An application program interface (API) provides a set of functions for application developers who build Web applications on Microsoft Corporation's .NET™ platform.

Application program interface for network software platform

Web users are shown an invalid certificate warning when their browser cannot validate the identity of the websites they are visiting. While these warnings often appear in benign situations, they can also signal a man-in-the-middle attack. We conducted a survey of over 400 Internet users to examine their reactions to and understanding of current SSL warnings. We then designed two new warnings using warnings science principles and lessons learned from the survey. We evaluated warnings used in three popular web browsers and our two warnings in a 100- participant, between-subjects laboratory study. Our warnings performed significantly better than existing warnings, but far too many participants exhibited dangerous behavior in all warning conditions. Our results suggest that, while warnings can be improved, a better approach may be to minimize the use of SSL warnings altogether by blocking users from making unsafe connections and eliminating warnings in benign situations.

/pdf/crying-wolf-an-empirical-study-of-ssl-warning-effectiveness-27u5ddrfxw.pdf

Crying wolf: an empirical study of SSL warning effectiveness

The Model/View/Controller design pattern is very useful for architecting interactive software systems. This design pattern is partition-independent, because it is expressed in terms of an interactive application running in a single address space. Applying the Model/View/Controller design pattern to web-applications is therefore complicated by the fact that current technologies encourage developers to partition the application as early as in the design phase. Subsequent changes to that partitioning require considerable changes to the application's implementation-despite the fact that the application logic has not changed. This paper introduces the concept of Flexible Web-Application Partitioning, a programming model and implementation infrastructure, that allows developers to apply the Model/View/Controller design pattern in a partition-independent manner Applications are developed and tested in a single address-space; they can then be deployed to various client/server architectures without changing the application's source code. In addition, partitioning decisions can be changed without modifying the application.

Web-application development using the Model/View/Controller design pattern

Web applications are becoming the dominant way to provide access to on-line services. At the same time, web application vulnerabilities are being discovered and disclosed at an alarming rate. Web applications often make use of JavaScript code that is embedded into web pages to support dynamic client-side behavior. This script code is executed in the context of the user's web browser. To protect the user's environment from malicious JavaScript code, a sand-boxing mechanism is used that limits a program to access only resources associated with its origin site. Unfortunately, these security mechanisms fail if a user can be lured into downloading malicious JavaScript code from an intermediate, trusted site. In this case, the malicious script is granted full access to all resources (e.g., authentication tokens and cookies) that belong to the trusted site. Such attacks are called cross-site scripting (XSS) attacks.In general, XSS attacks are easy to execute, but difficult to detect and prevent. One reason is the high flexibility of HTML encoding schemes, offering the attacker many possibilities for circumventing server-side input filters that should prevent malicious scripts from being injected into trusted sites. Also, devising a client-side solution is not easy because of the difficulty of identifying JavaScript code as being malicious. This paper presents Noxes, which is, to the best of our knowledge, the first client-side solution to mitigate cross-site scripting attacks. Noxes acts as a web proxy and uses both manual and automatically generated rules to mitigate possible cross-site scripting attempts. Noxes effectively protects against information leakage from the user's environment while requiring minimal user interaction and customization effort.

https://auto.tuwien.ac.at/~chris/research/doc/sac06_noxes.pdf

Noxes: a client-side solution for mitigating cross-site scripting attacks

"Reading this book has filled a gap in my education. I feel a sense of completion, understand that UNIX is really a style of community. Now I get it, at least I get it one level deeper than I ever did before. This book came at a perfect moment for me, a moment when I shifted from visualizing programs as things to programs as the shadows cast by communities. From this perspective, Eric makes UNIX make perfect sense." --Kent Beck, author of Extreme Programming Explained, Test Driven Development, and Contributing to Eclipse"A delightful, fascinating read, and the lessons in problem-solvng are essential to every programmer, on any OS." --Bruce Eckel, author of Thinking in Java and Thinking in C++Writing better software: 30 years of UNIX development wisdomIn this book, five years in the making, the author encapsulates three decades of unwritten, hard-won software engineering wisdom. Raymond brings together for the first time the philosophy, design patterns, tools, culture, and traditions that make UNIX home to the world's best and most innovative software, and shows how these are carried forward in Linux and today's open-source movement. Using examples from leading open-source projects, he shows UNIX and Linux programmers how to apply this wisdom in building software that's more elegant, more portable, more reusable, and longer-lived.Raymond incorporates commentary from thirteen UNIX pioneers: Ken Thompson, the inventor of UNIX. Ken Arnold, part of the group that created the 4BSD UNIX releases and co-author of The Java Programming Language. Steven M. Bellovin, co-creator of Usenet and co-author of Firewalls and Internet Security. Stuart Feldman, a member of the Bell Labs UNIX development group and the author of make and f77. Jim Gettys and Keith Packard, principal architects of the X windowing system. Steve Johnson, author of yacc and of the Portable C Compiler. Brian Kernighan, co-author of The C Programming Language, The UNIX Programming Environment, The Practice of Programming, and of the awk programming language. David Korn, creator of the korn shell and author of The New Korn Shell Command and Programming Language. Mike Lesk, a member of the Bell Labs development group and author of the ms macro package, the tbl and refer tools,lex and UUCP. Doug McIlroy, Director of the Bell Labs research group where UNIX was born and inventor of the UNIX pipe. Marshall Kirk McKusick, developer of the 4.2BSD fast filesystem and a leader of the 4.3BSD and 4.4BSD teams. Henry Spencer, a leader among early UNIX developers, who created getopt, the first open-source string library, and a regular-expression engine used in 4.4BSD.

