links for 2008-06-20

Flickr: Smithsonian Institution’s Photostream
Good mine of photos for Wikipedia articles among others.
(tags: photo flickr wikiresearch smithsonian)

Who are the “Media Bloggers Association” and what gives them to right to negotiate copyright with the Associated Press? - Boing Boing
Triangulating the “Media Bloggers Association.”
(tags: copyright mediabloggersassociation fraudulentmisrepresentation)

XPath Injection (0×000000 # The Hacker Webzine)
A proposal for detecting XPath injection [...]

Resources for application security education

As I’ve been getting myself up to speed in learning about application security, a few resources have been extremely helpful.
A good general background on application security issues, unsurprisingly, is contained in The Art of Software Security Testing, co-authored by Veracode cofounder Chris Wysopal. The book goes beyond the basic description of classes of application security [...]

Serious new Mac OS X escalation of privilege vulnerability

Slashdot is reporting a new escalation of privilege vulnerability in Mac OS X 10.4 and 10.5. The details are a little sparse, but it appears that calling the Apple Remote Desktop Agent (ARDAgent) from AppleScript allows execution of arbitrary code with root privilege. Bad, for sure.
The mitigation is that it requires execution as the currently [...]