博客园-YellowWee's Scriptshttp://www.cnblogs.com/YellowWee/妳的世界能夠從此不同...而我的世界... 亦因妳而改變...zh-cnWed, 03 Dec 2008 04:36:59 GMTWed, 03 Dec 2008 04:36:59 GMT60Founders at Work: Stories of Startups' Early Days 创业初期的故事http://www.cnblogs.com/YellowWee/archive/2007/11/03/948156.htmlYellowWee(端木柒)YellowWee(端木柒)Sat, 03 Nov 2007 08:33:00 GMThttp://www.cnblogs.com/YellowWee/archive/2007/11/03/948156.htmlhttp://www.cnblogs.com/YellowWee/comments/948156.htmlhttp://www.cnblogs.com/YellowWee/archive/2007/11/03/948156.html#Feedback1http://www.cnblogs.com/YellowWee/comments/commentRss/948156.htmlhttp://www.cnblogs.com/YellowWee/services/trackbacks/948156.html     Founders at Work: Stories of Startups' Early Days 是许多著名技术公司创建者的访谈录,记录着他们创业早期发生的种种。当这些技术还只是朋友们的一些想法时，它们是什么样的？像Steve Wozniak (Apple), Caterina Fake (Flickr), Mitch Kapor (Lotus), Max Levchin (PayPal), and Sabeer Bhatia (Hotmail) 这这样的创业者亲自告诉你他们学习创建一个公司是多么的有趣，多么的令人吃惊。

      他们是从哪里得到后来使他们变得富有的注意？他们怎么说服投资者给他们投资？当他们进行不下去了，他们又是怎么死里逃生的？

      这本书里除了基本的技术之外,很有很多商业知识,始终创业和商业是分不开的,并不是有好的技术就能把它变成热销的商品。记得大学时李开复教授来我们学校演讲，拿会儿大概2000年，其中他介绍了它们亚洲研究院的一个研究项目，一款“中文输入法”。这款输入法到如今来看也没有哪个输入法功能能超过它的，让我印象最深的是功能是自动更正功能，比如你输入汉语拼音shanxi，山西和陕西都是这个拼音，输入shanxi后显示的山西，当你输入西安后，前面的山西自动变成陕西了（刚是了一下，好像微软拼音输入法2007也能实现）；还有比如你在输入英文，遇到比如公司的英文记不得怎么写了，你只用输入gongsi，就会自动生成company，更牛的是，它能根据你英文的上下文选择不同的英文。每次敲入gongsi，它能根据上下文生成company，corporation，corp. ，Co. 和firm。这款输入至今还没有面世，可见一个技术转化为商品还需要很长的过程。

      推荐，这本书可以给我们这些搞技术开拓视野，学习一些商业知识，商业技能，始终技术能否成功得要有市场才行。这本书还没有中文，我会利用时间慢慢把这一个个的采访故事翻译过来，请关注YellowWee's Script。 http://www.yellowwee.com.cn/category/FounderAtWork.aspx

       32个采访包括：

David Heinemeier Hansson
Partner, 37signals and creator of Ruby on Rails

Charles Geschke
Founder of Adobe

Ron Gruner
Founder of Alliant Computer and Shareholder.com

Steve Wozniak
Founder of Apple

Philip Greenspun
Founder of ArsDigita

Evan Williams
Founder of Blogger.com and Odeo

Craig Newmark
Founder of Craigslist

Joshua Schachter
Founder of Del.icio.us

Joe Kraus
Founder of Excite and JotSpot

Blake Ross
Creator of Firefox

Caterina Fake
Founder of Flickr

Joel Spolsky
Founder of Fog Creek Software

Paul Buchheit
Creator of Gmail

Ray Ozzie
Founder of Groove Networks and Iris Associates

Sabeer Bhatia
Founder of Hotmail

James Hong
Founder of HotorNot

Mitch Kapor
Founder of Lotus

Bob Davis
Founder of Lycos

Arthur van Hoff
Founder of Marimba

Mark Fletcher
Founder of ONElist and Bloglines

Ann Winblad
Founder of Open Systems and Hummer Winblad

Max Levchin
Founder of PayPal

Mike Lazaridis
Founder of Research in Motion

Mena Trott
Founder of Six Apart

Dan Bricklin
Founder of Software Arts and creator of VisiCalc

James Currier
Founder of Tickle

Mike Ramsay
Founder of TiVo

Steve Kaufer
Founder of TripAdvisor

Paul Graham
Founder of Viaweb and Y Combinator

Brewster Kahle
Founder of WAIS, Internet Archive and Alexa Internet

Steve Perlman
Founder of WebTV

Tim Brady
First employee at Yahoo!



