In this article I analyze five applications Microsoft’s Explorer, Sun’s Java JRE, Apple’s QuickTime, HP NodeManager and Adobe Reader. The conclusion I formulated after writing the article was that the reliability of Software Product is too low to be even bad.

QuickTime’s users are 99% of the time exposed to at least one unfixed vulnerability, which I think should ban this products for almost all computers.

I hope you enjoy the article.

The windows package of Squid comes with several external programs which can be used as external ACLs which allow you to query the local Active Directory in order to obtain access or not. The one dealing with users and groups is called mswin_check_ad_group.exe which, as all the external ACLs, reads the standard input looking for a user and a group and return whether the user belongs to the given group.

This is fine and pretty straight forward it has a PROBLEM, it only works with Groups with scope set to “Domain Local”; which turn into a drawback when your users belong to Groups with Global Scope. I haven’t found any documentation explaining how to achive this so I have created a simple external ACL to peform this task in python.

You only need to download pywin32 and the active directory plugin for python. After installing just use the following code, which will return OK IFF the user belongs to the given group (non matter which scope):

• Checking for adminstrator privileges:

userInfo::getAccountType

Pop $0

StrCmp $0 “Admin” +3

MessageBox MB_OK “Debe tener privilegios de administrador para correr este programa de instalación: $0″

Return

StrCmp $0 “Admin” +3

MessageBox MB_OK “You need Administrator privileges: $0″

Return

This chunk of code will pop up a windows with the propoer notification. The StrCmp sentence compares the $0 variable poped from the stack against “Admin” and if they are equal continue the execution with the 3rd line of code, the one below Return.

• Downloading and Executing, e.g. an external installer:

NSISdl::download /TIMEOUT=30000 “http://www.advansen.com/this/is/a/test/advansen.msi” “$INSTDIR\advansen.msi”

Pop $R0 ;Get the return value

StrCmp $R0 “success” +3

MessageBox MB_OK “Download failed: $R0″

Quit

ExecWait  ’”msiexec” /i “$INSTDIR\advansen.msi” /quiet’

• Unziping :

To use the unzip feature you need to download the unzip external plugin, follow the installation guidelines (basically copying the dll to the plugins directory) and that’s it.

nsisunz::Unzip “$INSTDIR\squid.zip” “C:\”

Pop $R0

StrCmp $R0 “success” +2

DetailPrint “$R0″

• Modifying the environment variables:

Adding to PATH

${EnvVarUpdate} $0 “PATH” “A” “HKLM” “C:\some\path”

Removing a PATH

${un.EnvVarUpdate} $0 “PATH” “R” “HKLM” “C:\some\path”

To use the code above you also need external help, just download the EnvVarUpdate extension and will able to update the $PATH variable easily

• Download files
• Unzip Files to a specific folder
• Execute external installers
• Modify Environment Variables

Since NSIS supports plug-ins there are quite a few available which provide extra functionalities such as the unzipping one.

Before going into these extra features, which will be subject of a new post, I prefer writing down how a more complex script is structure, just to keep in to the future.

NSIS is structured in pages (page == panels show each time a “next button” is clicked), most of them are predefined, where you can only change tittle or add extra text in them. Following are the pages definition using the MUI2 interface:

!insertmacro MUI_PAGE_LICENSE “path\to\license.txt”

!insertmacro MUI_PAGE_COMPONENTS

!insertmacro MUI_PAGE_DIRECTORY

!insertmacro MUI_PAGE_INSTFILES

Except for the components page which is configured using the section described in the previous post.  Each Section name will appear as a component with its corresponding checkbox, groups can also be specified and the code inside each section will be only executed if the component is checked:

SectionGroup “Extra Plug-ins”

Section “Spreadsheet”

SectionEnd

Section “PDF”

SectionEnd

SectionGroupEnd

A section declared as follows is executed always :

Section “”

SectionEnd

The next chunk of code creates an entry in the program’s menu:

CreateDirectory “$SMPROGRAMS\Advansen\”

CreateShortCut “$SMPROGRAMS\Advansen\uninstall.lnk” “$INSTDIR\uninstall.exe”

And in order to execute external installers or additional programs the ExecWait sentences provides an easy way to achive that. In the next line python uninstaller is called with the quite flag so no window pops up:

ExecWait  ’”msiexec” /uninstall “$INSTDIR\python-2.6.2.msi” /quiet’

These days I have been playing with SQUID and the external ACL feature which allow the user to add some amount of customization without too many work. The syntax for those external ACL is the following:

external_acl_type <type-name> %<PARAMETER> /path/to/external/program

That’s how you define an external acl to be used afterwards. There a bunch of allowed parameters, the external program can read from the stdin, as follow:

%LOGIN

%IDENT

%SRC

%DST

%PROTO

%PORT

%METHOD

%{Header}

dcpromo

Along with the Class and sequence diagrams you have to use the State Machine diagrams or Protocol State Machine diagrams. The main difference is in the second one you do not need to specify embedded states.

I will write a longer post with some diagrams and nifty stuff

The best approach seems to be specify and close the interface with the plug-in subsystem in the main system and afterwards develop each new subsystem independently.
The bad point of this procedure is that it can lead of loads of documentation since you need requirements and design documentation for each new plug-in.

The good point is that the system is completely isolated by analysis, and obviously design, of each subsystem which increase cohesion and encapsulation, decrease coupling and produce a cleaner product.

But when in the analysis this factor comes important? In which part of the document should you split the server and client functionalities?

I am not really sure what would be the best approach to solve this problem, for sure it depends on what the client wants you to design but what if other client is not that sure?

For the first kind of client I came across with a simple solution, just include the client/server model as a design constraint and go on with the analysis.

If instead of the client it’s you who finds out that the client/server model is the best one which fits the system architecture I think you shouldn’t consider the client/server model till the design stage.