Marty Hermsen

Talks around the ICT and Financial Coffee Corners

Secure your profile...

August 15
by Marty Hermsen 15. August 2009 00:29

Share or Bookmark this post…
  • LinkedIn
  • Google
  • Facebook
  • NuJIJ
  • MySpace
  • del.icio.us
  • Technorati
  • Digg
  • DotNetKicks
  • Yahoo! Buzz
  • Yigg
  • E-Mail

Tags:

Media Services | Music and Video | Private | Security

Flash Trading - the Thirty Milliseconds Advantage

August 03
by Marty Hermsen 3. August 2009 10:01

More info here

Share or Bookmark this post…
  • LinkedIn
  • Google
  • Facebook
  • NuJIJ
  • MySpace
  • del.icio.us
  • Technorati
  • Digg
  • DotNetKicks
  • Yahoo! Buzz
  • Yigg
  • E-Mail

Tags:

Financial News | FIX Protocol | Security | High Frequency Trading HFT

Detecting Browsers, Crawlers, and Web Bots in C# ASP .NET

August 02
by Marty Hermsen 2. August 2009 17:52

The .NET framework, used to create C# ASP .NET web applications, actually comes with a built-in web browser detector, called the BrowserCaps feature. .NET 2.0 adds an additional detector, called the .Browser feature. Regardless of the .NET version, determining the difference between a user's web browser and an automated web crawler can make a big difference in a web application, and it's easy to do.

In this article, we'll discuss three methods for determining the web browser type. We'll also describe how to tell the difference between a user's web browser and an automated crawler.

What's Inside the User-Agent String

It really all starts with the web browser user-agent string. The user-agent is a string of text, sent in the HTTP header by the web browser, for each request made when accessing a page in the C# ASP .NET web application. The user-agent typically describes the web browser client type, name, version, and other information.

Some example User-Agent strings:

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727)
Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Mozilla/5.0 (compatible; Yahoo! Slurp; +http://help.yahoo.com/help/us/ysearch/slurp)

As you can tell from the above examples, quite a bit of information can be parsed out of the user-agent string. We can tell that the first user-agent is a Microsoft Internet Explorer web browser, and thus a regular user. The other two user-agents are web bots. By looking at the details of the user-agent string, you can probably determine the most direct method of detecting the user's web browser is by simply looking for sub-strings.

Looking for Keywords in a User-Agent

The most direct and simple method for detecting web browsers accessing your C# ASP .NET web application is to simply search for a sub-string within the user-agent and classify the web browser accordingly.

if (Request.UserAgent.ToString().IndexOf("Googlebot") > -1)
{
   // We have a GoogleBot web crawler.
}
else
{
   // We do not have a GoogleBot web crawler.
}

By parsing a simple sub-string from the UserAgent property of the HttpRequest, we can determine the type of web client accessing the site. While this method is simple and direct, it suffers from the problem of being unable to classify the many different types of user-agent strings out there. You could certainly obtain a list of user-agent strings and add keywords to parse for each, but this could take a long time. It would also be difficult to maintain the list and keep it updated as new web bots and browsers emerge. There must be an easier way and this is exactly where Microsoft is one step ahead.

Digging Deeper Into Request.Browser

In the above code sample, we pulled the user-agent string from the HttpRequest object. Rather than parse a sub-string from the Request.UserAgent property, the Request object provides us with an additional object for accessing information about the web browser client via Request.Browser. One of the properties of interest for telling the difference between a user and a web bot is Request.Browser.Crawler. This property is a boolean and will indicate true if the web browser is actually a web bot.

if (Request.Browser.Crawler)
{
   // We have a web crawler.
}
else
{
   // We do not have a web crawler.
}

Request.Browser.Crawler Always Returns False

If you try using the above code sample and testing using various user-agent strings to simulate web bots (ie. with the Firefox User-Agent Switcher plug-in), you'll notice that Request.Browser.Crawler always returns false. This is due to missing information in one of .NET's configuration sections, called BrowserCaps. We'll need to populate the list of BrowserCaps (the list of available user-agents that we have information about) in order to use this feature.