[新闻]Digg创始人：不再考虑出售公司 将适机并购
博客园首页 社区 新闻频道 小组 博问 网摘 闪存]]>生成自己站点的SiteMaphttp://www.cnblogs.com/YellowWee/archive/2007/10/31/944488.htmlYellowWee(端木柒)YellowWee(端木柒)Wed, 31 Oct 2007 08:16:00 GMThttp://www.cnblogs.com/YellowWee/archive/2007/10/31/944488.htmlhttp://www.cnblogs.com/YellowWee/comments/944488.htmlhttp://www.cnblogs.com/YellowWee/archive/2007/10/31/944488.html#Feedback0http://www.cnblogs.com/YellowWee/comments/commentRss/944488.htmlhttp://www.cnblogs.com/YellowWee/services/trackbacks/944488.htmlhttp://www.yellowwee.com.cn/post/2007/10/%e7%94%9f%e6%88%90%e8%87%aa%e5%b7%b1%e7%ab%99%e7%82%b9%e7%9a%84SiteMap.aspx

SEO技术肯定很多人都听说过，SEO(Search Engine Optimization)直译成中文是“搜索引擎优化”。就是研究如何提高自己网站在搜索引擎中的排名。其中有一项就是在自己的站点加入SiteMap，让搜索引擎更好的理解你的网站，更容易的索引你的页面。

 

         SiteMap允许你“告诉”搜索引擎你网站页面的URLs。SiteMap其实就是一个XML文档，其中列出了你站点页面的URLs。下面就是一个SiteMap的例子：

<?xml version="1.0" encoding="UTF-8"?>
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">    
   <url>     
       <loc>http://www.example.com/</loc>     
       <lastmod>2005-01-01</lastmod>     
       <changefreq>monthly</changefreq>     
       <priority>0.8</priority>
   </url> 
   <url>     
      <loc>http://www.example.com/catalog?item=12&amp;desc=vacation_hawaii</loc>   
      <changefreq>weekly</changefreq>  
    </url>  
 </urlset>

是不是看见这么长一串的XML就放晕啊？<loc><changefreq>这些都是什么意思？

还好Google为我们提供了一个SiteMap生成器(SiteMap Generator)，你可以到http://www.sourceforge.net/project/showfiles.php?group_id=137793&package_id=153422 这里下载。

如果你不喜欢Google，这里还有第三方提供的SiteMap 生成器。http://code.google.com/sm_thirdparty.html

 

如果你有兴趣理解研究SiteMap协议，可以到https://www.google.com/webmasters/tools/docs/en/protocol.html 了解。

 

下面来说一下如果要使用Google 的SiteMap生成器，需要什么前期准备：

 

1.         首先你必须有在Web服务器上运行脚本的权限。（如果你是使用虚拟主机，那么可以在本地的测试环境下运行生成SiteMap，并替换其中的连接为你的虚拟主机地址）

2.         由于Google 的生成器是用Python写成，要运行它你必须要装有Python 2.2或后续版本。（从这里下载http://www.python.org/download）

3.         当然生成SiteMap后你要能把它放到你的服务器或虚拟主机上。

 

如何生成SiteMap：

 

1.         下载Google SiteMap生成器：http://www.sourceforge.net/project/showfiles.php?group_id=137793&package_id=153422

2.         创建配置文件

 

修改example_config.xml文件（包含在下载的压缩包中）中找到

<site base_url="http://www.example.com/" store_into="/var/www/docroot/sitemap.xml.gz"verbose="1"> 

