No Starch Press, November 2011, 320 pp., $49.95

In a recent survey by Veracode in December 2011 found that more than 80 percent of approximately 10,000 web applications examined failed security testing. This data shows that web applications provide a fertile ground for hackers to launch their malware. Obviously web developers still have some work to do to make their applications secure. The Tangled Web by Michal Zalewski is targeted toward web application developers and security professionals that have a solid understanding of the web and browser operations at an operational level. The author will go into fairly technical details assuming that the reader has the necessary skills to understand the technology discussed.

After an introductory chapter outlining some security fundamentals, the book is split into three parts. The first part covers browser and web technologies. Specific attention is paid to vulnerabilities and how they became to be part of the infrastructure. The second part covers browser security and highlights some of the ways to mitigate the inherent holes in the current technology. The final portion covers some of the new vulnerabilities that are expected to come in the near future. With a couple of exceptions, most chapters are concluded with a security engineering cheat sheet. This gives a summary of the topics covered in the chapter and serves as a guide to implementing some of the technology discussed. It provides a useful quick reference to the books contents after the reader has completed their read through and can be used as a design aid on future projects.

Part One goes into some depth on the various technologies used by browsers, both their inherent operating infrastructure and the services used over the web. Attention is paid to areas of the technology that are open to exploitation. In many cases the author outlines how some of the weaknesses came into being and provides a good view into the difficulty of building this technology. Part One is broken down into chapters that cover the different pieces of the browser function. Both internal processes, HTML and CSS parsing for example, are covered plus external processes, HTML and URL parsing, are reviewed. Two chapters cover additional programming capabilities of the browser i.e. JavaScript and plug-ins.  Throughout this section many examples are given on how the vulnerabilities can be exploited. This gives the reader a better understanding on how a hacker would go about using these weaknesses. In some cases a chapter has a limited discussion of the topic due its wide complexity. The author does include references to other works that cover the topic in greater detail and then focuses on key areas that are relevant to web security.

The first five chapters of Part Two concentrates on browser security mechanisms that attempt to prevent rogue content from interfering with valid, legitimate, content displayed with in the browser. These chapters cover how content isolation is maintained within the operation of the browser. The concepts discussed in part one are used to show how the browser security achieves this. Content from user input and downloaded data are included in this review. Furthermore the impact of scripting and plug-in functionality is discussed in depth to allow the reader to understand how this can impact the overall security of a web application. There are many references to works where researchers have shown example of exploits based on the vulnerabilities in the browser and associated functions. The latter two chapters in this section cover dealing with rogue scripts and extrinsic site privileges.  In general Part Two provides a comprehensive overview of many security flaws in the browser. There are comparisons between the major browsers and how their operation differs with respect to the exploits. Additionally there are also recommendations on how to understand and overcome them.

Part Three looks at some of the changes that may come to fruition in the future. The first chapter covers new and upcoming security standards. They are intended to mitigate some of the problems that plague browsers today. These include, cross domain requests (including a discussion of Cross-Origin Resource Sharing CORS), content security policy CSP, sandboxed frames, strict transport security, private browsing modes, in-browser HTML sanitizers and XSS Filtering. In each case a summary of the goal of the security measure and its current status is given. The second chapter covers new browser developments and how they may impact security. Several new or planned API sets are examined for their intent and current implementation. The final chapter is a synopsis of common web vulnerabilities and how they are defined. Common, simple definitions are used for the various vulnerabilities – e.g. Cross Site Scripting (XSS). For each there is a short description with a reference to the details section of the book.

There is a pivotal statement in Chapter 16 “the dream of inventing a brand-new browser security model is strong within the community, but it is always followed by the realization that it would require rebuilding the entire Web.” This book walks the reader through the inner workings of popular browsers with a focus on showing the weaknesses that are embedded in their very construction. The author does take time to explain how these came about and the attempts to fix them. In part 2 he also gives examples on how to develop web applications so you can navigate around these deficiencies. The security engineering cheat sheets give an easy way to develop a strategy to apply basic security concepts to web application development. The book provides an invaluable reference for anyone working with, testing or deploying web applications.

Wallace Wang's My New iPad from No Starch Press

My New iPad was written by a stand-up comic, but the advice in this thorough book is no joke. The 350 pages of this manual ($24.95 print plus ebook, $19.95 ebook) from No Starch Press don’t overlook a thing in the iPad user experience. It’s a guide to the 1st generation of the iPad, written in Deb. 2010. iPad 2 users can look forward to another edition in May, but this book does include specifics on the recent iOS 4.2 release. Apple rolled out version 4.3 of the iOS today.