Using the BrowserCaps To Detect Web Browsers From Web Bots

BrowserCaps is a section in the web.config file, within the system.web section. BrowserCaps allows you to specify a list of web browser user-agent strings, via regular expressions, to match against. Each item in the list indicates the capabilities of the web browser, version, whether it's a crawler, and much more.

Inside the web.config (or machine.config) file:

<configuration>
<system.web>
<browserCaps>
   <result type="class"/>
   <use var="HTTP_USER_AGENT"/>
        browser=Unknown
        version=0.0
        majorver=0
        minorver=0
        frames=false
        tables=false
      <filter>
         <case match="Windows 98|Win98">
            platform=Win98
         </case>
      <case match="Windows NT|WinNT">
         platform=WinNT
      </case>
   </filter>
   <filter match="Unknown" with="%(browser)">
      <filter match="Win95" with="%(platform)">
      </filter>
   </filter>
</browserCaps>
</system.web>
</configuration>

The above is a sample entry for detecting Windows 98 and Windows NT operating systems in the user-agent string from the web browser. While you can proceed to add entries by hand to match each web browser and crawler of interest, you can actually download a complete and updated list of user-agent BrowserCaps to add to your C# ASP .NET web application.

To add the list of BrowserCaps to your development machine or server, follow these steps:

1. Open the following file for editing:
C:\windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config

2. Download the BrowserCaps list from http://owenbrady.net/browsercaps (direct download list).

3. Paste the entire contents of the XML file into the machine.config, just before the line </system.web>.

If you only want the BrowserCaps list available to a single web application, paste the BrowserCaps section into your local web.config. If you want all web applications to have access to the information, use the machine.config as noted above.

After saving the changes and refreshing the C# ASP .NET web application, you will now have proper values displaying for Request.Browser.Crawler. The regularly updated list helps you detect the majority of web crawlers, bots, scripts, and web browsers.

Using the Newer .BROWSER

BrowserCaps was introduced in the .NET 1.0 Framework. While it is still active and supported by Microsoft, it has been deprecated with .NET 2.0. The current standard is to use the .BROWSER feature to indicate the list of user-agent strings. It's important to note that entries specified in the .BROWSER feature are merged with the contents of the BrowserCaps, so that both methods may be used.

.BROWSER provides a way of specifying the web browser user-agents via XML in separate files in C:\windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\Browsers. After creating a .browser file, you can execute aspnet_regsql.exe to build the browser files into the global assembly, giving access to the list to all web applications. This allows you to add new entries to the list without restarting the web application process. The actual command line to use is: C:\WINDOWS\Microsoft.NET\Framework\<versionNumber>\aspnet_regsql.exe -i

The .browser feature provides a more seamless way of incorporating web browser detection into an ASP .NET application. However, at this time, a greater number of entries are available for the BrowserCaps method, which provides a more accurate detection method of web bots in the wild. Since both methods can be used together, there is no harm in combining them.

Perfecting Traffic Statistics with Web Bot Detection

One of the primary reasons to determine a web bot from a regular user's web browser is to allow for accurate recording of statistics. For example, when counting the hits to a particular page in an ASP .NET web application, the numbers would become skewed if you included hits from GoogleBot, Yahoo Slurp, and the many other web bots. By using the Request.Browser.Crawler value, we can easily detect a web bot from a user and provide a more accurate figure.

Cloaking Isn't Just in Star Trek

The discussion about web bot detection in C# ASP .NET web applications wouldn't be complete without briefly cautioning against displaying different content to web bots and regular user web browsers, also called cloaking. More specifically, cloaking is when your web application detects a web bot and shows a different page or content, with the goal of affecting search engine ranking. It's generally a rule of thumb to display the same content to web bots as you would to normal users and only use the web bot detection methods shown above for traffic statistical means or other behind-the-scenes activities.

Conclusion

The .NET Framework provides two powerful features for detecting the web browser client and determining web spiders from users' web browsers. .NET 1.0 provides the BrowserCaps feature, which can be updated regularly with new user-agent strings as they become available. .NET 2.0 provides the .BROWSER feature, in addition to the BrowserCaps feature, for incorporating new user-agent matches more seamlessly in web applications. By using web browser and web bot detection responsibly, you can help enhance web application traffic statistics and features, creating a more powerful and resiliant C# ASP .NET web application.