修改base_url为你自己的Url

修改store_into为你存放SiteMap的地址

 

修改后我的是：

<site base_url="http://www.yellowwee.com.com.cn/" store_into="sitemap.xml"verbose="1"> 

             根据example_config.xml的说明设置配置文件的剩余部分。

3.         上传脚本到服务器：需要上传config.xml、sitemap_gen.py到你的web服务器

4.         运行生成脚本sitemap_gen.py生成SiteMap

 python sitemap_gen.py --config=<path/config.xml>  

把生成的SiteMap提交给Google，Google就会根据你的SiteMap索引你的站点，这样你的站点出现在Google搜索结果中的几率就会大大增加喽。（因为很多网站是页面动态生成，虽然Google会索引动态页面，但如果索引时遇到错误，就会跳过索引。提交SitaMap后Goolge就知道如何索引你的站点，减少因出错没有索引到的几率）

 

提交SiteMap到Google，请到“Google 网站管理员工具”。“Google 网站管理员工具”里还有Google为站长准备的一些工具，有兴趣的可以自己看看。



[新闻]福布斯:中国经济增长减速 网游行业从中获益
博客园首页 社区 新闻频道 小组 博问 网摘 闪存]]>开通新博客，欢迎大家访问：http://www.yellowwee.com.cnhttp://www.cnblogs.com/YellowWee/archive/2007/10/31/944484.htmlYellowWee(端木柒)YellowWee(端木柒)Wed, 31 Oct 2007 08:14:00 GMThttp://www.cnblogs.com/YellowWee/archive/2007/10/31/944484.htmlhttp://www.cnblogs.com/YellowWee/comments/944484.htmlhttp://www.cnblogs.com/YellowWee/archive/2007/10/31/944484.html#Feedback0http://www.cnblogs.com/YellowWee/comments/commentRss/944484.htmlhttp://www.cnblogs.com/YellowWee/services/trackbacks/944484.html请大家到我的新博客看看～

http://www.yellowwee.com.cn

[新闻]福布斯:中国经济增长减速 网游行业从中获益
博客园首页 社区 新闻频道 小组 博问 网摘 闪存]]>[转载]Fix Your Site With the Right DOCTYPEhttp://www.cnblogs.com/YellowWee/archive/2007/09/24/904239.htmlYellowWee(端木柒)YellowWee(端木柒)Mon, 24 Sep 2007 07:18:00 GMThttp://www.cnblogs.com/YellowWee/archive/2007/09/24/904239.htmlhttp://www.cnblogs.com/YellowWee/comments/904239.htmlhttp://www.cnblogs.com/YellowWee/archive/2007/09/24/904239.html#Feedback0http://www.cnblogs.com/YellowWee/comments/commentRss/904239.htmlhttp://www.cnblogs.com/YellowWee/services/trackbacks/904239.htmlFix Your Site With the Right DOCTYPE!

by Jeffrey Zeldman

You’ve done all the right stuff, but your site doesn’t look or work as it should in the latest browsers.

You’ve written valid XHTML and CSS. You’ve used the W3C standard Document Object Model (DOM) to manipulate dynamic page elements. Yet, in browsers designed to support these very standards, your site is failing. A faulty DOCTYPE is likely to blame.

This little article will provide you with DOCTYPEs that work, and explain the practical, real–world effect of these seemingly abstract tags.

WHY A DOCTYPE?

Per HTML and XHTML standards, a DOCTYPE (short for “document type declaration”) informs the validator which version of (X)HTML you’re using, and must appear at the very top of every web page. DOCTYPEs are a key component of compliant web pages: your markup and CSS won’t validate without them.

As mentioned in previous ALA articles (and in other interesting places), DOCTYPES are also essential to the proper rendering and functioning of web documents in compliant browsers like Mozilla, IE5/Mac, and IE6/Win.

A recent DOCTYPE that includes a full URI (a complete web address) tells these browsers to render your page in standards–compliant mode, treating your (X)HTML, CSS, and DOM as you expect them to be treated.

