Posts Tagged ‘Developers’

Apple nudging developers to get apps Gatekeeper-ready

May 1st, 2012

Apple’s release of its Mountain Lion software isn’t until “late summer,” though today the company began nudging developers to get their software up to speed with its new security feature.

In an e-mail sent to developers this afternoon and forwarded on to CNET, Apple urged developers to start signing their apps and other software with their Apple Developer ID certificate so they will get by Gatekeeper, a security feature that’s built into Apple’s next OS and designed to keep malware at bay.

“Gatekeeper is a new feature in OS X Mountain Lion that helps protect users from downloading and installing malicious software,” Apple told developers. “Signing your applications, plug-ins, and installer packages with a Developer ID certificate lets Gatekeeper verify that they are not known malware and have not been tampered with.”

The feature has three levels of security, though by default it’s set up to keep software from being installed unless it’s sold through Apple’s Mac App Store, or been certified by a registered Apple developer. The two other options allow users to either install anything without running the additional security check (which is how it works in existing versions of the OS), or limit software installations to Apple’s Mac App Store.

As mentioned in previous coverage, Mountain Lion is a successor to OS X 10.7 Lion, which Apple released last July. The software takes several cues from Apple’s iOS platform, bringing over features like Notification Center, and apps like Reminders and Notepad.

Apple is currently on its third developer preview of Mountain Lion. The first preview came in February, alongside the unveiling of the upcoming OS.

Source:http://news.cnet.com/8301-13579_3-57424371-37/apple-nudging-developers-to-get-apps-gatekeeper-ready/

Why Software Developers Don’t Care About Application Security

December 21st, 2011

Software development is not easy. In fact, I don’t think I’ve ever really seen a job with more conflicting priorities.

On one hand developers are asked to churn out endless code releases and deal with continuously shifting requirements of what feels like an impossible race. During crunch times they’re asked to work hundreds of hours to meet insane deadlines, skip holidays and ignore families. On the other hand, they’re expected to explain to the business why a piece of functionality is taking so long to develop and why testing its functionality can take just as much time.

Developers are pulled in a million different directions and they are always asked to deliver more than before.

I have not worked as a developer. That said, I’ve worked alongside them and been present during a lot of these kinds of discussions. I can’t help but empathise with them, their problem solving and hard work ethic so often goes unsung.

So it comes as no surprise to me when information security professionals conflict with developers grappling with application security. “When will they get it?” the security pros cry.

I am often bemused when consultants talk about application security awareness training for developers and testers. Have they ever tried training the developers themselves? Have they ever stopped to ask developers why they didn’t validate certain inputs? Not likely. If they did ask, they might have received a response along the lines of “Umm. I dunno what I was thinking. It was one AM and I hadn’t slept for two days at the time I wrote that. Sorry bro.” If, as a security professional, you were a developer in another life, then you are a rare breed. I’m sure you would never need to ask that question. You’d understand.

Application security does not exist in a vacuum and for developers, it is just one of many competing (and in some cases, seemingly conflicting) requirements that are expected to be addressed. Security controls should always be seamless and transparent, and in the case of developers, their work should be no exception. Frameworks like ASP.NET come with a number of attributes which can be readily adopted by developers to support security with minimal fuss, such as Anti-XSS library, features to prevent Cross Site Request Forgery and robust session management controls.

Our job as security professionals is to make developers jobs easier, and by extension, our own as well. Try to understand the languages and frameworks your developers are working with. Tell them what libraries they can use which contain the desired security functionality. If these libraries resolve specific problems, that means less code they have to write and a reduced likelihood that they’ll get it wrong. The Open Web Application Security Project (OWASP)’s ESAPI Project is a prime example of providing a consistent toolset for all languages. Once you prove you can help them save time in development and prove that security doesn’t have to be a huge problem, then they’ll invariably be grateful – and perhaps they’ll also start getting it.