Share or Bookmark this post…
  • LinkedIn
  • Google
  • Facebook
  • NuJIJ
  • MySpace
  • del.icio.us
  • Technorati
  • Digg
  • DotNetKicks
  • Yahoo! Buzz
  • Yigg
  • E-Mail

Tags: ,

BlogEngine.NET | DotNetNuke | Security | Web IIS 6 - IIS 7

BlogEngine.NET provisioning for Linkedin.com and Twitter.com

July 19
by Marty Hermsen 19. July 2009 18:47

For some time now I was thinking about a RSS feeds with FIX related news in the FIX Protocol group on LinkedIn

In the search to RSS Feeds about the FIX Protocol I didn't find any feed about the FIX Protocol, not even on the official FIX Protocol website ! or Google reader...

So I decided to use the new BlogEngine.NET blog for adding a RSS Feeds to the FIX group.  Simple add news on my blog in the category FIX protocol and the feed provisioning is there...

LinkedIn will each two hour come back for updates in the feed...

BlogEngine makes life easier with all widgets born by developers...and still open source...

It's now also possible with Blogengine.NET to integrate published blogs articles within Twitter...and tweets

Why not click on the green tweet button ! try it out..

 

Connecting the world together in a Single Sign On Enterprise environment !!!  Who thinks about !

Share or Bookmark this post…
  • LinkedIn
  • Google
  • Facebook
  • NuJIJ
  • MySpace
  • del.icio.us
  • Technorati
  • Digg
  • DotNetKicks
  • Yahoo! Buzz
  • Yigg
  • E-Mail

Tags: , ,

BlogEngine.NET | FIX Protocol | Security

BlogEngine Comment Poster is stopped by update

July 19
by Marty Hermsen 19. July 2009 12:53

Sorry SEORebel, your spam tool is stopped by a simple update....

How this SPAM tool works you can see in the video below

How to stop this SPAM tool click here

What is BlogEngine?
BlogEngine is a Microsoft .Net based blogging system used by a large number of people and companies all over the world. The blog system is very vulnerable to link spam.!

What is BlogEngine Comment Poster?
BlogEngine Comment Poster is a program that automatically posts comments to blog posts on BlogEngine blogs, these comments can contain your link, and give you link-juice to boost your sites in Google, Yahoo and Bing.

How many blog posts are there to post my link on?
According to Google there are currently 77.800 blog posts indexed:

Are these do-follow links?
Around 75% of the blogs are do-follow, meaning that the search engines will recognize these links as valid and counting. (click here to solve)

Do I have to wait for my links to get approved?
Around 50% of the blogs will have your link on instantly! The rest are moderated. The program will automatically check to see if your link is live after posting a comment, and you have the option to save all blog posts with links on to a text file. That gives the possiblity to ping these blog posts, so the search engine will find your links faster.

What success rate can I expect?
Around 40% of your attempted comment posts, should convert into live do-follow links.

What about captchas?
BlogEngine uses a .net hidden-field based captcha system. We've used webbrowser based posting to bypass this, making it appear as human as possible.

What are the requirements for running this program?
Windows and Microsoft .net 3.5

What is the comment posting speed?
The posting speed can be defined in settings. Expect 2-4 posts per minute, including the time it takes to verify if your link is live.

How do I find the blog posts?
You can do a simple google search for:

+"Notify me when new comments are added" +"Powered by blogengine"

Do I get some blog posts together with the program?
Yes, to get your started we've made a text-file with 950 blog posts all with with Pagerank 2-5!
To make sure that this doesn't get too saturated, we encourage people to create their own collections of blog posts. Use your favorite Search Engine Scraper. Download data-files - The blog posts are in the blogtargets.txt file.