Using an incomplete or outdated DOCTYPE—or no DOCTYPE at all—throws these same browsers into “Quirks” mode, where the browser assumes you’ve written old-fashioned, invalid markup and code per the depressing industry norms of the late 1990s.

In this setting, the browser will attempt to parse your page in backward–compatible fashion, rendering your CSS as it might have looked in IE4, and reverting to a proprietary, browser–specific DOM. (IE reverts to the IE DOM; Mozilla and Netscape 6 revert to who knows what.)

Clearly, this is not what you want. But it is often what you’ll get, due to the preponderance of incorrect or incomplete DOCTYPE information this article hopes to correct.

(Note: The Opera browser does not play by these rules; it always attempts to render pages in standards–compliant mode. Go, Opera! On the other hand, Opera does not yet offer solid support for the W3C DOM. But they’re working on it.) {Ed: Since this article was first published, Opera has delivered the DOM-compliant Opera 7 browser.}

WHERE HAVE ALL THE DOCTYPES GONE?

Since DOCTYPES are vital to the proper functioning of web standards in browsers, and since W3C is a leading creator of web standards, you might expect W3C’s website to provide a listing of proper DOCTYPEs, and you might also expect to be able to find this information quickly and easily in a single location. But as of this writing, you can’t. {Ed. Prompted in part by this article, the W3C now lists standard DOCTYPEs on its site. You will find the listing a few screens into the W3C tutorial, “My Web site is standard. And yours?”}

W3.org is not A List Apart, WebReference, or Webmonkey. It’s not intended to help web designers, developers, and content folks get up to speed on the latest technological recommendations and practices. That’s not its job.

W3C does publish a series of tutorials, though most web developers are unaware of it. Mainly, though, W3C’s site houses a collection of proposals, drafts, and Recommendations, written by geeks for geeks. And when I say geeks, I don’t mean ordinary web professionals like you and me. I mean geeks who make the rest of us look like Grandma on the first day She’s Got Mail.™

You can search for DOCTYPEs all day at w3.org without finding one page that lists them all. And when you do hunt down a DOCTYPE (generally in relation to a particular Recommendation or Working Draft), it’s often one that won’t work on your site.

Scattered throughout W3C’s site are DOCTYPEs with missing URIs, and DOCTYPEs with relative URIs that point to documents on W3C’s own site. Once removed from W3C’s site and used on your web pages, these URIs point to non–existent documents, thus fouling up your best efforts and the browser’s.

For instance, many sites sport this DOCTYPE, copied and pasted directly from w3.org:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"DTD/xhtml1-strict.dtd">

If you look at the last part of the DOCTYPE (“DTD/xhtml1-strict.dtd”), you’ll see that it is a relative link to a document on W3C’s site. Since that document is on W3C’s site but not yours, the URI is useless to the browser.

The DOCTYPE you’d actually want to use is:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

Notice that the latter DOCTYPE includes a complete URI at the end of the tag. Since the tag provides a valid location on the web, the browser knows where to find it, and will render your document in standards–compliant mode.

DOCTYPES THAT WORK

So what DOCTYPEs should we use? Glad you asked. The following complete DOCTYPEs are the ones we need:

HTML 4.01 Strict, Transitional, Frameset

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
"http://www.w3.org/TR/html4/strict.dtd">
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Frameset//EN"
"http://www.w3.org/TR/html4/frameset.dtd">

XHTML 1.0 Strict, Transitional, Frameset

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Frameset//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-frameset.dtd">

XHTML 1.1 DTD

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">

NEXT STEPS

How can you help improve support for standards on the web? Besides bookmarking this page (and copying and pasting these DOCTYPEs for your own use), if your web editor inserts DOCTYPEs, you might want to check them out and compare them to the list above.

Many well–intentioned software makers have cut and pasted incomplete DOCTYPEs from W3C into their software. Result: when you use these programs’ built–in functionality to insert DOCTYPEs in your pages, the browsers go into Quirks mode, undoing all your hard work.

It’s worth contacting the folks who make your favorite authoring package, showing them the proper DOCTYPEs, and politely requesting them to address this issue in an incremental upgrade. (In some cases, you may also be able to modify your editor yourself.)

