Gajendra's Blog

Novel by Eric Van Lustbader and Robert Ludlum I like all Robert Ludlum’s novels including those which are written by Evan Lastbadder. To me his novels have taken fiction to the next level. During my way back to Hyderabad from my last summer trip to hometown I bought paperback version of “The Bourne Betryal”. This novel was full of Lastbadder’s style of writing than Robert Ludlum’s one.  I took almost 6 months to complete it. This novel has something different to offer actually. Plot is exciting but the story is not very accelerating. Jason bourn and Martin Lindros, When martin Lindros decided to come back in the field operations with the aim to destroy Fadi and When Martin is out the track , Jason is the only help possible in the situation. Story takes you through various struggle of Jason to bring Martin back home. There are few things where author has not even paid any attention for example how does an ordinary Pakistani Waiter will have that much of information   Towa...

In application security world blacklisting and whitelisting validations are very popular. This basically indicates what should be allowed and what shouldn’t be allowed. I was thinking about some of the web applications deployment structure and paying attention on the way various files are packaged and deployed. I found one interesting thing about web assets like CSS, Images and fonts , java scripts. When we host the web assets, URLs that actually provide web assets are actually not protected up to the mark. Let’s say  you have an application which has URL something like this http://someapplicationname/somecontext/myaccount when you access the above mentioned URL, application may redirect you to login page, Whole idea is to force user to authenticate him/herself and create a secure session. Once the session is established you can access and the account page and do whatever you want to do. But web asset URLs are not protected.   http://someapplicationname/someconte...

We have seen multiple new programming languages every year and question which is commonly asked is Will there always be new programming languages coming out? I believe  many new programming languages will keep coming and many are on the way. Technologies are evolving around us will make it fairly easy; everyday big corporation and tech individual/communities are making consistent progress towards technological advancement. If you observe every new programming language has one thing in common and that is they are based on software engineering principals, you will find same loop, iteration, conditional processing and stuff like that. What makes them different is Adoption, you can make your own programming language using other languages but it will only be popular when it can convince large tech community on the ground of Efficiency, Security, Agility, Portability, platform support etc. Wikipedia has impressive List of programming languages We have seen many languages in the pa...

Why does the aboave command prints URLs, Websites addresses that we have never accessed before ? When your system communicates with the DNS server for resolvingthe name queries, Your system builds the cache over the perios of time, This cache normally contains records from the host file and also the retrieved records from the recently resolved queries. Coming to the question that the site which were never accessed showing up there. DNS cache notes down positive and negative results as well. as you know caching is all about performance improvment. Now lets say you accessed Website1 and Website1 has some functionalities which makes it to communicate with Website2. Now Fortunately or unfortunately Website2 is blocked in your network and name query for this Website is not resolved. Still this unresolved queries will be recorded in DNS cache. I think those results are coming as they were initiated from your system implicitly. Issue this command to clean the DNS cache

Why did backend guys always feel superior over frontend guys? I have been on both side and have done both front-end development and back-end development for long time. Truth is in a web based product nothing is superior both complement each other. Think about the product which has sophisticated transaction processing system, better error handling,reliability and availability but lacks good user experience and poorly designed user interface. Consider user interface as front desk, no matter how good your back office processes are if front desk does not behave in respected manner nothing works. Coming to so called superior feeling of backend developers much of it can be largely attributed to technology stack, I think it’s better to say traditional technology stack. Normally engineer feel great when they deal with stuff which has fair amount of complexity and backend gives you that.Front end was nothing more than JAVA script, HTML and CSS, not counting tools and productivity solutions...

One of the friend asked this question in one of the popular forums, i thought I should keep copy of my answer in my blog as well. What sort of interview questions can be asked in information security profile? It depends on your role under information security profile, If you are ininformation security engineering role, questions will be more from tools andtechnologies and security audit and analysis methodologies. Questions may comefrom application security(OWASP TOP10), network security or computer forensics. In the corporate world no one expects an information security engineer to bemaster of all the security disciplines. Questions from different operating system techniques and popular web serversand information security architecture will be asked. Various operating system administrationdetails questions may surface. Vulnerability assessment is another topic whichcan be discussed. Security consultant as a profession itself is about being specialist notjournalist. So solid un...

