Coder's Revolution

Do you want a revolution?

Category Filtering: 'General'

ColdBox Preso for NOVA CF UG Slides and Recording

ColdBox, General

I'd like to thank Dan Fredericks and the NOVA CF UG for asking me to come and present for them last night.  I was given the floor to present whatever I wanted to regarding ColdBox as part of their History of CF Frameworks series.  I had a great time and was happy to be able to talk about some of the exciting things coming up in ColdBox's future as well as some demonstrations of CommandBox, the new CLI, REPL, and package manager for CFML developers.

Here is the Connect recording of the session:

http://experts.adobeconnect.com/p9tt6w78ldy/

And here is a PDF version of my slide deck: (1.3 MB)

ColdBox Platform - Brad Wood.pdf

3

Adobe Product Security Incident Response Team (PSIRT) On ColdFusion And HeartBleed

ColdFusion, General, Networking, Railo, Security

The world is abuzz with the OpenSSL "heartbleed" bug and the ColdFusion community has also been going 'round about it too.  Firstly, a server (like Apache, Nginx, Tomcat, etc) can be exploited by a client on a hackers machine requesting an SSL connection.  In addition, a client (CURL, wget, CFHTTP, etc) can be exploited if connecting to a malicious SSL endpoint.  So basically, the bug has the ability to flow both ways. 

For most CF sites, they are using IIS, Apache, or Nginx to serve content so ColdFusion has no bearing on the vulnerability from that end.  Any CFML application, however, can connect to a malicious SSL endpoint.  Of course, it only matters if the OpenSSL library is specifically being used.  Any other SSL implementation is safe.

To date, neither Adobe or Railo have yet to make public announcements via security bulletins or their official blog.

UPDATE April 17: Railo responds here.

UPDATE April 18: Adobe responds here:

There have been a handful of less "official" conversations in mailing lists and Twitter.  As best I can tell, neither Adobe ColdFusion or Railo use OpenSSL and therefore are safe.  Of course, any other parts of your web stack (even bundled libraries) might use OpenSSL.  Gert from Railo has promised a blog entry "soon" to address the issue regarding Railo.  There has been some complaining about the lack of official word from Adobe, and my understanding is that the ColdFusion team's hands are tied by the Adobe PSIRT who are the only ones allowed to comment publicly on security matters.

 The general consensus is they could certainly say something, even if it was simply, "Hey, we're looking into it and will get back to you soon".  That as it is, I E-mailed Adobe's PSIRT myself and got a reply that seems as close to an official reply as they are willing to provide at this point though I'm unclear why they're talking about it one-on-one but refraining from public statements.  For the sake of those who haven't E-mailed PSIRT, I will post their reply here for the benifit of the community until something official comes out.  Also, for funsies, I'll post my original E-mail plus my followup.  If I hear back again, I'll update this post.


From: Brad Wood
To: PSIRT@adobe.com
Date: Wed, Apr 16, 2014 at 5:45 AM
SubjectAdobe ColdFusion and Heartbleed

Dear Adobe PSIRT team, 

 
I would like to encourage you to please make a public announcement regarding Adobe ColdFusion and if it is vulnerable to the latest OpenSSL "heartbleed" bug. This is a very significant bug that has people around the world scrambling to patch their software.  Even if Adobe ColdFusion is not susceptible to the recent "heartbleed" bug I would strongly suggest making an announcement on your blog to state that or authorize the ColdFusion team to do so on their blog. 
 
Many people in the CF community have noticed the silence on this issue and an official announcement really needs to be made in order for your customers to feel safe and to verify with their employers that they have all the patches they need.  Communication is very important and I hate to see the Adobe ColdFusion team getting beat up for not addressing this issue publicly on their blog.  Please authorize them to make some kind of statement on this.
 
Thanks!
 
~Brad

From: PSIRT@adobe.com
To: Brad Wood
Date: Wed, Apr 16, 2014 at 1:39 PM
Subject: RE: Adobe ColdFusion and Heartbleed

Hello Brad,

 

Thank you for contacting us.  We appreciate your feedback.  Please note that ColdFusion does not use OpenSSL. However, customers who are using an external web server with their ColdFusion deployment (ex. Apache) should test for CVE-2014-0160. If affected, customers should follow the recommendations provided in the OpenSSL security advisory, available at https://www.openssl.org/news/secadv_20140407.txt. Adobe

also recommends consulting the ColdFusion lockdown guides for security best practices:

https://www.adobe.com/content/dam/Adobe/en/products/coldfusion-enterprise/pdf/cf10-lockdown-guide.pdf

http://www.adobe.com/content/dam/Adobe/en/products/coldfusion/pdfs/91025512-cf9-lockdownguide-wp-ue.pdf

 

We hope this information is helpful.  Please let us know if you have additional questions.

