Web 2.0

All things related to IT security, privacy and compliance.

Don’t forget to check out #InfoSecAndCompliance on Jaiku.

Hiveminder Security Only For Paying Customers

UPDATE: Thoughtful response from Jesse @ Hiveminder in the comments.

Fans of Getting Things Done [GTD] are on a never-ending quest for the ultimate solution to help them get and stay organized. Remember The Milk [RTM] is one Web 2.0 site growing in popularity amongst the GTD-followers which allows you to perform task management via a slick web interface, from instant messaging services, on Twitter and even has a robust API for custom integration (not to mention some very interesting Google Apps interfaces). Amazingly enough, it even allows you to perform actions over SSL so your credentials and task bits remain secure (if you’re into that whole security thing when it comes to putting your information on Web 2.0 sites).

Contrast that with another contender I just learned about - Hiveminder. It has the similar integration points and facilities (some not as spiffy as RTM), but an entry in their FAQ gave me pause:

You’re not using SSL; how do I know my password is safe?
If you have a Javascript-enabled browser (most of them are these days), then your password will be encrypted when logging in, before being sent to us over the internet. But we also offer SSL encryption as a feature to pro users.

In other words: we don’t care about the security of your data unless you pay us to.

That is a fairly cavalier attitude given that their competition lets you encrypt all web traffic whether you are entering login credentials or just plain browsing.

In many cases, Web 2.0-ish sites put features first and security second (or third), and my concern is that others will either adopt this model of “Features? Sure, you can have ‘em! You want security? Cough up some dough!” or alter their terms of service to switch to this business model at some point after they gather a decent user-base.

This is yet another example of why you need to read the fine print when choosing a product or service and - especially for Web 2.0 sites - ensure that you have complete control over your data.

| »

Drupal 6 RC1 Released

The fine folks over @ Drupal announced the first release candidate for the 6.x code stream. [NOTE: RDN is powered by Drupal]

There are *tons* of new features including a better installer, core support for OpenID, “actions” and “triggers” for a horde of Drupal system events and significantly improved handling of internationalization (more info on features on the beta announcement page).

If you run your own site and aren’t using Drupal, you should be. The developer community behind it is amazing and highly talented, there is a serious commitment to security and they’ve garnered support from “big names” like Sun and Google. What are you waiting for? Stop reading this an go download it now!

|

Integrated 'Quick Hits' From tumblr

Some noteworthy items do not warrant a full-on blog post…at least that’s [part of] the premise of tumblr. I - mostly - tend to agree, and fearless readers should now see my tumblr feed as a right-hand block.

You can also bookmark the gathered post directly or just subscribe to that RSS feed for updates.

I’m thinking of a weekly “best of my tumbler quick hits” post, but we’ll see how that manages to manifest itself.

Technorati Tags:
|

Google News Bar For Your Site

Like the AJAX-y news box at the top of the site? You can get your own, courtesy of the Google News Bar Wizard.

It has a full API and can be displayed in a couple different formats (so far, vertical or horizontal).

If you use the wizard, it generates a bit of HTML that you can just add to your existing site (provided you have a Google account and API key for your site). There are some interesting possibilities with this. For instance, altering the news displayed based on a search performed in your blog. For now, I’ll just keep playing with the keywords to try and find the best news mix.

|