COMING SOON

We have every reason to believe that W3C’s site will soon sport a handy listing of accurate, usable DOCTYPES and other essential information in an easy–to–find location. In fact, Karl Dubost, Conformance Manager of W3C’s Quality Assurance team, contributed to the information in this little article.

Likewise, when The Web Standards Project relaunches (real soon), it will also provide this information. {Ed. note: The Web Standards Project relaunched in late 2002.}

But sites are being designed and built every day, and you need this information now—so there it is.

Happy authoring and rendering!

Translations
Italian (gdesign.it)
Bulgarian (Groove Manifesto)
French (Pompage.net)
German (Puredesign.ch)
Spanish (gen7es.net)
Russian (Webmascon.com)

Learn More

Related Topics: CSS, HTML and XHTML, Layout, XML


转自 http://www.alistapart.com/articles/doctype



[新闻]苹果正调查MacBook笔记本“黑屏死机”故障
博客园首页 社区 新闻频道 小组 博问 网摘 闪存]]>Java Top Bookshttp://www.cnblogs.com/YellowWee/archive/2007/09/19/898718.htmlYellowWee(端木柒)YellowWee(端木柒)Wed, 19 Sep 2007 08:45:00 GMThttp://www.cnblogs.com/YellowWee/archive/2007/09/19/898718.htmlhttp://www.cnblogs.com/YellowWee/comments/898718.htmlhttp://www.cnblogs.com/YellowWee/archive/2007/09/19/898718.html#Feedback0http://www.cnblogs.com/YellowWee/comments/commentRss/898718.htmlhttp://www.cnblogs.com/YellowWee/services/trackbacks/898718.html

.

Votes
27

Avg Pos
1.93

Effective Java Programming Language Guide

By Joshua Bloch

Addison-Wesley Professional

Paperback, 252 pages

List Price: $44.99 - Amazon: CAFRDEUKJPUS

2.

Votes
17

Avg Pos
3.06

Design Patterns: Elements of Reusable Object-Oriented Software

By Erich Gamma; Richard Helm; Ralph Johnson; John Vlissides

Addison-Wesley Professional

Hardcover, 395 pages

List Price: $54.99 - Amazon: CAFRDEUKJPUS

3.

Votes
12

Avg Pos
3.83

Refactoring: Improving the Design of Existing Code

By Martin Fowler; Kent Beck; John Brant; William Opdyke; Don Roberts

Addison-Wesley Professional

Hardcover, 464 pages

List Price: $59.99 - Amazon: CAFRDEUKJPUS

4.

Votes
10

Avg Pos
3

Head First Design Patterns

By Elisabeth Freeman; Eric Freeman; Bert Bates; Kathy Sierra

O'Reilly Media, Inc.

Paperback, 676 pages

List Price: $44.95 - Amazon: CAFRDEUKJPUS

5.

Votes
10

Avg Pos
3.5

Expert One-on-One J2EE Design and Development

By Rod Johnson

Wrox

Paperback, 768 pages

List Price: $59.99 - Amazon: CAFRDEUKJPUS

6.

Votes
9

Avg Pos
2

Thinking in Java (4th Edition)

By Bruce Eckel

Prentice Hall PTR

Paperback, 1520 pages

List Price: $59.99 - Amazon: CAFRDEUKJPUS

7.

Votes
9

Avg Pos
3.11

Code Complete (2nd Edition)

By Steve McConnell

Microsoft Press

Paperback, 960 pages

List Price: $49.99 - Amazon: CAFRDEUKJPUS

8.

Votes
8

Avg Pos
2.25

Head First Java (2nd Edition)

By Kathy Sierra; Bert Bates

O'Reilly Media, Inc.

Paperback, 720 pages

List Price: $44.95 - Amazon: CAFRDEUKJPUS

9.

Votes
8

Avg Pos
4.63

The Pragmatic Programmer: From Journeyman to Master

By Andrew Hunt; David Thomas

Addison-Wesley Professional

Paperback, 352 pages

List Price: $42.99 - Amazon: CAFRDEUKJPUS

10.

