penetration test 滲透測試

penetration test 滲透測試

Data sanitization

Data sanitization

Code injection is the exploitation of a computer bug that is caused by processing invalid data. Injection is used by an attacker to introduce (or "inject") code into a vulnerable computer program and change the course of execution. The result of successful code injection is often disastrous (for instance: code injection is used by some computer worms to propagate).

Reference:

https://en.wikipedia.org/wiki/Code_injection#Preventing_code_injection

All-pairs testing

In computer science, all-pairs testing or pairwise testing is a combinatorial method of software testing that, for each pair of input parameters to a system (typically, a software algorithm), tests all possible discrete combinations of those parameters. Using carefully chosen test vectors, this can be done much faster than an exhaustive search of all combinations of all parameters, by "parallelizing" the tests of parameter pairs.

http://en.wikipedia.org/wiki/All-pairs_testing
http://www.pairwise.org/

What is the most efficient way to generate all the multiset, combinations, probability, dispositions and permutations of an array in PHP?

What is the most efficient way to generate all the multiset, combinations, probability, dispositions and permutations of an array in PHP?

Here is code to get all permutations:

http://www.php.net/manual/en/function.shuffle.php#90615

With the code to get the power set, permutations are those of maximal length, the power set should be all combinations. I have no idea what dispositions are, so if you can explain them, that would help.

You can use this class: http://pear.php.net/package/Math_Combinatorics

combination with repetitions
統計學
組合排列

http://en.wikipedia.org/wiki/All-pairs_testing
http://rosettacode.org/wiki/Combinations_with_repetitions
http://en.wikipedia.org/wiki/Multiset
http://en.wikipedia.org/wiki/Probability
http://en.wikipedia.org/wiki/Combination
http://en.wikipedia.org/wiki/Permutations

Verification and Validation

經 LCamel 一提，發現英文的用詞很有趣，Verification and Validation 裡這麼解釋：

It is sometimes said that validation can be expressed by the query "Are you building the right thing?" and verification by "Are you building the thing right?" "Building the right thing" refers back to the user’s needs, while "building it right" checks that the specifications be correctly implemented by the system.

意即：

滿足需求 = validation = do the right thing.
驗證作法 = verification = do the thing right.
語言真是奇妙啊，用一句話來總結，就是「Are the do you right thing right?」

http://en.wikipedia.org/wiki/Verification_and_Validation
http://fcamel-fc.blogspot.tw/2009/09/blog-post_05.html

two-tier

Refers to client/server architectures in which the user interface runs on the client and the database is stored on the server. The actual application logic can run on either the client or the server. A newer client/server architecture, called a three-tier architecture introduces a middle tier for the application logic.

http://www.webopedia.com/TERM/T/two_tier.html

three-tier

A special type of client/server architecture consisting of three well-defined and separate processes, each running on a different platform:

1. The user interface, which runs on the user's computer (the client).
2. The functional modules that actually process data. This middle tier runs on a server and is often called the application server.
3. A database management system (DBMS) that stores the data required by the middle tier. This tier runs on a second server called the database server.

The three-tier design has many advantages over traditional two-tier or single-tier designs, the chief ones being:

• The added modularity makes it easier to modify or replace one tier without affecting the other tiers.
• Separating the application functions from the database functions makes it easier to implement load balancing.
• Refers to client/server architectures in which the user interface runs on the client and the database is stored on the server. The actual application logic can run on either the client or the server. A newer client/server architecture, called a three-tier architecture introduces a middle tier for the application logic.

http://www.webopedia.com/TERM/T/three_tier.html

What is the difference between server motherboard and desktop motherboard?

The difference is in the way the circuits on the motherboard are designed. Normally a desktop workload is no more than casual surfing, may be a bit of office suite tools or some developmental activity. All this pertaining to One physical user at a time. And not many services running on the system, which means the load on the system resources such as CPU, RAM & I/O is not very demanding. Hence the different interconnects between CPU, Mem & I/O are generally slower. Similarly the CPUs are generally designed to handle the compute requirements of a single user computing needs as mentioned above.

But a server is altogether different. It has to support multiple users. A server could be a web server, App server, DB server which require a lot of processes to be running in the background. This puts a lot of load on the CPU, RAM and I/O. Which means the bus(es) interconnecting the various peripherals have to be fast. There should be no bottlenecks. Also there should be provision to support multiple processors to cope with increasing work loads. Hence the bus(es) are designed to support this. Since the server is a critical, it needs certain Reliability. availability and serviceability (RAS) features, such as circuit redundancy built-in, remote management etc. All this require additional circuitary which needs to be incorporated on to the board.

On a broad level these are the fundamental technical differences between a desktop board and server board.

Hope that helps.