/pdf/the-art-of-unix-programming-40keaiz8l1.pdf

The Art of Unix Programming

This Fifth Edition is completely revised and expanded to cover JavaScript as it is used in today's Web 2.0 applications. This book is both an example-driven programmer's guide and a keep-on-your-desk reference, with new chapters that explain everything you need to know to get the most out of JavaScript, including:Scripted HTTP and AjaxXML processingClient-side graphics using the canvas tagNamespaces in JavaScript--essential when writing complex programsClasses, closures, persistence, Flash, and JavaScript embedded in Java applicationsPart I explains the core JavaScript language in detail. If you are new to JavaScript, it will teach you the language. If you are already a JavaScript programmer, Part I will sharpen your skills and deepen your understanding of the language.Part II explains the scripting environment provided by web browsers, with a focus on DOM scripting with unobtrusive JavaScript. The broad and deep coverage of client-side JavaScript is illustrated with many sophisticated examples that demonstrate how to:Generate a table of contents for an HTML documentDisplay DHTML animationsAutomate form validationDraw dynamic pie chartsMake HTML elements draggableDefine keyboard shortcuts for web applicationsCreate Ajax-enabled tool tipsUse XPath and XSLT on XML documents loaded with AjaxAnd much morePart III is a complete reference for core JavaScript. It documents every class, object, constructor, method, function, property, and constant defined by JavaScript 1.5 and ECMAScript Version 3.Part IV is a reference for client-side JavaScript, covering legacy web browser APIs, the standard Level 2 DOM API, and emerging standards such as the XMLHttpRequest object and the canvas tag.More than 300,000 JavaScript programmers around the world have made this their indispensable reference book for building JavaScript applications."A must-have reference for expert JavaScript programmers...well-organized and detailed." -- Brendan Eich, creator of JavaScript

JavaScript: The Definitive Guide

From the Publisher:
This bestselling book is an essential quick reference for all Java programmers. It contains an accelerated introduction to the Java language and its key APIs, so seasoned programmers can start writing Java code right away. The third edition of Java in a Nutshell covers Java 1.2 and Java 1.3 beta and includes: 
A description of the syntax of the Java language, written in a tight, concise style, that can serve as both a fast-paced tutorial and a language reference. An explanation of the object-oriented features of Java that does not assume any prior object-oriented programming experience. An overview of the essential Java APIs that shows how to perform common tasks, such as string manipulation, input/output, and thread handling, with the classes and interfaces that comprise the Java 2 platform. Documentation for the Java development tools shipped with Sun's Java SDK.

This book also includes O'Reilly's classic-style, quick-reference material for all of the classes in the essential Java packages, including java.lang, java.io, java.beans java.math, java.net, java.security, java.text, java.util, and javax.crypto. This reference material covers all of the new classes in Java 1.2 and 1.3. Once you've learned Java, you'll keep this book next to your keyboard for handy reference while you program. 
This book is part of the two-volume set of quick references that every Java programmer needs. It is an essential companion to Java Foundation Classes in a Nutshell, which covers the graphics and graphical user interface APIs in the Java 2 platform, including Swing, AWT, and Java 2D. A third volume, Java Enterprise in a Nutshell, focuses on the Java Enterprise APIs and is of interest to programmers working on server-side or enterprise Java applications.

JAVA in a Nutshell - A Desktop Quick Reference

From the Publisher:
Java Foundation Classes in a Nutshell is a quick reference for Java programmers who are writing applications that use graphics or graphical user interfaces. The author has written introductions to the Java APIs that comprise the Java Foundation Classes (JFC), so you can start using these new technologies right away. This book contains an overview of the architecture of graphical user interfaces built with both the new Swing API and the older AWT; an introduction to the important components and application services provided by the Swing API; and a comprehensive explanation of the features of the new Java 2D API.

Java foundation classes in a nutshell

From the Publisher:
JavaScript is a powerful, object-based scripting language that can be embedded directly in HTML pages. It allows you to create dynamic, interactive Web-based applications that run completely within a Web browser  JavaScript is the language of choice for developing Dynamic HTML (DHTML) content. JavaScript can be integrated effectively with CGI and Java to produce sophisticated Web applications, although, in many cases, JavaScript eliminates the need for complex CGI scripts and Java applets altogether. 
The JavaScript Pocket Reference is a companion volume to JavaScript: The Definitive Guide, 3rd Edition. This small book, covering JavaScript 1.2, is a handy reference guide to this popular language for Web development. It provides a complete overview of the core JavaScript language and contains summaries of both core and client-side objects, methods, and properties.

Paula Ferguson

Papers

JavaScript: The Definitive Guide

JAVA in a Nutshell - A Desktop Quick Reference

Java foundation classes in a nutshell

JavaScript Pocket Reference