OWASP Question Time

name: inverse
layout: true
class: middle
---

# Web Stuff
_No Question Is Stupid_

Joe Crawford<br>
21 November 2013

---

# 4 topics
  ## web
  ## cloud hosting Java
  ## NodeJS
  ## NSA

---

#web

---

# "what is a web"

Andrew Cowart, _Professional Developer_

<img src="owasp/taylor-swift.jpg" height=100>

---
.left-column[
  ## 1990 web
]
.right-column[

- the web is HTTP + HTML
- web servers and browsers speak to each other in HTTP
- browsers render HTML
- links inside HTML create "web" of documents and resources

<img src="owasp/next.jpg" height=100>
<img src="owasp/next.jpg" height=100>
<img src="owasp/next.jpg" height=100>
]
---

<img src="owasp/web.jpg" height=80%>

---
.left-column[
  ## 1990 web
  ## 2013 web
]
.right-column[

- the web is HTTP + HTML
- web servers and browsers speak to each other in HTTP
- browsers render markup
  * HTML
    - which can then call
    * Frames `<frameset><iframe>`
    * Images gif jpg png webm
    * Flash movies `<object><embed>`
    * Java applets `<applet>`
    * Audio `<audio>`
    * Video `<video>`
    * CSS `<link rel="stylesheet">`
      * images, fonts
    * JavaScript
      * AJAX (`XMLHttpRequest`)
        * HTML
        * XML
        * JSON
- Browsers handle a kitchen sink of markup
  * HTML, HTML4, HTML5, xhtml, wml, XML, RSS, Atom
- Resources can also speak HTTP
  * Frames, Flash movies, Applets
]
---

## web browsers

Chrome .............. 36.29%
    Internet Explorer ... 20.27%
    Firefox ............. 16.60%
    Safari Desktop ......  7.10%
    Android .............  4.97%
    Safari Mobile .......  4.27%
    Opera Mobile ........  2.73%
    Opera Desktop .......  1.01%

_Source_: [Statcounter](https://en.wikipedia.org/wiki/Usage_share_of_web_browsers#StatCounter_.28July_2008_to_present.29) _July 2013_

---

## web traffic is also

- Search Engine Indexers
  - Scrapers & Archivers
  - WebViews inside Mobile Apps

---

<img src="owasp/web.jpg" height=80%>

---

# what is a web (server)

<img src="owasp/taylor-swift.jpg" height=100>

---

## web servers
 - deliver stuff via HTTP

## application servers
 - process logic

## database servers
 - CRUD data

---
## web servers
 - Apache, IIS, nginx ...

## application servers
 - PHP, Tomcat, .NET, ColdFusion, Glassfish, mod_perl, Zend, NodeJS ...

## database servers
 - MySQL, SQL Server, Oracle, PostgreSQL, Hadoop, MongoDB, CouchDB ...
---

## choices in hosting
 - stable network address
 - computer(s) that run [web server(s), app server(s), db server(s)]

##types
* shared
* managed
* dedicated
* colocated
* virtual private server (VPS)
* cloud hosting

---
### Web Servers

Apache ........ 44%
    Microsoft ..... 24% (Internet Information Server, Azure, etc.)
    nginx ......... 14%
    Google ........  5% (Google Platform, Google App Engine, etc)
    ...................
    Other ......... 13%

_Source_ [Netcraft](http://news.netcraft.com/archives/2013/11/01/november-2013-web-server-survey.html) _November 2013_
# cloud hosting java servlets

---

# Google App Engine
  [developers.google.com/appengine/](https://developers.google.com/appengine/)

## web servers
 - Google

## application servers
 - Python, Java, PHP, Go

## database servers
 - App Engine DataStore

---

# Amazon Web Services (EC2)

### [Any](https://aws.amazon.com/marketplace/b/2649367011) operating system

### AMI: [aws.amazon.com/marketplace/](https://aws.amazon.com/marketplace/)

- any web server
 - any application server
 - any database server[*](http://aws.amazon.com/running_databases/)

---

### Try [Google App Engine](https://developers.google.com/appengine/docs/whatisgoogleappengine) First
- good tools and tutorials
- Eclipse integration