 

Thank you,

Adobe Product Security Incident Response Team


From: Brad Wood
To: PSIRT@adobe.com
Date: Wed, Apr 16, 2014 at 3:13 PM
SubjectAdobe ColdFusion and Heartbleed

Dear PSIRT Team, 
 
Thanks for the reply.  I appreciate the links and concern.  Let me be very clear though-- I am not asking about this for the sake of my servers, I am letting you know that Adobe needs to make a public official statement on the matter for the entire community to see.  Even if your blog entry said nothing more than what you put in your E-mail reply that would be great-- but the community has noticed the lack of public response by Adobe to this matter and it's reflecting quite poorly on your PR.
 
If the PSIRT team doesn't have time to make a quick announcement, please authorize the ColdFusion team to put out a blog post.  This would do a lot for the community as silence breeds distrust and most every other major technology stack have already addressed their platform publicly-- even if just to say they are not vulnerable.
 
Thanks!
 
~Brad
 

UPDATE April 18:


From: Brad Wood
To: PSIRT@adobe.com
Date: Thu, Apr 17, 2014 at 9:50 PM
SubjectAdobe ColdFusion and Heartbleed

Dear PSIRT team,

 
Can you please respond to the comments on my blog made by a community member named "Aaron".  He has listed several binaries that ship with ColdFusion that supposedly use OpenSSL.  His comments can be found here:
 
 
Also, if you haven't seen it-- here is the official response from the Railo team (a competitor of Adobe CF) which categorically addresses the uses of SSL inside Railo server.
 
 
Thanks!
 
~Brad

From: PSIRT@adobe.com
To: Brad Wood
Date:  Fri, Apr 18, 2014 at 2:58 PM
SubjectAdobe ColdFusion and Heartbleed

Hi Brad,

Thanks to you and Aaron for bringing this to our attention.  With your input, we started a deeper investigation of ColdFusion components.  We have also clarified our blog post regarding OpenSSL in ColdFusion (http://blogs.adobe.com/psirt/?p=1085).  Should additional information arise from our investigation we'll provide an update to our blog.

 

Thank you again for your help,

Adobe Product Security Incident Response Team

6

Will A Piece Of Paper, Folded 42 Times, Reach The Moon?

General, Mathmatics

So I was at a friend's house Sunday night playing a game when this odd fact came up in conversation:

If you were to fold a piece of paper in half 42 times, it would reach the moon.

Several of those around the table scoffed at this, exclaiming that a single sheet of paper was simply too thin to have its thickness reach any substantial amount after only a few dozen folds.  I pointed out it was entirely possible seeing as how doubling the thickness with each fold would lead to an exponential increase in thickness that would increase slowly at first before quickly getting larger.  My friends were clearly imagining a linear increase in thickness.

I also knew that it is pretty much impossible to fold a single sheet of paper more than about 8 times -- though Myth Busters once folded a giant sheet the size of a football field 10 times. The resulting thickness (after hitting it with a bulldozer) was almost a foot tall, though there was quite a bit of air mixed in with the 1,024 sheets.  The formula for finding out how many of something you'll have after doubling it N number of times is as follows where O is the original number (or size in our case).

o * 2^(n)

A standard sheet of paper is about 0.1 mm so 42 folds would give us this:

0.1 * 2^(42) = 439,804,651,110 mm

That's 440 billion millimeters, or 439,804 kilometers.  The moon on average is 384,400 kilometers from Earth according to Google.  I'd say this checks out.  

To help visualize the data, I created a quick spreadsheet and graph that tracks the thickness of the paper for each fold.

# Folds Thickness (mm)
0 0.10
1 0.20
2 0.40
3 0.80
4 1.60
5 3.20
6 6.40
7 12.80
8 25.60
9 51.20
10 102.40
11 204.80
12 409.60
13 819.20
14 1,638.40
15 3,276.80
16 6,553.60
17 13,107.20
18 26,214.40
19 52,428.80
20 104,857.60
21 209,715.20
22 419,430.40
23 838,860.80
24 1,677,721.6
25 3,355,443.2
26 6,710,886.4
27 13,421,773
28 26,843,546
29 53,687,091
30 107,374,182
31 214,748,365
32 429,496,730
33 858,993,459
34 1,717,986,918
35 3,435,973,837
36 6,871,947,674
37 13,743,895,347
38 27,487,790,694
39 54,975,581,389
40 109,951,162,778
41 219,902,325,555
42 439,804,651,110

And to graph that out in kilometers looks like this:

2

Know Python? Help ColdFusion Get Proper Script Highlighting On GitHub

ColdFusion, General, GitHub

It's bothered me for a while, that GitHub and Gist don't have proper syntax highlighting for full-script CFCs like this one.  

They handle tags fine, and even do script inside of a <cfscript> tag, but just leave full script components as black text all the way down the page.

 ColdFusion has allowed all-script components since version 9 which was released 5 years ago.  I always just assumed that GitHub was aware of the problem and someone somewhere was hard at work resolving it.  Silly Me.