Server motherboards usually have dual sockets for processors.
-made only for servers and not for desktops.
-huge and never fit in computer cases.
-a lot of sockets for RAM and PCI-E

Desktop motherboards have only one socket for a processor.
-smaller than server ones and a lot cheaper.
-less sockets for RAM and PCI-E

About 200-300 bucks. Actually the difference is different chip. Most server motherboards use a XEON with is not used in desktop. Also they can support way more ram also. The price for it is about 2x or 3x a typical motherboard.

http://answers.yahoo.com/question/index?qid=20080208183342AAjfGbc

Scrum - managing software projects and product

Scrum - is an iterative and incremental agile software development method for managing software projects and product or application development. Scrum has not only reinforced the interest in project management[citation needed], but also challenged the conventional ideas about such management. Scrum focuses on project management institutions where it is difficult to plan ahead. Mechanisms of empirical process control, where feedback loops that constitute the core management technique are used as opposed to traditional command-and-control oriented management.[citation needed] It represents a radically new approach for planning and managing projects, bringing decision-making authority to the level of operation properties and certainties.[1]

Reference:
http://en.wikipedia.org/wiki/Scrum_(development)

Low Level Virtual Machine (LLVM)

Low Level Virtual Machine

The Low Level Virtual Machine (LLVM) is a compiler infrastructure, written in C++, which is designed for compile-time, link-time, run-time, and "idle-time" optimization of programs written in arbitrary programming languages. Originally implemented for C/C++, the language-independent design (and the success) of LLVM has since spawned a wide variety of front ends, including Objective-C, Fortran, Ada, Haskell, Java bytecode, Python, Ruby, ActionScript, GLSL, and others.

http://en.wikipedia.org/wiki/Low_Level_Virtual_Machine

LVM is a logical volume manager

LVM is a logical volume manager for the Linux kernel; it manages disk drives and similar mass-storage devices, in particular large ones. The term "volume" refers to a disk drive or partition thereof. It was originally written in 1998 by Heinz Mauelshagen, who based its design on that of the LVM in HP-UX.

Reference: http://en.wikipedia.org/wiki/Logical_Volume_Manager_(Linux)

ACID (atomicity, consistency, isolation, durability) is a set of properties that guarantee that database transactions are processed reliably

ACID (atomicity, consistency, isolation, durability) is a set of properties that guarantee that database transactions are processed reliably

In computer science, ACID (atomicity, consistency, isolation, durability) is a set of properties that guarantee that database transactions are processed reliably. In the context of databases, a single logical operation on the data is called a transaction. An example of a transaction is a transfer of funds from one bank account to another, even though it might consist of multiple individual operations (such as debiting one account and crediting another).

Although Jim Gray is credited with defining, in the late 1970s, these key transaction properties of a reliable system, and with helping to develop the technologies that automatically achieve these,[1] the acronym ACID was coined by Andreas Reuter and Theo Haerder in 1983.[2]

Standard operating procedure SOP

Standard operating procedure SOP

Snapshot (computer storage)

Snapshot (computer storage)

From Wikipedia, the free encyclopedia

Jump to: navigation, search

In computer file systems, a snapshot is a copy of a set of files and directories as they were at a particular point in the past. The term was coined as an analogy to that in photography.

Contents[[url=javascript:toggleToc()]hide[/url]]

1 Rationale

2 Implementations

2.1 Volume managers

2.2 File systems

2.3 In databases

2.4 In virtualization

2.5 Other applications

3 External links

[edit] Rationale

A full backup of a large data set may take a long time to complete. On multi-tasking or multi-user systems, there may be writes to that data while it is being backed up. This prevents the backup from being atomic and introduces a version skew that may result in data corruption. For example, if a user moves a file from a directory that has not yet been backed up into a directory that has already been backed up, then that file would be completely missing on the backup media. Version skew may also cause corruption with files which change their size or contents underfoot while being read.

One approach to safely backing up live data is to temporarily disable write access to data during the backup, either by stopping the accessing applications or by using the locking API provided by the operating system to enforce exclusive read access. This is tolerable for low-availability systems (on desktop computers and small workgroup servers, on which regular downtime is acceptable). High-availability 24/7 systems, however, cannot bear service stoppages.

To avoid downtime, high-availability systems may instead perform the backup on a snapshot—a read-only copy of the data set frozen at a point in time—and allow applications to continue writing to their data. Most snapshot implementations are efficient and can create snapshots in O(1). In other words, the time and I/O needed to create the snapshot does not increase with the size of the data set, whereas the same for a direct backup is proportional to the size of the data set.

Read-write snapshots are sometimes called branching snapshots, because they implicitly create diverging versions of their data. Aside from backups and data recovery, read-write snapshots are frequently used in virtualization, sandboxing and virtual hosting setups because of their usefulness in managing changes to large sets of files.

[edit] Implementations

[edit] Volume managers

Some Unix systems have snapshot-capable logical volume managers. These implement copy-on-write on entire block devices by copying changed blocks—just before they are to be overwritten—to other storage, thus preserving a self-consistent past image of the block device. Filesystems on this image can later be mounted as if it were on read-only media. Block-level snapshotting is almost always less space-efficient than direct file system support for snapshots.

