BaseX-Talk

basex-talk@mailman.uni-konstanz.de

13 participants
5244 discussions

Re: [basex-talk] Use of unsalted password hashes
by Dimitar Popov 18 Mar '12

18 Mar '12

Am Sonntag, 18. März 2012, 12:16:48 schrieb Charles Duffy: > On Sun, Mar 18, 2012 at 10:16 AM, Dimitar Popov < > Dimitar.Popov(a)uni-konstanz.de> wrote: > > > Am Sonntag, 18. März 2012, 09:08:36 schrieb Charles Duffy: > > > Caching accepted username/password pairs in RAM, and maintaining a > > > separate pool using the credentials for each such pair, would _work_, > > > but it would mean that you'd have to be careful not to let the memory > > > that information is stored in get swapped to disk -- writing users' > > > passwords to disk, even by way of the OS's swap operations, being a > > > serious no-no. > > > > The pairs username/password can be, of course, hashed and additionally, > > swap > > partitions can be encrypted, if such a level of security is required. > > > > Hashing could work, but adds a requirement that only basic auth be > supported. Given the number of other credential-proving mechanisms in the > world (Kerberos, NTLM, etc), this seems a very unfortunate limitation to > place on future development. > > As for encrypted swap -- in a typical commercial environment, that's > outside of the dev team's control unless they bother to do a great deal of > paperwork and politics; in short, not an acceptable solution. > > AFAIK, JCA provides a keystore mechanism, which I guess, provides enough > > means > > of protection against steal. I'm, however, too lazy to thoroughly read the > > JCA > > guide [1], but the first which comes to my mind is for example, external > > storage of keys. > > > > Again, to make that keystore secure, you're creating requirements that the > typical user won't implement. Better to design things to be secure > out-of-the-box, rather than "secure if only you do A, B, C and D". Well, then it seems after all, that the token alternative provides the highest degree of flexibility and security :) I guess, if there are no other suggestions, it should be discussed how to implement it. Regards, Dimitar

1 0

Use of unsalted password hashes
by Charles Duffy 18 Mar '12

18 Mar '12

Howdy -- I'm a bit concerned about storing password hashes unsalted -- compared to a salted hash, this makes a stolen database easier to retrieve user passwords from, dangerous if users use their passwords for other purposes as well. Would salting (and perhaps stretching) the hashes be considered a reasonable feature to support in the future?

4 16

Setting the context item via the native protocol
by Charles Duffy 17 Mar '12

17 Mar '12

Howdy -- Right now, I'm aware of two ways to set the context item via the native protocol: (1) Insert a "declare context item" header into the document - Disadvantage: Should only work when XQUERY3 is true - Disadvantage: Modifies line/column references for errors received - Disadvantage: Hard to ensure that user-provided XML document will evaluate to itself in XQuery (security risk) (2) Use the "CS" ["Context Set"] command - Disadvantage: Requires a database to be open (why?) - Disadvantage: Hard to ensure that user-provided XML document will evaluate to itself in XQuery (security risk) Is there a better approach?

2 8

REPOPATH prefixed twice on current snapshots?
by Charles Duffy 17 Mar '12

17 Mar '12

In my .basex file: REPOPATH = /home/cduffy/local/opt/basex-data/repo ...and running repo:list() shows my local package, with namespace http://dyfis.net/ as installed, but trying to use anything from it leads to an error similar to the following: releng.db.basex.rest.RemoteException: [XQST0059] Could not retrieve module '/home/cduffy/local/opt/basex-data/home/cduffy/local/opt/basex-data/repo/http-dyfis.net-0.1.140101/dyfis/reporting.xq'. This is happening with a local build of 230e16551cf397def9e6c59044ff605e48908e1c (current master on github).

2 8

after upgrading one big disaster
by jidanni＠jidanni.org 17 Mar '12

17 Mar '12

All I know back in December the Makefile and programs in http://radioscanningtw.jidanni.org/images/radioscanningtw/maps/ worked fine. Now with BaseX 7.1.1 it is one big disaster and will take days to rewrite.