I think Capacity wise Facebook is the good place to start as no other website has experienced kind of volume and traffic that Facebook has witnessed in the recent past. As you have not specified whether You want to know more about the infrastructure, security or you are interested in their operating model, staff size and remote site management? I would go with the general details. Facebook has multiple data centers around the world and the reason behind this is a common knowledge i.e huge volume of the data that FB process on daily basis. Facebook is currently the world’s most popular web site, with more than 1 trillion page views each month, according to metrics from Google’s DoubleClick service. Facebook currently accounts for about 9 percent of all Internet traffic, slightly more than Google, according to HitWise. This is the first data center of the Facebook in Prineville FB realized that they need many data centers in different locations to support the performance demand of...

Microservices architecture addresses many concern of application development but does not solve all the problems. It has its own advantages and limitations. In order to understand it fully, we need to understand one common architecture pattern in practice, i.e. Monolithic Architecture Monolithic architecture are highly tightly coupled and you can’t change something without impacting other. Look at this building and tell me how easy it is to change Let’s take an example of an e-commerce website that has many components and services i.e. Order service Invoice service Payment services will talk to various payment gateways. User Administration services. Graphical user interface for web, WAP and for various mobile platform like android, iOS, blackberry etc. Database services, possibly more than one database will be involved. Now let’s see what are some common problems associated with it Ever Growing Container size Generally all these components are packaged in one ...

RSA SecureID is in use from long time, I think even before GPS. It uses two factor authentication mechanism. **RSA SecurID**, formerly referred to as **SecurID**, is a mechanism developed by Security Dynamics (later RSA Security and now RSA, The Security Division of EMC ( RSA Security )) for performing two-factor authentication ( Two-factor authentication ) for a user to a network resource. RSA secureID generates token which is then transmitted to the server where it is matched against the stored value in the server database. to understand it clearly we need to go through one use case and i hope that will make things pretty clear. This token can be transmitted using USB port or directly by user input. so 2 type of device is being used. John Smith joins a new company, According to new company's information security policy John is instructed to use RSASecureID to authenticate himself in corporate network. From the companies IT infrastructure department he got his brand new RS...

Precious metal, exchange of goods have served as currency in the past, as human race advances and their knowledge of market, financial innovations surfaces. This time its about the Cryptographic currencies. You might have heard about Block Chain, Bitcoin, Titcoin, Primecoin etc.. all of them are digital way of exchanging values. These frameworks outlines how participants can exchange values securely. Security of transaction is very important as system without faith will not even last for seconds. It has to be time tested and robust. BTW Why we call it Cryptocurrencies ? digital because we do not need it in physical form, Cryptocurrencies because this whole thing is bullet proofed by Cryptographic system. Which supports encryption/decryption, public/private keys, transformation, block and stream ciphers almost everything that can make even a Geek to Freak. Is it Legal ? The whole idea is to make the value exchange system decentralized. Crptocurrencies are not regulated by Ce...

Its hard to arrive at conclusion in this wide and ever changing job market of IT industry but one thing is quite evident that now data is becoming highly critical and crucial to any business. Most of the recruitment are happening around 1. Dealing with data. (Web service, SOA, API's etc..) 2. Protecting Data (Protection of data at rest and at transit, Web development  Security, AppSec, Cyber Theft, Computer Forensics) 3. Analyzing data (BigData implementation platform, Hadoop, Stream Analytics and technologies supporting this platforms). Of course there are many other technologies which are highly paid but that have become quite saturated but form the above mentioned 3 points, let me try to get into the specific job titles 1. Web Application Development :  Application development which supports all the operating systems and possible hardware(s). Android, iOS, Smart watch and other devices. This include Web based and native app development. Front end development is ...

Apple siri has evolved many times and each and every time it has managed to bounce back with solid capabilities, sky is the limit and we can only expect some or other kind of improvement in the architecture as the technology evolves. These guys have not given an inch to rivals. Apple Siri backend runs thousands of services and they are running on equal number of nodes. Siri’s Application data resides in HDFS (Hadoop distributed file system) cluster . Apple have created a proprietary PaaS-like scheduler framework named J.A.R.V.I.S. , which allows developers to deploy Siri services in a scalable and highly available manner. Apache Mesos is the one that Apple Siri is leveraging for backend cluster management, it serves the CPU, Memory and computing resources abstraction very well, to prove the capability, following is the data published by Apache Mesos Apache Mesos Features Scalability to 10,000s of nodes Fault-tolerant replicated master and slaves using ZooKeeper Support for...