The new iPad user can rely on this book like a novice cook reading The Joy of Cooking. The tasks explained, from setting up email accounts to synchronizing contacts, all include a novel What You’ll be Using feature.

For example, to transfer ebooks and audiobooks to the iPad, you’ll need 1. The iPad’s USB cable; 2. iTunes on your computer; 3. The iBooks app. The range of possible ingredients is vast these days for Apple owners, with some software on desktop/laptops, and other programs on iPads. This feature keeps things well-sorted-out. There’s a generous layout that leaves plenty of room for screen shots — very important for new-user books.

Another element that’s extraordinary is the “Additional Ideas” wrap-ups for each chapter. After you’ve learned how to do something like set up and customize an email account, it’s good to see the bigger picture and deploy what you’ve learned to do. Establishing separate accounts for work and home, or customizing your signature, may seem obvious to some. But a user who’s new to the Mail in iPad, coming from a Web-based mail service, can find this deeper dive aspect useful.

If you own an iPad already, this book will provide the training to take it to another level. I’ve learned that every onscreen keyboard key can be held down to reveal its alternative characters. Great for speeding up your typing.

Bookmark management is another insider kind of task you might have overlooked if you already own this device. A lot of this kind of technique is hidden away in the Settings app of the iPad. You’ll feel a lot more comfortable with Settings by using this book.

No Starch (an imprint of the O’Reilly tech publishing empire) has an extensive overview of the book on its site. The table of contents shows a thoughtful and thorough collection of subjects.

Part 1: Basic Training

Chapter 1: Turning Your iPad On and Off
Chapter 2: Charging and Conserving iPad Battery Power
Chapter 3: Using Your iPad’s Physical and Virtual Controls
Chapter 4: Controlling the iPad User Interface
Chapter 5: Using and Customizing the Virtual Keyboard

Part 2: Customizing Your iPad
Chapter 6: Customizing the Home Screen
Chapter 7: Using Parental Controls
Chapter 8: Protecting Your Privacy
Chapter 9: Setting the Date and Time
Chapter 10: Restoring and Resetting Your iPad
Chapter 11: Setting Up an Internet Connection
Chapter 12: Installing (and Uninstalling) Apps

Part 3: Getting on the Internet
Chapter 13: Browsing with Safari
Chapter 14: Using Bookmarks with Safari
Chapter 15: Filling Out Forms Automatically in Safari
Chapter 16: Setting Up and Customizing an Email Account
Chapter 17: Reading, Writing, and Organizing Email

Part 4: Sharing Data with Your iPad
Chapter 18: Transferring Photos, Movies, Music, TV Shows, and Podcasts to Your iPad
Chapter 19: Transferring Ebooks and Audiobooks to Your iPad
Chapter 20: Transferring Contacts, Appointments, Mail, Notes, and Bookmarks
Chapter 21: Transferring iTunes University Courses from a Computer to Your iPad

Part 5: Video, Music, and Ebooks
Chapter 22: Shopping on iTunes and the iBookstore
Chapter 23: Listening to Music and Other Audio Files
Chapter 24: Watching Videos
Chapter 25: Watching YouTube Videos
Chapter 26: Reading Ebooks
Chapter 27: Viewing Photographs
Chapter 28: Using and Sharing Photographs

Part 6: Organizing Yourself
Chapter 29: Jotting Down Notes
Chapter 30: Viewing Contact Information
Chapter 31: Tracking Appointments on a Calendar
Chapter 32: Viewing a Map
Chapter 33: Finding Places and Getting Directions with Maps
Chapter 34: Searching Your iPad with Spotlight

Part 7: Additional Tips
Chapter 35: Updating the iPad Operating System
Chapter 36: Making an iPad Accessible
Chapter 37: Using Foreign Languages
Chapter 38: Transferring and Editing Microsoft Office Documents
Chapter 39: The Best iPad Apps

The event is aimed at the Apple product user who needs to do maintenance and configuration and management of their own systems. There’s a good business case to be made for learning this stuff, and a classroom setting works well for some kinds of employees or your staff.

MacTech organizer Neal Ticktin offers this summary of the event that takes place in the same week as this month’s Macworld Expo conference in San Francisco; Wed. Jan 26th, 9am-6pm, at the Parc 55 Hotel.  (Badge pickup opens at 8am, while the Macworld event begins in earnest on Jan. 27.) Registration is discounted from the MacTech website, where you register and pay.