[edit] File systems

Some file systems, such as WAFL, fossil for Plan 9 from Bell Labs or ODS-5, internally track old versions of files and make snapshots available through a special namespace. Others, like UFS2, provide an operating system API for accessing file histories. In NTFS, access to snapshots is provided by the Volume Shadow-copying Service (VSS) in Windows XP and Windows Server 2003 and Shadow Copy in Windows Vista. Snapshots have also been available in the NSS (Novell Storage Services) file system on NetWare since version 4.11, and more recently on Linux platforms in the Open Enterprise Server product.

Sun Microsystems ZFS has a hybrid implementation which tracks read-write snapshots at the block level, but makes branched file sets nameable to user applications as "clones".

Time Machine, included in Apple's Mac OS X v10.5 operating system, is not a snapshotting scheme but a system-level incremental backup service: it merely watches mounted volumes for changes and copies changed files periodically to a specially-designated volume using hard links.

[edit] In databases

The SQL specification mandates four levels of transaction isolation. In the highest, SERIALIZABLE, a snapshot is implicitly created at the start of every transaction. The backup utilities for many popular SQL databases use this feature to generate self-consistent dumps of table data.

[edit] In virtualization

System emulators host a guest operating system in a virtual machine; some (including VMware, Qemu and Virtual PC) can perform whole-system snapshots by dumping the entire machine state to a backing file and redirecting future guest writes to a second file, which then acts as a copy-on-write table.

[edit] Other applications

Software transactional memory is a scheme which applies the same concepts to data structures held only in memory.

[edit] External links

Garimella, Neeta (2006-04-26). "Understanding and exploiting snapshot technology for data protection, Part 1: Snapshot technology overview". http://www-128.ibm.com/developerworks/tivoli/library/t-snaptsm1/index.html.

Harwood, Mike (2003-09-24). "Storage Basics: Backup Strategies". http://www.enterprisestorageforum.com/management/features/article.php/3082691.

Janssen, Bob (2008-08-04). "Snapshot Intelligence: Using Snapshots to their Fullest Potential". http://www.res.eu/Files/File/RES%20White%20Paper%20-%20Snapshot%20Intelligence%20v2000-01L.pdf.

integrity (完整)

intact (完整性地)

integrity (完整)

Database integrity ensures that data entered into the database is accurate, valid, and consistent

Profiling

Profiling: Objective Analysis "Profiling" means running your code in a controlled environment to see what actually happens, not what you think happens.

solution stack

solution stack

In computing, a solution stack is a set of software subsystems or components needed to deliver a fully functional solution, e.g. a product or service.

For example, to develop a web application, the designer needs to use an operating system, web server, database and programming language. Another version of a solution stack is operating system, middleware, database, and applications.[1]

One of the many possible solution stacks available is LAMP:[2]

* Linux (the operating system)
* Apache (the web server)
* MySQL (the database management system)
* Perl, PHP, or Python (scripting languages)

PHP accelerator (PHP op-code caches)

PHP accelerator
From Wikipedia, the free encyclopedia
Jump to: navigation, search

A PHP accelerator is an extension designed to boost the performance of software applications written using the PHP programming language. Most PHP accelerators work by caching the compiled bytecode of PHP scripts to avoid the overhead of parsing and compiling source code on each request (some or all of which may never even be executed). For best performance, caching is to shared memory with direct execution from the shared memory and the minimum of memory copying at runtime. A PHP accelerator typically reduces server load and increases the speed of PHP code anywhere from 2-10 times, depending on factors such as the inherent execution time of the PHP application and the percentage of source code actually executed on a given request. While a code optimizer may even slow down overall performance when used in isolation, it can provide an additional performance boost when coupled with a code cache as the optimization effort is performed just once.

Benchmarking

Benchmarking is the process of comparing the business processes and performance metrics including cost, cycle time, productivity, or quality to another that is widely considered to be an industry standard benchmark or best practice. Essentially, benchmarking provides a snapshot of the performance of your business and helps you understand where you are in relation to a particular standard. The result is often a business case and "Burning Platform" for making changes in order to make improvements. The term benchmarking was first used by cobblers to measure people's feet for shoes. They would place someone's foot on a "bench" and mark it out to make the pattern for the shoes. Benchmarking is most used to measure performance using a specific indicator (cost per unit of measure, productivity per unit of measure, cycle time of x per unit of measure or defects per unit of measure) resulting in a metric of performance that is then compared to others.

Also referred to as "best practice benchmarking" or "process benchmarking", it is a process used in management and particularly strategic management, in which organizations evaluate various aspects of their processes in relation to best practice companies' processes, usually within a peer group defined for the purposes of comparison. This then allows organizations to develop plans on how to make improvements or adapt specific best practices, usually with the aim of increasing some aspect of performance. Benchmarking may be a one-off event, but is often treated as a continuous process in which organizations continually seek to improve their practices.

Debugging

Debugging is a methodical process of finding and reducing the number of bugs, or defects, in a computer program or a piece of electronic hardware thus making it behave as expected. Debugging tends to be harder when various subsystems are tightly coupled, as changes in one may cause bugs to emerge in another.