Source:http://www.cso.com.au/article/410766/why_software_developers_don_t_care_about_application_security/

Property developers encouraged to focus on ‘software’ solutions

November 16th, 2011

Faced with intense competition, property developers have been on a drive to market its units with unique architectural designs to gain a bigger slice of the market.
However, developers have occupy most, if not all, of their attention into the ‘hardware’ aspects of development, forgetting that after-sales service (software) plays a greater role in sustaining the player’s brand-name in the long-run.
“It is a very competitive playground out there. Property developers are so caught up with the design of their products and its quality that service itself is neglected. In the past, traditional developers are only concerned about the number of units sold with very little emphasis on the management afterwards,” said Amber Skyline Sdn Bhd (Amber Skyline) executive director Wee Ai Na to The Borneo Post.
A member of the Wee Boon Ping Group, branding consultancy firm Amber Skyline has been on a vigorous mode to market and brand its clientele’s portfolios on both regional and global landscape. The group has been forming strong alliances with real estate networks, one being Remax Singapore.
With years of experience within the real estate segment of the Asia Pacific region, occupancy rate, as Wee observed, in Malaysia has been ‘ridiculously’ low as compared with other countries like Singapore.
“Perhaps one of the main issues that differentiates the local properties and projects in other more developed nations like Singapore, Hong Kong and Japan is our low occupancy rate. We actually did a survey where in Malaysia, occupancy rate on average is trending at about 30 per cent to 40 per cent. Singapore, on the other hand, is standing at an average rate of 80 per cent where it is owner-occupied, and the remaining 20 per cent is out for leasing.
“That is what a developer should expect upon completion of their projects. Given the densely -populated Kuala Lumpur, I think 30 per cent or 40 per cent occupancy rate is unjustifiable. Hence, it is a completely different ball game seen here in both countries. A good infrastructure is nonetheless integral in this sense, but there should also be more initiatives on the part of the developers,” she lamented.
‘Software’ development, as Wee opined, should be warranted more emphasis amongst property developers. This would include tie-up with services solutions provider to run corporate leasing and branding exercise to attract not only domestic customers but international investors as well.
She cited China as an example of a nation that had gone through the same path that Malaysian was heading.
“The same thing happened to China about 10 years ago when they started to boom. They can copy very well on the architectural and technological part of the business (hardware) to the point that they became very technically inclined and could not catch up with the intangible part of the deal, in the sense of value-added solutions were lacking.
“Take into example, in terms of law, what was passed here in Malaysia could be the same compared with Singapore; but why is it that the development and progress in the neighbouring nation different? This boils down to the enforcement role of the state. If we are implying enforcement into the property market per se, solutions provider in Malaysia is pretty weak,” she underscored.
Singapore, although smaller in size, possessed a comprehensive marketing real estate system that was mature and transparent, according to Wee.
“They have very good agencies that provide very good link-up. At one touch, the whole world can view the records of the market, which is what international investors are seeking for – they like transparencies. They must feel at ease with the database of the market in terms of the clarity of these database and how clean it is without going into the country.
“How reliable are these source of information and how easy can they obtain these information from the platforms are amongst aspects that will attract foreign investments. These platform areas in Malaysia need to be improved,” she underlined.
Adding to this was councillor of the Malaysian Institute of Real Estate Agents, Alex J Gomez, who stressed that developers in the country had been adopting the same approach over and over again.
“What we are seeing is that developers are continuously striving for that excellence in presentation that they do not give much importance to the buyers after they sold their products.
“Branding exercise should be pursued more firmly because people are generally cautious of uncertainties hovering within the external market. A lot of the retail outlets and even residential units are empty and take-up rate had been sluggish so to speak.
“Taking into account the situation, our government has started its move to seriously begin attracting investors abroad through Malaysia Property Incorporated (MPI). While this is a good starting point, more still needs to be done,” he said to The Borneo Post in a recent phone interview.

Source:http://www.theborneopost.com/2011/11/16/property-developers-encouraged-to-focus-on-%E2%80%98software%E2%80%99-solutions/

Get Adobe Flash playerPlugin by wpburn.com wordpress themes