Share or Bookmark this post…
  • LinkedIn
  • Google
  • Facebook
  • NuJIJ
  • MySpace
  • del.icio.us
  • Technorati
  • Digg
  • DotNetKicks
  • Yahoo! Buzz
  • Yigg
  • E-Mail

Tags: ,

BlogEngine.NET | Security

How to install Perl on Windows 2008 / IIS 7 with FastCGI

July 07
by Marty Hermsen 7. July 2009 23:53

Just like other extensions ....

There we go...(official you don't have to install Perl for running Perl on your PC or server!, see below)

First download the latest Perl download Win file

Ola, Perl is only available for 32 bits !  Ola,....and this is the tric where a lot people in the world get stuck.....

Did you already install a Windows 2008 server ! (doesn't matter which version ! even 64 bits)

No, then you have to do something before...Intall Windows 2008 is not described here, but in the future in another page...

Yes you installed a Windows 2008 server, great then we can start....

First question, Did you enable IIS 7 in Windows 2008 ?  Thats the first thing to do...add a role...

When IIS 7 enabled, then the real works start... which modules for IIS 7 you want to use....

IIS 6 and before was 'all' or 'nothing', with IIS 7 you have to think about ! which one....

For an Enterprise Environment , I'll advice you to create IIS 7 profiles...  and don't forget the DMZ ! even when 'as usual' Windows 2008 is great hardened.
Security must coming to the door now.... I expect you are in a LAB environment, before staging to production envorinments

For a correct working from Perl you need for sure two IIS 7 modules to install.... then its up to you to decide which one more...

Security and Serving services in IIS 7

About getting it to work with FastCGI.

Since PHP runs best on IIS with FastCGI, I suppose it was logical to turn to FastCGI for Perl as well.

Sometimes, though, the right tool for the job is not the newest and flashiest thing. It turns out that this is the case for Perl. For many years, ActiveState has provided a free version of ActivePerl that runs great on IIS using ISAPI instead of FastCGI.

It's been a while since I've looked at ActivePerl, so I did some research last week to see the state of things and discovered that there are a few things you need to know in order to get it to work on IIS 7:

ActivePerl is available as an ISAPI for 32 bits only. This does not prevent it from running on a 64 bit install of Windows. It just means that any application pool that contains Perl content must be configured to run as 32 bit.

As of this writing, ActivePerl runs well on IIS 7, but its installer does not properly configure IIS 7 for running Perl scripts. After completing the ActivePerl installation, you will need to create handler mappings to associate requests for Perl scripts to the correct ISAPI based Perl interpreter.

There are at least two different ISAPI extensions with ActivePerl. You should make sure that you use PerlEx30.dll with IIS 7. If you use perlis.dll, you may find that response headers sent from your Perl script are added to your response page instead of going back to the client as headers.

Given the above information, here are the steps to get ActivePerl running on IIS 7:

1. Install ActivePerl from http://www.activestate.com/activeperl/. At this time, there is a link to version 5.10 for Windows (x86) on this page. This link downloads an MSI installer to your machine which you can run.

2. If you are running the 64 bit version of Windows 2008, ensure that your application pool is configured to run as 32 bit. Assuming that you will be using ActivePerl in the default application pool, these steps will do it:

  • From the Windows 'Start' menu, pick run and type "inetmgr" (without the quotes). Click on 'OK".
  • In the left hand pane of IIS Manager, open up the settings for your server. Click on "Application Pools".
  • In the Application Pools page, select "DefaultAppPool".
  • In the right hand pane, under "Edit Application Pool", click on "Advance Settings..."
  • In the Advanced Settings dialog, ensure that "Enable 32-bit Applications" is set to "True".

3. Create a handler mapping that associates "*.pl" requests with ActiveState's perlex30.dll extension using the following steps:

4. In the left hand pane of IIS Manager, select your server. This will apply the following handler mappings on the entire server. If you would like to do this for just a specific site or application, you can open up the server and select any site or application. In the center pane, double click on the Handler Mappings icon.

5. When the Handler Mappings pane is displayed, click on the "Add Module Mapping..." item in the Actions pane on the right.