Who should attend? Those that already support the home, SOHO (small office home office) and SMB (small to medium business) communities, or that want to become a consultant supporting these areas.

Those interested in becoming Apple Certified can take part in a study session and exam the day prior, Jan. 25.

Sessions include topics such as:
- Marketing Oneself in a Community
- Client Handling
- Client Documentation, Passwords and Records
- Resources for Finding Answers
- Basic Command Line
- Troubleshooting Hardware
- Networking Basics and Troubleshooting
- Printing Setup and Troubleshooting (Wifi, USB, Bluetooth, and Wired)
- iOS Support
- Windows on the Mac Options
- Software Updates
- Backup Systems and Options
- Viruses and Security
- Basic Scripting
- Support Call Techniques
- Remote Support and Access

The database is a genuine value at its list price, and so an extraordinary asset at half-off. Businesses which share contacts and relationships might help one another with this Filemaker deal. It expires on December 22. Details are at the Filemaker website, which lets users obtain a second license code for another business to use.

• Macworld is offering $50 off the Conference Package of your choice, or $25 off a 1-Day Users Conference pass. Discounts expire on Dec. 26. Registration is at the site for Macworld 2011, which runs Jan. 26-29.

• A $14.99 price for the Quickoffice Connect Mobile Suite for iPad is available until Dec. 31. The latest version of the suite to create, edit, and share Microsoft Word and Excel files, and view PowerPoint files adds support for iOS 4.2, multi-tasking, access to Huddle and SugarSync, and external keyboard support. Discounts available at the site.

• Appigo is running a 99-cent sale on its iPad and iPhone apps through January 1. The price is a significant discount off the $4.99 price to ToDo for the iPad, an extensive tool that’s ideal for a mobile business pro tracking projects and tasks. There’s also a Notebook, AccuFuel and Corkulous app on sale, along with an iPhone version of Todo.

Prices range wide at Google, but there's lots of titles

But searching for a best seller like The Four Hour Workweek, a Getting Things Done (GTD) guide, yields a nice cache of business-related titles. Google’s got an iPad/iPhone app for its bookstore that allows reading and searching. It lags behind the Kindle features of its app — won’t auto-rotate a book, for example. And auto-sync, to let you catch up to where you stopped reading on another device, must be coming in a later release.

What’s more, some of the Google titles are scanned pages, which limits your ability to search inside a book. This is a real benefit of Kindle titles as well as those sold in Apple’s bookstore. Prices? Well, Google is matching Amazon, most of the time, but they’re not beating the world’s largest online bookseller. Amazon is in the book business, after all. Google is in the advertising business, although now we know what that lawsuit and abandoned books legal dance was all about last year. Google was grabbing books that had dropped out of print. The authors who’ve got a publishing deal are being cut in for some royalties, somehow.

However, you can read anything you buy, or the free titles, on a Mac, although you need an Internet connection like any other ebook service to get the books onto your computer or mobile device. You don’t need to download a separate program on the Mac to do your reading. It all happens within your browser.

Bottom line, Google presents a way to keep the Amazon ebook experience on your Apple devices price competitive. Although Google’s charging sales tax, something still in the future for Amazon. Meanwhile, Apple’s bookstore falls even further behind, since it doesn’t have Google’s treasures like a copy of the 1990 US Census.

In addition to complimentary registration, we’re offering exclusive summer special pricing on Apple-related products for Macworld registrants only. We’ll offer one product special a day.

This event is the best way for a small business to research and evaluate new products, especially those that don’t have an ad budget or strong outreach to the business press. You can register at the website and learn a great deal just off the show floor, but adding sessions to your show package is well worth the extra $100 or so.

That includes the iPad as well as the iPod Touch. Take Control Books, edited by Mac veteran Adam Engst, has a new PDF book title out to maximize your use of Mail while mobile. Take Control of Mail on the iPad, iPhone, and iPod Touch. Written and edited by Joe Kissell and Dan Frakes, the 96-page book promises to make Mail more useful on these devices.

This new ebook takes a practical look at using the Mail app on an iPad, iPhone, or iPod touch. It explains various email account options, helps you develop a real-world mobile email strategy that integrates with your Mac, explains the mechanics of sending and receiving mobile email, and provides essential troubleshooting advice.