GitHub uses this Ruby library to determine what language a while is written in:

https://github.com/github/linguist

Which in turn uses this Ruby wrapper to spin up the syntax highlighter:

https://github.com/tmm1/pygments.rb

But that library is just a proxy to this Python library that actually does the color coding:

https://bitbucket.org/birkenfeld/pygments-main

It looks like there's already a ticket from 2012 to add support and Ben Riordan took a whack at it last year with no luck.  So I've forked the Pygments library, but know nothing of Python so I'm asking anyone who does to help me get this figured out.  Since script already works inside <cfscript> tags, it sounds like all the pieces are there-- we just need to properly identify script components and use the correct highlighter for them. Comment here or shoot me an E-mail if you'd like to help!

4

Who's Had More Vulns- PHP, Java, or ColdFusion?

ColdFusion, General, Security, Technology

I get tired of people on complaining about ColdFusion as a technology choice because it's "so insecure".   I regularly am told that it has more holes, more vulnerabilities, and a worse track record than other platforms. That's why I compiled this quick chart showing the number of Common Vulnerabilities and Exposures (CVE) by year for CF as well as PHP and Java (as reported by cvedetails.com) which are two of the most-used languages on the web.  I also threw in Apache Tomcat for comparison since it completes in the web space and CF10 actually runs on a version of it.

 

Click to enlarge

So to break this down, the red line riding out on top with a huge spike in 2007, that's PHP.  The purple line coming out of the backfield for a solid lead (?) at the end is Java.  The yellow line is Tomcat who still manages 10-15 vulns a year (and the only one to go LOWER than CF.  And that green line on the bottom with the lowest number of vulns every year, and nothing even reported until 2006- that would be CF.

So, sure-- there's a lot more info than just the counts on the chart.  My point also isn't that PHP or Java are bad-- I'm just trying to make the point that oft-used technologies are targeted by crackers and nobody is perfect.  And according to this data, CF is doing way better than several of the main techs out there.  It should also be noted that CF, Java, and PHP were all created the same year-- 1995, so don't give me any of this "old" crap either.  (Tomcat was created in 1999)

References:

 

10

Coder's Revolution Is Now Running ContentBox CMS

ColdBox, ColdFusion, ContentBox, General

I am proud to have finally brought my blog into the new age my converting from BlogCFC which served me well for many years to ContentBox Modular CMS.  Other than a few case-sensitivity glitches moving my database from a Windows backup to my Linux server, it went very well.  Contentbox has a built-in BlogCFC converter which is very nice and pulled across all my content, categories, comments, users, etc in just a minute or so.  I also wrote a simple open source module for ContentBox which will support the old BlogCFC-style links to entries, pages, and RSS feeds so old links will still work.  I am using Computer Know How's Bootswatch Theme.

 Both the URL compatibility module and the Bootswatch theme are available on ForgeBox and can be installed directly from the ContentBox admin with the click of a button.  This is part of why ContentBox is so advanced and extensible.  Hopefully I'll blog a bit more now that I've got all the new ContentBox features.  I know I still need to do some cleanup on the code formatting in some of my entries.  If you see any broken links for functionality, please let me know so I can take a look and fix it.

3

ContentBox is Giving Away a Kindle Fire for Christmas

ColdBox, ContentBox, General
ContentBox and Ortus Solutions just announced a new contest today. All you have to do is write an original ContentBox Theme or Module and submit it to ForgeBox by the Dec 14th deadline.

First prize is a Kindle Fire and a $50 Amazon Gift Card. Runner up is $50 worth of iTunes and Amazon Gift Cards. We're excited to see what the community comes up with.
0

My "One Tough Puzzle" JavaScript Brute Force Solution

General, JavaScript, Technology
So, I've been sitting on this for months (because I'm lazy) and decided it's finally time to post it. My mother-in-law visited a while back and brought a puzzle for the kids to play with. It's called "One Tough Puzzle". It claims to have "more the 300,000 wrong ways, but only one right way to assemble it." Well, after fiddling with it for a while, I did what any code-blooded hacker would do and wrote some JavaScript to brute force solve it.
2

Call to Arms: We All Need to Evangelize

ColdBox, General, Technology
Prior to this week, there were Wikipedia entries for MockBox, CacheBox and WireBox, but they've all been deleted by Wikipedia. There still is an entry for the ColdBox Platform-- for now. It's also been marked for deletion. So has the FuseBox page. The main reason for the deletion notices is that those articles don't have enough notable third-party references to support them. Wikipedia moderators say those topics just don't have enough articles, news, and books written about them OUTSIDE of their own community, or for that matter; the ColdFusion community.
1

Take A Quick ColdBox Survey, Win An iPod Shuffle

ColdBox, ColdFusion, General, LogBox, WireBox
If you currently use (or recently used) ColdBox, we want to know your thoughts. Take our quick, anonymous survey to tell us what you like or dislike about ColdBox and we'll put your name in for a drawing to win your choice of either an iPod Shuffle or a 1 hour consultancy with the creator of ColdBox, Luis Majano. http://blog.coldbox.org/blog/why-do-you-use-coldbox
0