6. Fill out the Add Module Mapping dialog as follows:

  • For Request Path, enter "*.pl".
  • For Module, select "IsapiModule" from the dropdown list. Note that the ISAPI module is a prerequisite. If it does not show up on this list, it will need to be installed an an IIS optional component.
  • For Executable, enter "c:\perl\bin\PerlEx30.dll" (without the quotes.) Note that this assumes that you've installed ActiveState Perl using its default location. If you installed it in another location, you will need to look there for perlex30.dll.
  • For Name, enter "ActiveState Perl for .pl". Note that this name is just a label and does not affect functionality. It does need to be unique, though. If you are going to be associating other file extensions with ActiveState Perl, the names for those mappings will need to be different.
  • You do not need to do anything with the "Request Restrictions..." button. If you wish to limit this mapping to specific HTTP verbs, etc., it can be done there.

7. Repeat the above steps for any additional file extensions you wish to be associated with Perl. On IIS 6, ActiveState Perl creates mappings for "*.pl", "*.plx" and "*.plex". Additionally, some applications are known to map "*.cgi" with Perl.

That's it. After doing this, ActiveState Perl should run on IIS 7.

 

No Perl to install with ActiveState Perl App, everything in one executable file...

 

Share or Bookmark this post…
  • LinkedIn
  • Google
  • Facebook
  • NuJIJ
  • MySpace
  • del.icio.us
  • Technorati
  • Digg
  • DotNetKicks
  • Yahoo! Buzz
  • Yigg
  • E-Mail

Tags: ,

Security | Web IIS 6 - IIS 7

Forrester waarschuwt voor migratieproblemen cloud

June 08
by Marty Hermsen 8. June 2009 17:41

De cloud is uitstekend geschikt om snel applicaties te draaien op de korte termijn. Voor de lange termijn komt het aloude spook van vendor lock-in om de hoek kijken.

Daarvoor waarschuwt een analist van Forrester. "Je kunt door de cloud worden ingesloten", zo zegt James Staten tegenover CIO.com tijdens een sessie in Berlijn over het onderwerp. "Het is moeilijk om een bestaande, al draaiende applicatie naar de cloud te halen, en het is nog niet mogelijk om het er weer uit te krijgen", zo waarschuwt de analist.

Nu nog wordt cloud computing volgens Staten vooral gebruikt door kleinere, nieuwe bedrijven die snel en tijdelijk rekenkracht nodig hebben voor krachtige applicaties. Gaming is daarvan een voorbeeld, maar ook de manier waarop de Amerikaanse krant New York Times zijn archief snel naar het bestaande Amazon EC2-infrastructuur heeft versleept is een mogelijkheid.

Interessant model

Juist applicaties waarvoor snel heel veel rekenkracht nodig is, maken van cloud computing volgens Staten een interessant model. Desondanks blijven grote bedrijven achter, en vendor lock in is daar volgens de analist zeker debet aan. Toch wil hij bedrijven adviseren om in ieder geval een of twee cloudprojecten te draaien, al was het alleen maar omdat ze anders het risico lopen niet mee te komen met ontwikkelaars die toch wel aan de cloud verder timmeren.

Bron: Techworld.nl

Share or Bookmark this post…
  • LinkedIn
  • Google
  • Facebook
  • NuJIJ
  • MySpace
  • del.icio.us
  • Technorati
  • Digg
  • DotNetKicks
  • Yahoo! Buzz
  • Yigg
  • E-Mail

Tags:

ASP.NET | Security

Rabobank werkt aan eigen mobiele portemonnee

March 29
by Marty Hermsen 29. March 2009 21:25

De Rabobank wil nog voor het einde van 2008 van de mobiele telefoon een digitale portemonnee maken. Ook Paypal ziet kansen in een mobiele variant van zijn internetbetaaldienst.

Het nieuwe betaalsysteem dat de Rabobank voor ogen heeft, kent nog geen naam, maar zal vermoedelijk gebaseerd worden op de nfc-technologie van voormalig Philips-dochter NXP. De dienst zal in eerste instantie aan klanten van Rabo Mobiel worden aangeboden. De bank maakt daarbij gebruik van het mobiele netwerk van Orange.