Mail is one of the most useful things on the iPad, in part because you can create something in it — an aspect of the iPad that’s still gaining credibility. Even over a WiFi link, it’s become a ready tool in my business belt. Take Control has other Mail training aids as well, if your exposure to Mail is limited to your desktop.

We just got a free update to the Take Control of Apple Mail in Snow Leopard ebook, which covers plenty of nuances but is written for the first-time user of Mail. That’s been me, until recently, because I’m making a transition away from Eudora. (Odd behavior in Eudora under Snow Leopard. Beware.)

Engst’s group even has a special anti-spam edition of a book for Mail. These three titles are available in various bundles at a 30 percent discount. You can even download them for reading (using the EPUB versions) on your iPad.

While Filemaker has also made a run at small business with its $39 basic-level Bento database, Filemaker 11 is worth the extra $140. The Productivity Kit includes templates — ready-made database reports — to serve companies dealing in either goods or services. The Standard Edition Kit is aimed at sellers of goods, while the Service Edition includes templates for, well, services companies.

Filemaker 11 does ship with a raft of templates already, many suitable for the business user. But the company promises that the new kit’s free templates are “an integrated set of business tools and each module ties to the other, eliminating any need for duplicate fields, tables and data re-entry.”

The biggest advance in Filemaker 11 may well be its charting, and the Kit proposes to make that power ready to use, along with what the company calls “on-the-fly” reporting.

After a few days building and experimenting with the Bento database, it’s plain that the Filemaker advantages of customization are well worth its lift in cost. Starting with a set of templates that you can customize gives a small business room to grow and expand to new opportunities. Filemaker even includes a guide to database basics and one for working with Microsoft Office in the Productivity Kit.

Reports are the most obvious element missing from Bento, although that product does provide an Excel-like listing of the records in each database. Ready-made reports are the kind of solution a company would pay a consultant to create; it’s possible, with a good training resource like Lynda.com, to make these reporting templates go much further.

Filemaker says that its two editions of the Productivity Kit break out along these lines of business tasks:

Standard Edition (for companies selling goods):

• Manage contacts and suppliers
• Organize products and inventory
• Process sales orders
• Track projects and production
• Send targeted e-mails

Service Edition (for companies providing services):

• Track clients and vendor contacts
• Process service orders
• Organize information about service offerings
• Manage invoices and other key business data
• Send targeted e-mail campaigns

The kit also comes with a bonus e-mail marketing guide, one that Filemakers says included “valuable tips and tricks on creating customized email campaigns to market goods and services.” For that mission you need a means of delivery, and we’d recommend Constant Contact for your outreach.

Complete instruction and training, but O'Reilly offers a better deal

An iPhone problem led me into my library of O’Reilly Missing Manuals, an ever-growing sheaf of pages that’s approaching one full foot of dandy advice and training. A Missing Manual for Apple products is often likely to have the crack advice of David Pogue among its authors, making them a pleasure to read and a complete resource. (Pogue created the Missing Manual series.)

But a Missing Manual book is also bound up by the Curse of the Index. Nobody can reference every entry for every word in a book made of paper. The index would run longer than the content. You can spend awhile searching a handful of entries in a paper book, and even if the advice is inside, locating it among 600-odd pages takes time. You might be at deadline on a project and wish there was a faster method to solving a problem — so you can avoid the line at the Apple Genius Bar at the retail stores (if that’s even an option.)

O’Reilly’s got a shortcut for your fixit dilemma. Today the solution is e-books, editions of these Manuals you download and read on a Mac, an iPhone, a Kindle or yes, even the new iPad. Today, all e-book purchases are half-off, in celebration of Earth Day.

I already had the iPhone Missing Manual in my library last weekend, when my iPhone refused to sync up and cough up its photos. I wanted to push a new album onto the phone to show some images to a client. The new iPad was in use elsewhere at Bites HQ. The solution to the iPhone problem was inside the Missing Manual. I might have found it faster if I owned an e-book version instead.

The knock on e-books, if there is one, is that an online manual makes it less easy to browse. That used to be true before readers like the Kindle or the iPad. By now it’s just a memory, so long as the publisher can give you the e-book format you need.

O’Reilly is thorough about this selection. You purchase an e-book and get download rights to the .mobi, PDF, Android and ePub versions of your book. Two of these can be viewed on an iPad, and the PDF is viewable anywhere.