---

### Costs?

- [Google](https://cloud.google.com/pricing/) gives lots of free usage to encourage developers
 - [Amazon Web Services Simple Monthly Calculator](http://calculator.s3.amazonaws.com/calc5.html)

---
## Besides Amazon and Google:

- Rackspace
 - Eucalyptus
 - CloudStack
 - OpenStack
 - Xen
 - VirtualBox

---

## More reading
 - [Google App Engine Java Tutorial](https://developers.google.com/appengine/docs/java/gettingstarted/introduction)
 - [What alternatives are there to Google App Engine?](http://stackoverflow.com/questions/153721/what-alternatives-are-there-to-google-app-engine)
 - [Amazon Elastic Compute Cloud User Guide](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/)

---

# [NodeJS](http://nodejs.org/)

---
<img src="owasp/node.png" height="30">

## javascript = popular

_(most common programming language on the planet)_

---

<img src="owasp/node.png" height="30">

## node = fast

_(uses Chrome's V8 engine)_

---

<img src="owasp/node.png" height="30">

## web apps = same language end to end

_(Did I mention JavaScript?)_

---

<img src="owasp/node.png" height="30">

## open source

_(dependencies all open source as well)_

---

<img src="owasp/node.png" height="30">

## documentation

[http://nodejs.org/api/](http://nodejs.org/api/)

---
<img src="owasp/node.png" height="30">

## built in capabilities

Buffer · C/C++ Addons · Child Processes · Cluster · Console · Crypto · Debugger · DNS · Domain · Events · File System · Globals · HTTP · HTTPS · Modules · Net · OS · Path · Process · Punycode · Query Strings · Readline · REPL · Stream · String Decoder · Timers · TLS/SSL · TTY · UDP/Datagram · URL · Utilities · VM · ZLIB

---

<img src="owasp/node.png" height="30">

## npm (bundled package manager)

[NPM Registry](https://npmjs.org/)

---

<img src="owasp/node.png" height="30">

### webserver

var http = require('http');
    http.createServer(function (req, res) {
      res.writeHead(200, {'Content-Type': 'text/plain'});
      res.end('Hello World\n');
    }).listen(1337, '127.0.0.1');
    console.log('Server running at http://127.0.0.1:1337/');

---

<img src="owasp/node.png" height="30">

## PayPal
[How Paypal Is Being Revolutionized By Node.JS And Lean-UX](http://www.nearform.com/nodecrunch/release-the-kracken-how-paypal-is-being-revolutionized-by-node-js-and-lean-ux)

---

<img src="owasp/node.png" height="30">

## PayPal's experience

- Step 1: Utilize an Open Source Stack (use tools that lots of people use)
- Step 2: Bootstrap with Bootstrap
- Step 3: Use JavaScript Templating
- Step 4: Make UI Bits portable to legacy
- Step 5: Make it easy to understand and easy to experiment
- Step 6: Bring Node to Production
- Step 7: Node.js Wins
- Step 8: Release Modules to Open Source

Source: _[How Paypal Is Being Revolutionized By Node.JS And Lean-UX](http://www.nearform.com/nodecrunch/release-the-kracken-how-paypal-is-being-revolutionized-by-node-js-and-lean-ux)_

---

<img src="owasp/node.png" height="30">

## PayPal's experience

- fewer developers spun up faster
  - faster development cycle
  - better performance
  - fewer lines of code
  - lighter weight than prior Java usage
  - able to integrate with existing legacy systems

Source: _[How Paypal Is Being Revolutionized By Node.JS And Lean-UX](http://www.nearform.com/nodecrunch/release-the-kracken-how-paypal-is-being-revolutionized-by-node-js-and-lean-ux)_

---

# Try it: [http://nodejs.org/](http://nodejs.org/)

---

## how do i stop the NSA from reading my traffic?

---

## how do i stop the NSA from reading my traffic?

_[EFF's Technology to Protect Against Mass Surveillance](https://www.eff.org/deeplinks/2013/07/technology-protect-against-mass-surveillance-part-1)_

---

## how?

[Tor](https://www.torproject.org/), [VPN](https://www.google.com/search?q=foreign+vpn+service)

---
## but...

<img src="owasp/GOOGLE-CLOUD-EXPLOITATION1383148810.jpg">

---

## Encryption everywhere?

---

# Thanks!