Home | Contact Us | FAQ | Search & Site Map | Link to Us
Sign In | Join | Other 45 Sites in Network
HomeAnnouncementsWhite Papers
Discussion GroupsFirst AidDatabasesJavaBeansGUIJava 3DVirtual MachineCORBASecurityToolsGeneral
Java DirectoryOpen Source ProjectsSample Book ChaptersUser GroupsWeb Resources
Related Topics
Databases.NETMore Topics ...

Java Forum / General / July 2006

Tip: Looking for answers? Try searching our database.

exception report

Thread view: 
cmk128@hotmail.com - 31 Jul 2006 06:42 GMT
Hi
  When my java application throw an exception, it will connect to
MySQL, dump the exception to it. My java software is open source, so i
scare everyone will know my mysql password because the password is
inside the code.
  I can pack the class that connect to mysql to another jar, and don't
release this piece of source code, but this is not open source and not
what i want. Any other way?

thanks
from Peter (cmk128@hotmail.com)
Oliver Wong - 31 Jul 2006 16:05 GMT
> Hi
>   When my java application throw an exception, it will connect to
[quoted text clipped - 4 lines]
> release this piece of source code, but this is not open source and not
> what i want. Any other way?

   Create a new user account for your MySQL DB which only has INSERT
priviliges into your table. Have your Java program use that password.

   Now people can insert into your DB, but they can't delete or do other
stuff to it.

   You'll still be vulnerable to DOS (Denial of Service) attacks in which a
malicious user tries to make a billion inserts into your table, but I think
it's impossible to avoid that. At best, you could add an extra processing
layer between the DB (e.g. a WebService), which checks against duplicate
entries, or flooding from a single IP address or something like that.

   - Oliver
cmk128@hotmail.com - 31 Jul 2006 17:59 GMT
Oliver Wong 寫道:

> > Hi
> >   When my java application throw an exception, it will connect to
[quoted text clipped - 18 lines]
>
>     - Oliver

thank Oliver
   I already set the user account that only have select and insert
rights.
I don't think i have a perfect way to avoid the DOS attack, because
once the exception occurs, it will insert record to DB. And same
exception occurs many times on the same IP is very possible.
thanks again
from Peter (cmk128@hotmail.com)


Free Magazines

Get these publications absolutely FREE for up to 12 months. There are no hidden fees and no obligation. Simply choose a title, complete the application form and submit it. Read more ...

Oracle MagazineNetwork ComputingComputer WorldBio-IT WorldeWeekInformation WeekInfosecurity
 
Sign In
Join
My Latest Posts
My Monitored Threads
My Blog
My Photo Gallery
My Profile
My Homepage

Start New Thread
Enable EMail Alerts
Rate this Thread



©2008 Advenet LLC   Privacy Policy - Terms of Use
This website includes both content owned or controlled by Advenet as well as content owned or controlled by third parties.