My problem needed an iPhone “restore to factory settings” solution. I take a deep breath when I do something like reset any device. You worry about losing your contacts for the iPhone, or apps you may have purchased, even things like the Marketplace podcasts or my favorite, On the Media. Nobody wants to reorder or reload such stuff.

Guess what word does not appear in the iPhone Missing Manual index? Yes, it’s “restore.” You can track it down under “resetting,” which leads you to saying aloud, “page 375″ while you turn to the page and start scanning it.

This whole process is so direct with an e-book. You type “restore” in the e-book viewer of your choice — Preview or Adobe Reader on the Mac, iBooks on the iPad or the ultra-fine PDF Reader Pro ($3.99), or GoodReader on the iPhone (99 cents) — and all those references pop up.

So I learned that a restore is not as scary as it might seem, because even if your iPhone has been acting up awhile — and backing up troubled files — you can go to the location of your last good backup and replace it with what iTunes offers you as a backup.

(If you’re wondering, those backups live in the user/library/Application Support/MobileSync/Backup folder. So you just go to your daily or weekly backups from Time Machine, because you back up every day, and swap in a clean backup. Before you restore.)

Although I love paper and the browsing of it, I find it harder than ever to justify a purchase of a training book (that’s what I call manuals) that takes up space on my sagging shelves or cherrywood desk. Pogue’s iPhone book is a great resource, complete and written so even a beginner to the Apple product can extend the phone’s use as a mobile computer.

This third edition is the latest, having been printed right as Apple brought out the 3GS phones last summer. Until the rumored 4G phones emerge this year, it’s the best you can buy for a complete lesson on the iPhone’s power.

I just don’t know if I need to make any more space for the paper here at HQ anymore. At least not if the publisher keeps offering e-books at discounts. O’Reilly even has a print+e-book offer at its own store. And the e-book versions are not sold at Amazon.

Today I bought a CSS Missing Manual (for WordPress blog designs) and the Photoshop CS4 Missing Manual, both as e-books. Total cost under $34. They’d be twice that as paper books. Get your discount before tonight and help out the Earth and reduce your recycling load.

If you haven’t seen one of these books, it may not be easy to describe how much color and how many screen shots prance across the pages. This is a book for the switcher who’s moved from a business Windows system to the simplicity of the Mac — or a more advanced user who needs a quick refresher and can just scan a picture to recall how to reset a forgotten password.

The emphasis here is on the complete set of computing tasks at an everyday level. Using the Dock, entering a Web address into Safari, composing email in Mail, locating files you’ve downloaded from the Web: it’s all shown screen by screen in Paul McFriederies’ book. The lessons are broken down into two-page spreads with alternative methods for some tasks, such as uninstalling applications or customizing the Dock.

If you’re working with a Mac for the first year, or in the first year of using Snow Leopard, this training tool might be just the right amount of information to avoid overload. Some users don’t need extensive details on the nuances of networking, or the best way to bring iPhone voice memos onto the Mac without a complete snyc of everything on the iPhone with the Mac. This isn’t a power users’ book, but it’s got plenty to show the small business and creative user who’s exploring the utility of the Mac.

About 20 percent of the book covers using the highly-visual Mac apps, iPhoto, iDVD, and iMovie. There’s a healthy spread devoted to iTunes, where across almost 50 pages you can learn how to manage music and the ever-growing controls of synchronization between iPhone and Mac.

One of the shortest sections of this book is its networking instructions. For plenty of users, networking amounts to linking with a WiFi network in their office or at a client site. Setting up a network is beyond the scope of this book, and securing a network isn’t covered at all. There’s a firewall in every Mac, but this book won’t help you understand that protection. On the upside, you’ll get a good primer on creating a robust password using Snow Leopard’s Password Assistant.

The Mac ships with software included to build Web sites, as well as features to record video from a Webcam or audio messages, but there’s nary a page about iWeb or Quicktime Player 7 in this book. The former is a underwhelming tool for building fundamental Web sites, while the latter is an optional install that provides much more multimedia power than Apple’s simple Quicktime Player.

But a training book like this one can’t really be judged by what’s missing as much as how it handles the included tasks, taught from scratch. You will learn how to create and manage iCal appointments or organize business contacts using Address Book, and this book — Wiley’s only Mac title in the Teach Yourself Visually Series — is a useful addition to a training library. It’s something to hand to the curious user who’s got the motivation to follow a pictured path to productivity. Let your Mac guru or administrator wrestle with one of Wiley’s 800-page bibles.

US $29.99