizers for next February’s Macworld 2011 have opened up free Exhibit Only registration on the show’s website. Full registration for the conference is also online, but Expo-only registration will be free through July 26. The show’s organizers are also offering attendees immediae discounts on selected products for the Mac and Apple mobile systems.

In addition to complimentary registration, we’re offering exclusive summer special pricing on Apple-related products for Macworld registrants only. We’ll offer one product special a day.

This event is the best way for a small business to research and evaluate new products, especially those that don’t have an ad budget or strong outreach to the business press. You can register at the website and learn a great deal just off the show floor, but adding sessions to your show package is well worth the extra $100 or so.

Apple’s mail program, Mail, is gaining a regular place for our business. One of the best things about this software is its ability to travel. We’ve learned to use it on our iPhones to keep up with e-mail while we’re out of the office. The 3G capability is what makes this possible, but you can check mail while mobile over a WiFi connection on other Apple devices.

That includes the iPad as well as the iPod Touch. Take Control Books, edited by Mac veteran Adam Engst, has a new PDF book title out to maximize your use of Mail while mobile. Take Control of Mail on the iPad, iPhone, and iPod Touch. Written and edited by Joe Kissell and Dan Frakes, the 96-page book promises to make Mail more useful on these devices.

This new ebook takes a practical look at using the Mail app on an iPad, iPhone, or iPod touch. It explains various email account options, helps you develop a real-world mobile email strategy that integrates with your Mac, explains the mechanics of sending and receiving mobile email, and provides essential troubleshooting advice.

Mail is one of the most useful things on the iPad, in part because you can create something in it — an aspect of the iPad that’s still gaining credibility. Even over a WiFi link, it’s become a ready tool in my business belt. Take Control has other Mail training aids as well, if your exposure to Mail is limited to your desktop. Read the rest of this entry »

Filemaker has announced a new Business Productivity Kit which works with its new Filemaker 11 database, a collection of charts and reports that are “a fast-track way for small businesses to get instant results and grow their businesses,” according to VP of marketing and services Ryan Rosenberg. The kit is available as a free download from the Filemaker site and includes a 30-day trial copy of Filemaker 11.

While Filemaker has also made a run at small business with its $39 basic-level Bento database, Filemaker 11 is worth the extra $140. The Productivity Kit includes templates — ready-made database reports — to serve companies dealing in either goods or services. The Standard Edition Kit is aimed at sellers of goods, while the Service Edition includes templates for, well, services companies.

Filemaker 11 does ship with a raft of templates already, many suitable for the business user. But the company promises that the new kit’s free templates are “an integrated set of business tools and each module ties to the other, eliminating any need for duplicate fields, tables and data re-entry.”

The biggest advance in Filemaker 11 may well be its charting, and the Kit proposes to make that power ready to use, along with what the company calls “on-the-fly” reporting.

After a few days building and experimenting with the Bento database, it’s plain that the Filemaker advantages of customization are well worth its lift in cost. Starting with a set of templates that you can customize gives a small business room to grow and expand to new opportunities. Filemaker even includes a guide to database basics and one for working with Microsoft Office in the Productivity Kit.

Read the rest of this entry »

Complete instruction and training, but O'Reilly offers a better deal

An iPhone problem led me into my library of O’Reilly Missing Manuals, an ever-growing sheaf of pages that’s approaching one full foot of dandy advice and training. A Missing Manual for Apple products is often likely to have the crack advice of David Pogue among its authors, making them a pleasure to read and a complete resource. (Pogue created the Missing Manual series.)

But a Missing Manual book is also bound up by the Curse of the Index. Nobody can reference every entry for every word in a book made of paper. The index would run longer than the content. You can spend awhile searching a handful of entries in a paper book, and even if the advice is inside, locating it among 600-odd pages takes time. You might be at deadline on a project and wish there was a faster method to solving a problem — so you can avoid the line at the Apple Genius Bar at the retail stores (if that’s even an option.)

O’Reilly’s got a shortcut for your fixit dilemma. Today the solution is e-books, editions of these Manuals you download and read on a Mac, an iPhone, a Kindle or yes, even the new iPad. Today, all e-book purchases are half-off, in celebration of Earth Day.

I already had the iPhone Missing Manual in my library last weekend, when my iPhone refused to sync up and cough up its photos. I wanted to push a new album onto the phone to show some images to a client. The new iPad was in use elsewhere at Bites HQ. The solution to the iPhone problem was inside the Missing Manual. I might have found it faster if I owned an e-book version instead. Read the rest of this entry »

Wiley Publishing thinks that you can, running into Apple Mac territory with its training book Teach Yourself Visually: Mac OS X Snow Leopard. The book series that promises you can “Read Less – Learn More” unspools more than 300 full-color pages of instruction on the full range of everyday use of the Mac’s latest operating system release.

If you haven’t seen one of these books, it may not be easy to describe how much color and how many screen shots prance across the pages. This is a book for the switcher who’s moved from a business Windows system to the simplicity of the Mac — or a more advanced user who needs a quick refresher and can just scan a picture to recall how to reset a forgotten password.

The emphasis here is on the complete set of computing tasks at an everyday level. Using the Dock, entering a Web address into Safari, composing email in Mail, locating files you’ve downloaded from the Web: it’s all shown screen by screen in Paul McFriederies’ book. The lessons are broken down into two-page spreads with alternative methods for some tasks, such as uninstalling applications or customizing the Dock. Read the rest of this entry »