3 6

Any way to persist OutputStream in DiskData?
by Dave Glick 16 Mar '12

16 Mar '12

Hi, I've been doing some profiling recently and noticed one area in particular that appears to be using a lot of cycles. In calls to DiskData.write() the final DataOutput.close() call results in 20% - 40% of overall execution time in a variety of cases. The following screen capture shows the aggregated call stack (though it might look a little funny since this is the cross-compiled version used for Nxdb). Admittedly, this is probably an issue that just impacts me. Based on the trace, I suspect the issue is related to the releasing of handles rather than the actual disk writes (though I could be wrong - I'm not entirely sure what the cross-compiler does behind the scenes to support Java file descriptors). In any case, my question boils down to wondering if there is a way to force the DiskData class to use a persistent DataOutput instance instead of creating and closing a new one for every write? Instead, could a DataOutput be kept open until the database is "unpinned" and simply flushed on each write? Would this cause any problems with the current GUI, server, etc. uses? Thanks, Dave

3 4

fulltext index: case sensitive vs. case insensitive
by Cerstin Mahlow 16 Mar '12

16 Mar '12

Hi, If I create the fulltext index with "stemming" switched on and "case sensitive" switched off, there is no way to enable case sensitive search, is this correct? So if users would like to search case sensitive as well as case insensitive, I would have to create two indices? Which would mean creating actually four indices to allow for fuzzy search or exact matches as well: w/ stemming and w/ case sensitive w/ stemming and w/o case sensitive w/o stemming and w/ case sensitive w/o stemming and w/o case sensitve. That's quite a lot of data! Would it be possible to handle case sensitivity rather as an option for the query than as an option for the index, like described here: <http://www.xmlmind.com/tutorials/XQueryFullText/index.html#d0e333> Best regards Cerstin -- Dr. phil. Cerstin Mahlow Universität Basel Deutsches Seminar Nadelberg 4 4051 Basel Schweiz Tel: +41 61 267 07 65 Fax: +41 61 267 34 40 Mail: cerstin.mahlow(a)unibas.ch Web: http://www.oldphras.net ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

2 1

Delete attributes
by William P. Heise 16 Mar '12

16 Mar '12

How do I delete attributes? (and just the attribute, not the node) Motivation: I have a db where 20% of the attributes is the same, 'title', which is never used. Deleting it could decrease the size of the db. /William ________________________________ Please consider the environment before printing. </pre> <div style="FONT-FAMILY: arial;color:#525759;font-size:9pt; margin-top:15px">This e-mail and any attachments are intended only for the named recipient(s) and may contain information that is legally privileged, confidential, or exempt from disclosure under applicable law. This message may be logged for archival purposes, may be reviewed by parties at Deltek other than those named in the message header, and may not necessarily constitute an official representation of Deltek. If you have received this message in error, or are not the named recipient(s), you may not retain copy or use this e-mail or any attachment for any purpose or disclose all or any part of the contents to any other person. Any such dissemination, distribution or copying of this e-mail or its attachments is strictly prohibited. Please immediately notify the sender and permanently delete this e-mail and any attachment from your computer.</div>

2 2

REPLACE fails when root has attributes
by Charles Duffy 15 Mar '12

15 Mar '12

> REPLACE inventory <root foo="bar">test</root> Stopped at line 1, column 24: Syntax: REPLACE [path] [input] Replace documents in database. Replaces documents in the current database.

1 1

ADD:REPLACE :: STORE:?
by Charles Duffy 15 Mar '12

15 Mar '12

Restated: "ADD is to REPLACE as STORE is to... what?" REPLACE, like ADD, expects the content given to be parsed rather than raw. ADDing the same content twice can result in two documents with the same name in the database; I'm presuming that duplicate STORE commands have similar peril attached. What is the appropriate mechanism to use when replacing one version of raw content with another?

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

BaseX-Talk