Kirk Jackson's Page of Words - Xero http://pageofwords.com/blog/ Run the ink across this page of words en-us Kirk Jackson Wed, 09 Mar 2011 08:09:04 GMT newtelligence dasBlog 1.9.6264.0 kirkj@paradise.net.nz kirkj@paradise.net.nz http://pageofwords.com/blog/Trackback.aspx?guid=81025a86-8442-4a79-97f7-b25ddef3c72e http://pageofwords.com/blog/pingback.aspx http://pageofwords.com/blog/PermaLink,guid,81025a86-8442-4a79-97f7-b25ddef3c72e.aspx Kirk Jackson http://pageofwords.com/blog/CommentView,guid,81025a86-8442-4a79-97f7-b25ddef3c72e.aspx http://pageofwords.com/blog/SyndicationService.asmx/GetEntryCommentsRss?guid=81025a86-8442-4a79-97f7-b25ddef3c72e 1 Last month I started in a new role at Aura Software Security, where I am a security consultant. I'm excited about all the fun stuff I'll be doing, getting involved with security advice, training and testing at all stages of the development lifecycle.

However, starting a new job means leaving another, and I'm sad to leave Xero. It has been a blast working at Xero, and I have made some great friends, had a lot of laughs, and been a part of building something pretty special.

In terms of this blog, I predict that nothing much will change -- I will continue to post infrequently, usually triggered by a promise to post some event slides or other online. If you're subscribed, you've probably noticed that most of my posts tend to be around web security, and I doubt that will change!

Kirk

New job http://pageofwords.com/blog/PermaLink,guid,81025a86-8442-4a79-97f7-b25ddef3c72e.aspx http://pageofwords.com/blog/2011/03/09/NewJob.aspx Wed, 09 Mar 2011 08:09:04 GMT Last month I started in a new role at <a href="http://www.aurasoftwaresecurity.co.nz">Aura Software Security</a>, where I am a security consultant. I'm excited about all the fun stuff I'll be doing, getting involved with security advice, training and testing at all stages of the development lifecycle.<br> <br> However, starting a new job means leaving another, and I'm sad to leave <a href="http://www.xero.com">Xero</a>. It has been a blast working at Xero, and I have made some great friends, had a lot of laughs, and been a part of building something pretty special.<br> <br> In terms of this blog, I predict that nothing much will change -- I will continue to post infrequently, usually triggered by a promise to post some event slides or other online. If you're subscribed, you've probably noticed that most of my posts tend to be around web security, and I doubt that will change!<br> <br> Kirk<br> <p> </p> <img width="0" height="0" src="http://pageofwords.com/blog/aggbug.ashx?id=81025a86-8442-4a79-97f7-b25ddef3c72e" /> http://pageofwords.com/blog/CommentView,guid,81025a86-8442-4a79-97f7-b25ddef3c72e.aspx Xero;Aura http://pageofwords.com/blog/Trackback.aspx?guid=47180a1e-aa67-416a-9e0e-ab0b0584c010 http://pageofwords.com/blog/pingback.aspx http://pageofwords.com/blog/PermaLink,guid,47180a1e-aa67-416a-9e0e-ab0b0584c010.aspx Kirk Jackson http://pageofwords.com/blog/CommentView,guid,47180a1e-aa67-416a-9e0e-ab0b0584c010.aspx http://pageofwords.com/blog/SyndicationService.asmx/GetEntryCommentsRss?guid=47180a1e-aa67-416a-9e0e-ab0b0584c010

Thanks to those user group members and Xero partners that came along to our talk today.

We covered the two vulnerabilities released last week, the workarounds, and the patches that were released this morning.

Here are the slides: KirkJackson-PaddingOracle.pdf (641.14 KB)

All ASP.NET applications are affected. The best thing to do is install the patches released this morning.