Votes
8

Avg Pos
5.25

Applying UML and Patterns

By Craig Larman

Prentice Hall PTR

Hardcover, 736 pages

List Price: $59.99 - Amazon: CAFRDEUKJPUS

11.

Votes
7

Avg Pos
2.71

Core Java 2, Volume I--Fundamentals (7th Edition)

By Cay Horstmann; Gary Cornell

Prentice Hall PTR

Paperback, 784 pages

List Price: $49.99 - Amazon: CAFRDEUKJPUS

12.

Votes
7

Avg Pos
3.71

Core Java 2, Volume II--Advanced Features (7th Edition)

By Cay Horstmann; Gary Cornell

Prentice Hall PTR

Paperback, 1024 pages

List Price: $49.99 - Amazon: CAFRDEUKJPUS

13.

Votes
7

Avg Pos
4.57

Patterns of Enterprise Application Architecture

By Martin Fowler

Addison-Wesley Professional

Hardcover, 560 pages

List Price: $54.99 - Amazon: CAFRDEUKJPUS

14.

Votes
6

Avg Pos
4.33

Core J2EE Patterns: Best Practices and Design Strategies

By Deepak Alur; John Crupi; Dan Malks

Pearson Education

Paperback, 496 pages

List Price: $44.99 - Amazon: CAFRDEUKJPUS

15.

Votes
6

Avg Pos
4.83

Concurrent Programming in Java: Design Principles and Pattern (2nd Edition)

By Doug Lea

Addison-Wesley Professional

Paperback, 432 pages

List Price: $54.99 - Amazon: CAFRDEUKJPUS

16.

Votes
4

Avg Pos
3.75

Agile Software Development, Principles, Patterns, and Practices

By Robert C. Martin

Prentice Hall

Hardcover, 552 pages

List Price: $63 - Amazon: CAFRDEUKJPUS

17.

Votes
4

Avg Pos
4.75

UML Distilled: A Brief Guide to the Standard Object Modeling Language (3rd Edition)

By Martin Fowler

Addison-Wesley Professional

Paperback, 192 pages

List Price: $34.99 - Amazon: CAFRDEUKJPUS

18.

Votes
4

Avg Pos
5.5

The Mythical Man-Month: Essays on Software Engineering, 20th Anniversary Edition

By Frederick P. Brooks

Addison-Wesley Professional

Paperback, 322 pages

List Price: $34.99 - Amazon: CAFRDEUKJPUS

19.

Votes
4

Avg Pos
6

Domain-Driven Design: Tackling Complexity in the Heart of Software

By Eric Evans

Addison-Wesley Professional

Hardcover, 576 pages

List Price: $54.99 - Amazon: CAFRDEUKJPUS

20.

Votes
3

Avg Pos
2.33

Java Puzzlers

By Joshua Bloch; Neal Gafter

Addison-Wesley Professional

Paperback, 304 pages

List Price: $39.99 - Amazon: CAFRDEUKJPUS



显示全部（http://www.javalobby.org/articles/5books/full.jsp）

[新闻]007最牛电脑探秘：应用界面来自中国(组图)
博客园首页 社区 新闻频道 小组 博问 网摘 闪存]]>自定义DataContext类http://www.cnblogs.com/YellowWee/archive/2007/09/04/881068.htmlYellowWee(端木柒)YellowWee(端木柒)Tue, 04 Sep 2007 01:48:00 GMThttp://www.cnblogs.com/YellowWee/archive/2007/09/04/881068.htmlhttp://www.cnblogs.com/YellowWee/comments/881068.htmlhttp://www.cnblogs.com/YellowWee/archive/2007/09/04/881068.html#Feedback0http://www.cnblogs.com/YellowWee/comments/commentRss/881068.htmlhttp://www.cnblogs.com/YellowWee/services/trackbacks/881068.html阅读全文