Most of the time technological advancement manages to amaze me. Deeper I go, better I feel about it. For example the the progress mobile application development has made in the recent past is without a doubt first rate. This blog post is being written using the android platform based Blogger Application. How interesting is this that you can share your feeling whenever you want and from wherever you are. One thing that all of us should appreciate about technology is that it makes our life far more easier and very comfortable.  If technology is not impacting life of the people than its of no use. That being said let's see how many articles I can post from today on wards. Mobile application alone can not help you to share your feelings, you should have passion and willingness as well. You can download this from Google Play Store and start playing around. This will fetch existing account information from your android phone and will be functional in no time. This application is co...

I am back after 10 days long leave from work, sometime it really feels so good to stay away from work and office, sometime it is very much required not only to relax but also to give some time to your other hobbies and remind yourself that We are human and no matter what we do for living we have to keep some time aside for things that we enjoy. Like they say don;t be a computer siting in front of another computer. I planned to use my time off on something non-technical and turned towards one of my favorite writers novel. By the way John Grisham is one of my favorite writers. I have finished the book and am to write about the thrilling experience that I had reading this Novel. I have finished it very recently, it’s “ The Litigators from John Grisham ”, one of the finest legal thriller I have ever read. Anyone who likes legal suspense and their terminology will find it very useful and interesting. Specifically I want to applaud on Grisham’s ability to keep humor involved in complic...

From one of my quora answers What jobs in the information security realm require strong development skills? By development skills if you mean application development skills then yes what Andrew Olson  pointed out seems correct, You can use those skills during the static analysis code review. Code review has always been part of security engineering in most of the organizatons. When you come to offensive security you should have strong development skills as you will be developing exploits in order to publish or test the vulnerabilities. Skills that you need at this level are completely differnt from the application development skills which is largely based on Language and thrid part libraries available in the language. Its kind of hard to segregate responsibilities based on the job role but let me try and list some for you Information security engineer (Application Security)  - Code Review(Both manual and automated using the tools), Should have good knowledge of the fr...

This story is about a man who went through a deadly experiment, a man whose survival was subjected to the outcome of the experiments doctors were struggling with, it is about the man who had enough faith on the doctors( not because he believes on them but because he had no option), a man who made himself ready to attach with the operation table. For some reason operation table was better than the dental chair. Though it shares so many commonality between the jail and dentist chair but i will talk about that later.   Let me start with the first thing when i was struggling with throbbing pain. Still i wanted to avoid dentist. I knew the man behind the table with drillers in his hand has earned all the right and degrees  to use his instruments on almost anyone who is in the clinic, the only way you can save yourself from him is - DON'T get into the dental chair. Let me tell you what dental  chair is - its name chair is very deceptive, its not at all chair actually...

The below mentioned documentaries prepared and presented by Michael J. Mosley from BBC can give you great incite into the human body. It takes you through the exciting and innovating phase of medical advancement in the field of surgery. i was thrilled after knowing some of the facts, it is very interesting to know how doctors have invented methods and how they took charge of doing complex surgery, what has made them so confident, who are the patients who survived and who lost their life ? Amazing 5 part documentary brilliantly presented  

Another video that i encourage all my family and friends to watch ...

Let me put some disclaimer first, I am neither a medical practitioner or doctor nor i am pretending to be one, and i don't have any medical degree either but i do have some knowledge and experience that i would like to share with you today. I hope this will help some of you who are suffering from some kind of decease. This is also useful for those who believe in prevention of decease.  No matter what type of problem your body has one thing is very clear that your body is perfectly able to fight back we have limited its potential by our thought process another thing which contributes in limiting the bodies ability is  use of pathological drugs which never seems to work without side effect, which means if any pathological drug is working in one part of your body defiantly other part of he body is compromising with the side effect but some time it is OK to use this unless its in a purview of strength of the body but can not be continued for long time. All long term treatment sho...