Problem & bulletins:

Security bulletin MS10-070

Useful info on ScottGu's blog

Forum about the security vulnerability

Video of a site exploit, even with the workarounds applied

Patch:

Scott Gu's writeup of the patch

Post-mortem of the patch - Marc Brooks

How to configure the new patched features

Research:

Juliano Rizzo and Thai Duong and their POET tool

Padbuster tool (including a great writeup of Padding Oracles)

ASP.NET Vulnerability - Slides http://pageofwords.com/blog/PermaLink,guid,47180a1e-aa67-416a-9e0e-ab0b0584c010.aspx http://pageofwords.com/blog/2010/09/29/ASPNETVulnerabilitySlides.aspx Wed, 29 Sep 2010 08:25:39 GMT <p> Thanks to those user group members and Xero partners that came along to our talk today. </p> <p> We covered the two vulnerabilities released last week, the workarounds, and the patches that were released this morning. </p> <p> Here are the slides: <a href="http://pageofwords.com/blog/content/binary/KirkJackson-PaddingOracle.pdf">KirkJackson-PaddingOracle.pdf (641.14 KB)</a> </p> <p> All ASP.NET applications are affected. The best thing to do is <a href="http://blogs.technet.com/b/msrc/archive/2010/09/28/ms10-070-released-out-of-band-today.aspx">install the patches released this morning</a>. </p> <p> <b> <br> </b> </p> <p> <b>Problem &amp; bulletins:</b> </p> <p> <a href="http://www.microsoft.com/technet/security/bulletin/ms10-070.mspx">Security bulletin MS10-070</a> </p> <p> <a href="http://weblogs.asp.net/scottgu/archive/tags/Security/default.aspx"> Useful info on ScottGu's blog<br> </a> </p> <p> <a href="http://forums.asp.net/1233.aspx">Forum about the security vulnerability</a> </p> <p> <a href="http://www.youtube.com/watch?v=mP6mKLh1FBw">Video of a site exploit</a>, even with the workarounds applied </p> <p> <b> Patch: </b> </p> <p> <a href="http://weblogs.asp.net/scottgu/archive/2010/09/28/asp-net-security-update-now-available.aspx">Scott Gu's writeup of the patch</a> </p> <p> <a href="http://musingmarc.blogspot.com/2010/09/ms10-070-post-mortem-analysis-of-patch.html">Post-mortem of the patch - Marc Brooks</a> </p> <p> How to <a href="http://support.microsoft.com/kb/2425938"> configure the new patched features</a> </p> <p> <b>Research:</b> </p> <p> <a href="http://twitter.com/julianor">Juliano Rizzo</a> and <a href="http://twitter.com/thaidn">Thai Duong</a> and their <a href="http://netifera.com/research/">POET tool</a> </p> <p> <a href="http://www.gdssecurity.com/l/b/2010/09/28/new-version-of-padbuster-available-for-download/"> Padbuster tool</a> (including a <a href="http://www.gdssecurity.com/l/b/2010/09/14/automated-padding-oracle-attacks-with-padbuster/">great writeup of Padding Oracles)</a> </p> <img width="0" height="0" src="http://pageofwords.com/blog/aggbug.ashx?id=47180a1e-aa67-416a-9e0e-ab0b0584c010" /> http://pageofwords.com/blog/CommentView,guid,47180a1e-aa67-416a-9e0e-ab0b0584c010.aspx .NET;Security;Xero http://pageofwords.com/blog/Trackback.aspx?guid=86106136-9dc9-4c55-9183-5b374de89804 http://pageofwords.com/blog/pingback.aspx http://pageofwords.com/blog/PermaLink,guid,86106136-9dc9-4c55-9183-5b374de89804.aspx Kirk Jackson http://pageofwords.com/blog/CommentView,guid,86106136-9dc9-4c55-9183-5b374de89804.aspx http://pageofwords.com/blog/SyndicationService.asmx/GetEntryCommentsRss?guid=86106136-9dc9-4c55-9183-5b374de89804 1

While it's not always like this...

... it's true that Rod does zoom around the office (although not always on the Segway).

