pgmarket=en-ca&page=byoa/prem&xAPID=1994&DI=1034&SU=http://hotmail.com/enca&HL=Market_MSNIS_Taglines "Maris Apse" Visit http://www.ofo.ca/ontbirdsguide.htm for information on leaving and joining the list. As well as general information and content guidelines.

LORAN-C is approved as an en route supplemental air navigation system for both Instrument Flight Rule (IFR) and Visual Flight Rule (VFR) operations. The LORAN-C system serves the 48 continental states, their coastal areas, and parts of Alaska.

(COA) > for the discussion of birds and birding in Connecticut. > For subscription information visit > http://lists.ctbirding.org/mailman/listinfo/ctbirds_lists.ctbirding.org

. > For subscription information visit http://lists.ctbirding.org/mailman/listinfo/ctbirds_lists.ctbirding.org _________________________________________________________________ Get your vacation photos on your phone! http://windowsliveformobile.com/en-us/photos/default.aspx?&OCID=0809TL-HM

Surf the web up to FIVE TIMES FASTER! Only $14.95/ month - visit www.juno.com to sign up today! Alan Wormington Visit http://www.ofo.ca/ontbirdsguide.htm for information on leaving and joining the list. As well as general information and content guidelines.

I developed the original format of the web site (including the little bit of Javascript) on a local Linux box a number of moons ago and transfered it to a commercial ISP that shall remain nameless. At the time, that was working (maybe the only thing that was working with that ISP...)

be relatively straightforward to extend this into an authorisation interface too. I don't know your code or approach, so I'm going to assume it is object oriented and then will just punt ideas out randomly ;) The way I would approach would be to: - If your code doesn't already support the concept of abstract user groups, then implement it (associate with an LDAP group, allowing centralised management). - Create a grid of methods that require authorisation, then associate these with the user groups. - Create a function that checks for membership of the group, then call this prior to allowing any sensitive methods to run. A couple of observations for the LDAP auth: - If you're not already doing your LDAP lookups over SSL, then add this in (otherwise the first time that someone like me looks at it we'll just start whining. ;) - When you do your LDAP auth check, use a named user with minimal privileges and disable anonymous binds on the LDAP server. - Then you test the LDAP auth, first check for the existence of the user, then attempt a bind as the user. That way you know whether the user actually exists or the password is wrong (then you can log the correct condition, though should give the user a generic "something was wrong with your credentials" message). Oh, then take the money you would have spent on an F5 and buy Jager bombs for everyone and don't come in tomorrow. You could invite me too. ;) Martin... ---------------------------------------------------------------------- CONFIDENTIALITY: This e-mail and any files transmitted with it are confidential and intended solely for the use of the recipient(s) only. Any review, retransmission, dissemination or other use of, or taking any action in reliance upon this information by persons or entities other than the intended recipient(s) is prohibited. If you have received this e-mail in error please notify the sender immediately and destroy the material whether stored on a computer or otherwise. ---------------------------------------------------------------------- DISCLAIMER: Any views or opinions presented within this e-mail are solely those of the author and do not necessarily represent those of Corsaire Limited, unless otherwise specifically stated. ---------------------------------------------------------------------- Corsaire Limited, head office: Unit 2 Grosvenor Court, Hipley Street, Old Woking, Surrey GU22 9LL. Telephone: +44 (0)1483-746700. Registered in England No. 3338312. Registered office: Portland House, Park Street, Bagshot, Surrey GU19 5PG.

lemented on the server side and doesn't depend on the options presented in the UI. If that security control fails then you have a serious security vulnerability, whether or not the options are presented to the user. Not presenting the options adds a layer of "security through obscurity" which is no security at all, so no real point implementing it. > My other concern is the inability to differentiate between malicious attempts to escalate privileges, or a user > attempting unauthorised actions by mistake or simply because the option is presented to them. This seems to be > the only tangible security concern. This depends on how the unauthorised actions are presented in the UI. They should not be selectable in the UI, e.g. Buttons should be disabled, which would mean that an attacker would have to deliberately modify the HTML or intercept and modify the request in order to provoke the action. In my opinion, having UI elements that are selectable, but then deny access to the function is just bad UI design. regards, Stephen

Nena Schvaneveldt, MSLIS, AHIP [speaker] <https://urlwatch.com/urlwatch?

I wonder if one could do some sort of hack by making multiple shared libraries of PJSIP and loading it multiple times into an app? Would the globals be segregated in their own area via the shared library?