De werking van het systeem werd in grote lijnen door algemeen directeur van Rabo Mobiel Eric Huijgen aan Emerce uit de doeken gedaan. De gebruiker kan een maximum bedrag toewijzen aan de inhoud van zijn digitale portemonnee. De grens zou liggen op ongeveer 150 euro. Het saldo is beschikbaar voor het uitvoeren van betalingen zonder dat er verbinding met de bank wordt gemaakt, maar het geld staat niet, zoals bij de chipknip, op de telefoon: bij verlies of diefstal van de telefoon is de gebruiker zijn geld niet kwijt. Verder kan de Rabo Mobiel-klant het tegoed op zijn mobieltje automatisch laten aanvullen.

Om met de Rabo-geldbundel te betalen, moet een gebruiker zijn mobiele telefoon langs de kassa 'zwaaien'. Nadat de betaling is geautoriseerd wordt het geld via de centrale server van de bank overgeboekt naar de winkelier. Het nieuwe systeem van de Rabobank, dat deels is gebaseerd op technologie van het eerdere Rabo-experiment Minitix, is ook geschikt om de mobiele telefoon als een toegangskaartje of een bewijs van lidmaatschap in te zetten. Zo is de bank een samenwerking aangegaan met Diergaarde Blijdorp. Wie via iDeal een kaartje koopt, kan door zijn toestel bij een nfc-scanner te houden, snel toegang krijgen tot de dierentuin. Ook kan de bezoeker via nfc-punten in het park of met een gprs- of umts-verbinding een elektronische gids downloaden.

Voordat de Rabobank zijn nieuwe betaaldienst kan uitrollen zou er nog wel gewacht moeten worden op een groter aanbod van geschikte mobieltjes. Momenteel is alleen de Nokia 6131 uitgerust met een nfc-chip en dus compatibel met de dienst. Rabo Mobiel kent momenteel ongeveer tweehonderdduizend gebruikers; zeventig procent van hen zou de mobiele telefoon gebruiken voor bankzaken. De Rabobank stelt dat als het nieuwe betaalsysteem succesvol is, het ook door andere banken gebruikt kan worden, zoals eerder met iDeal gebeurde. Het is nog onduidelijk of het concurrerende Payter, dat momenteel proeven uitvoert met mobiel betalen in Rotterdam, kans maakt om het Rabo-systeem te verslaan.

Niet alleen de gevestigde banken zijn druk in de weer met mobiele betaaldiensten, ook Paypal is bezig met plannen voor de introductie van een mobiel betaalsysteem. Het bedrijf kiest voor beproefde technologie: het wil vanaf 2009 via sms en wap zowel offline- als online-betalingen voor zijn klanten gaan verwerken. Paypal experimenteerde in 2006 al met een soortgelijk systeem. Het bedrijf zou in Nederland momenteel 1,4 miljoen gebruikers hebben en zou er naar streven om de nummer twee achter iDeal te worden.

Share or Bookmark this post…
  • LinkedIn
  • Google
  • Facebook
  • NuJIJ
  • MySpace
  • del.icio.us
  • Technorati
  • Digg
  • DotNetKicks
  • Yahoo! Buzz
  • Yigg
  • E-Mail

Tags:

Fortis en ABN | Security

About Me

My name is Marty Hermsen, 45 years young, living in the Netherlands, married with Denise for almost 16 years now, without children but with our 'child' dogs in the small village Kamerik near Woerden, between cows and cheaps, in the middle from nature.... a paradise in the dense populated area in the world...

I am working at Fortis Bank Netherland and ABN Amro as IT Architect with current activities in separation Fortis Netherlands and Fortis Belgium and in integration Fortis Bank Netherland with ABN Amro. Creating a new Enterprise Microsoft Windows Platform based on Windows 2008 and integrating webapplications, sharepoint etc etc.

Creating a newbank...

click here for more about me

Calendar

<<  March 2010  >>
MoTuWeThFrSaSu
22232425262728
1234567
891011121314
15161718192021
22232425262728
2930311234

View posts in large calendar

Google Reader Picks

Blogroll Others

Download OPML file OPML

Poll

No poll