[Rod on the Telecom Business Hub]

Kirk

A day in the Xero office http://pageofwords.com/blog/PermaLink,guid,86106136-9dc9-4c55-9183-5b374de89804.aspx http://pageofwords.com/blog/2009/05/20/ADayInTheXeroOffice.aspx Wed, 20 May 2009 11:53:38 GMT <p> While it's not always like this... </p> <p> <object width="560" height="340"> <param name="movie" value="http://www.youtube.com/v/hHwHPJHzL4I&amp;hl=en&amp;fs=1">> <param name="allowFullScreen" value="true">> <param name="allowscriptaccess" value="always">><embed src="http://www.youtube.com/v/hHwHPJHzL4I&amp;hl=en&amp;fs=1" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="560" height="340"></embed> </object> </p> <p> ... it's true that Rod <i>does</i> zoom around the office (although not always on the Segway). </p> <p> [<a href="http://www.hubcommunity.co.nz/videos/rod-drury-xero-2">Rod on the Telecom Business Hub</a>] </p> <p> Kirk </p> <img width="0" height="0" src="http://pageofwords.com/blog/aggbug.ashx?id=86106136-9dc9-4c55-9183-5b374de89804" /> http://pageofwords.com/blog/CommentView,guid,86106136-9dc9-4c55-9183-5b374de89804.aspx Xero http://pageofwords.com/blog/Trackback.aspx?guid=88651653-2703-4e89-a0af-af343914fcce http://pageofwords.com/blog/pingback.aspx http://pageofwords.com/blog/PermaLink,guid,88651653-2703-4e89-a0af-af343914fcce.aspx Kirk Jackson http://pageofwords.com/blog/CommentView,guid,88651653-2703-4e89-a0af-af343914fcce.aspx http://pageofwords.com/blog/SyndicationService.asmx/GetEntryCommentsRss?guid=88651653-2703-4e89-a0af-af343914fcce 4

I've just been awarded Cobol Developer of the year for 2009!

It has been a great ride at Xero, from releasing our first beta little more than 2 years ago, to racking up our 6000th customer this week.

Some people doubted us for picking a VSE/ESA environment and the IBM compiler, but the support for 31 bit addressing and dynamic calls really accelerated our development of a Web 2.0 software product.

I'd like to thank all the other forward thinking members of our team for choosing and building on a great platform, and encouraging me to achieve this award.

Kirk

Wow! I won! http://pageofwords.com/blog/PermaLink,guid,88651653-2703-4e89-a0af-af343914fcce.aspx http://pageofwords.com/blog/2009/03/31/WowIWon.aspx Tue, 31 Mar 2009 22:49:07 GMT <p> I've just been awarded Cobol Developer of the year for 2009! </p> <p> It has been a great ride at <a href="http://www.xero.com">Xero</a>, from releasing our first beta little more than 2 years ago, to racking up our <a href="http://blog.xero.com/2009/03/the-hockey-stick/">6000th customer</a> this week. </p> <p> Some people doubted us for picking a <a href="http://www-01.ibm.com/software/awdtools/cobol/vse/">VSE/ESA</a> environment and the IBM compiler, but the support for 31 bit addressing and dynamic calls really accelerated our development of a Web 2.0 software product. </p> <p> I'd like to thank all the other forward thinking members of our team for choosing and building on a great platform, and encouraging me to achieve this award. </p> <p> Kirk </p> <img width="0" height="0" src="http://pageofwords.com/blog/aggbug.ashx?id=88651653-2703-4e89-a0af-af343914fcce" /> http://pageofwords.com/blog/CommentView,guid,88651653-2703-4e89-a0af-af343914fcce.aspx Personal;Xero http://pageofwords.com/blog/Trackback.aspx?guid=927d180f-47bf-4bdd-ae06-3ab808ccfeac http://pageofwords.com/blog/pingback.aspx http://pageofwords.com/blog/PermaLink,guid,927d180f-47bf-4bdd-ae06-3ab808ccfeac.aspx Kirk Jackson http://pageofwords.com/blog/CommentView,guid,927d180f-47bf-4bdd-ae06-3ab808ccfeac.aspx http://pageofwords.com/blog/SyndicationService.asmx/GetEntryCommentsRss?guid=927d180f-47bf-4bdd-ae06-3ab808ccfeac

We've gone offline for an upgrade, and put a webcam in the office so you can see us work:

image

A little bit of fun with Craig acting for the camera :)

Kirk

Xero office webcam http://pageofwords.com/blog/PermaLink,guid,927d180f-47bf-4bdd-ae06-3ab808ccfeac.aspx http://pageofwords.com/blog/2008/11/08/XeroOfficeWebcam.aspx Sat, 08 Nov 2008 11:08:32 GMT <p> We've gone offline for an upgrade, and put a webcam in the office so you can see us work: </p> <p> <a href="https://go.xero.com"><img style="border-right: 0px; border-top: 0px; border-left: 0px; border-bottom: 0px" height="333" alt="image" src="http://pageofwords.com/blog/content/binary/WindowsLiveWriter/Xeroofficewebcam_207/image_3.png" width="520" border="0" /></a> </p> <p> A little bit of fun with Craig acting for the camera :) </p> <p> Kirk </p> <img width="0" height="0" src="http://pageofwords.com/blog/aggbug.ashx?id=927d180f-47bf-4bdd-ae06-3ab808ccfeac" /> http://pageofwords.com/blog/CommentView,guid,927d180f-47bf-4bdd-ae06-3ab808ccfeac.aspx Xero http://pageofwords.com/blog/Trackback.aspx?guid=1c21aa5c-ff9c-479e-bf43-e7783f56aed7 http://pageofwords.com/blog/pingback.aspx http://pageofwords.com/blog/PermaLink,guid,1c21aa5c-ff9c-479e-bf43-e7783f56aed7.aspx Kirk Jackson http://pageofwords.com/blog/CommentView,guid,1c21aa5c-ff9c-479e-bf43-e7783f56aed7.aspx http://pageofwords.com/blog/SyndicationService.asmx/GetEntryCommentsRss?guid=1c21aa5c-ff9c-479e-bf43-e7783f56aed7 Wow, I'm so proud that we've been selected as one of the top 10 Application UIs by the esteemed Nielson Norman Group in their latest report.

I haven't read the report yet, but we got a good writeup in the Alertbox article:
But Xero might be a more interesting example, simply because it targets the traditionally dry domain of accounting. One of its main features lets users automatically reconcile bookkeeping entries with bank account transactions. As a match is made, the 2 matching entries are removed from the list of stuff to be reconciled. Users compared this interaction to playing Tetris and described it as fun and addictive. Come on, making accounting fun? That's an award-winning design.
I'm not responsible for our look, or even for implementing it in code, but I'm very proud to do the behind-the-scenes work on Xero helping to wire it together. It's great that our application is being recognised as having a great user interface... well done to our design team for corralling everyone's ideas together into something that is fun for our users.

Kirk

Xero in top 10 Apps - Nielson Norman Group http://pageofwords.com/blog/PermaLink,guid,1c21aa5c-ff9c-479e-bf43-e7783f56aed7.aspx http://pageofwords.com/blog/2008/08/12/XeroInTop10AppsNielsonNormanGroup.aspx Tue, 12 Aug 2008 10:14:45 GMT Wow, I'm so proud that <a href="http://www.xero.com">we've</a> been selected as one of the <a href="http://www.useit.com/alertbox/application-design.html">top 10 Application UIs</a> by the esteemed Nielson Norman Group in their <a href="http://www.nngroup.com/reports/applications/design/">latest report</a>.<br> <br> I haven't read the report yet, but we got a good writeup in the <a href="http://www.useit.com/alertbox/application-design.html">Alertbox article</a>:<i> <br> </i><blockquote><i>But Xero might be a more interesting example, simply because it targets the traditionally dry domain of accounting. One of its main features lets users automatically reconcile bookkeeping entries with bank account transactions. As a match is made, the 2 matching entries are removed from the list of stuff to be reconciled. Users compared this interaction to playing Tetris and described it as fun and addictive. Come on, making accounting fun? <em>That's</em> an award-winning design. </i></blockquote>I'm not responsible for our look, or even for implementing it in code, but I'm very proud to do the behind-the-scenes work on Xero helping to wire it together. It's great that our application is being recognised as having a great user interface... well done to our design team for corralling everyone's ideas together into something that is fun for our users.<br> <br> Kirk<br> <br> <p> </p> <img width="0" height="0" src="http://pageofwords.com/blog/aggbug.ashx?id=1c21aa5c-ff9c-479e-bf43-e7783f56aed7" /> http://pageofwords.com/blog/CommentView,guid,1c21aa5c-ff9c-479e-bf43-e7783f56aed7.aspx Xero