[新闻]新浪网遭攻击瘫痪500分钟 被迫答应黑客要求
博客园首页 社区 新闻频道 小组 博问 网摘 闪存]]>[转载]Encrypting Configuration Information in ASP.NET 2.0 Applicationshttp://www.cnblogs.com/YellowWee/archive/2007/09/03/880662.htmlYellowWee(端木柒)YellowWee(端木柒)Mon, 03 Sep 2007 13:02:00 GMThttp://www.cnblogs.com/YellowWee/archive/2007/09/03/880662.htmlhttp://www.cnblogs.com/YellowWee/comments/880662.htmlhttp://www.cnblogs.com/YellowWee/archive/2007/09/03/880662.html#Feedback0http://www.cnblogs.com/YellowWee/comments/commentRss/880662.htmlhttp://www.cnblogs.com/YellowWee/services/trackbacks/880662.htmlEncrypting Configuration Information in ASP.NET 2.0 Applications
By Scott Mitchell

Introduction
When creating ASP.NET 2.0 applications, developers commonly store sensitive configuration information in the Web.config file. The cannonical example is database connection strings, but other sensitive information included in the Web.config file can include SMTP server connection information and user credentials, among others. While ASP.NET is configured, by default, to reject all HTTP requests to resources with the .config extension, the sensitive information in Web.config can be compromised if a hacker obtains access to your web server's file system. For example, perhaps you forgot to disallow anonymous FTP access to your website, thereby allowing a hacker to simply FTP in and download your Web.config file. Eep.

Fortunately ASP.NET 2.0 helps mitigate this problem by allowing selective portions of the Web.config file to be encrypted, such as the <connectionStrings> section, or some custom config section used by your application. Configuration sections can be easily encrypted using code or aspnet_regiis.exe, a command-line program. Once encrypted, the Web.config settings are safe from prying eyes. Furthermore, when retrieving encrypted congifuration settings programmatically in your ASP.NET pages, ASP.NET will automatically decrypt the encrypted sections its reading. In short, once the configuration information in encrypted, you don't need to write any further code or take any further action to use that encrypted data in your application.

In this article we'll see how to programmatically encrypt and decrypt portions of the configuration settings and look at using the aspnet_regiis.exe command-line program. We'll then evaluate the encryption options ASP.NET 2.0 offers. There's also a short discussion on how to encrypt configuration information in ASP.NET version 1.x. Read on to learn more!

 

Things to Keep in Mind...
Before we get started exploring how to encrypt configuration information in ASP.NET 2.0, keep the following things in the back of your mind:

  1. All forms of encryption involve some sort of secret that is used when encrypting and decrypting the data. Symmetric encryption algorithm use the same secret key in both encrypting and decrypting a message, whereas asymmetric encryption algorithms use different keys for encrypting and decrypting. Regardless of the technique being used, the encryption scheme is only as safe as the secret key for decrypting.
  2. The configuration encryption capabilities in ASP.NET 2.0 are designed to foil a hacker who somehow is able to retrieve your configuration files. The idea is that if the hacker has your Web.config file on his computer, she can't de-scramble the encrypted sections. However, when an ASP.NET page on the web server requests information from an encrypted configuration file, the data must be decrypted to be used (and this happens without you needing to write any code). Therefore, if a hacker is able to upload an ASP.NET web page to your system that queries the configuration file and displays its results, she can view the encrypted settings in plain-text. (There's an example ASP.NET page that can be downloaded at the end of this article that illustrates encrypting and decrypting various sections of the Web.config file; as you'll see, an ASP.NET page can access (and display) the plain-text version of the encrypted data.)
  3. Encrypting and decrypting configuration sections carries a performance cost. Therefore, only encrypt the configuration sections that contain sensitive information. There's likely no need to encrypt, say, the <compilation> or <authorization> configuration sections.
That being said, let's get started!

What Information Can Be Encrypted
Before we examine how to encrypt configuration information in ASP.NET 2.0, let's first look at what configuration information, exactly, can be encrypted. The .NET Framework 2.0 libraries include the capabilities to encrypt most any configuration sections within the Web.config or machine.config files. Configuration sections are those XML elements that are children of the <configuration> or <system.web> elements. For example, the sample Web.config below has three configuration settings explicitly defined: <connectionStrings>, <compilation>, and <authentication>.

<?xml version="1.0"?>
<configuration xmlns="http://schemas.microsoft.com/.NetConfiguration/v2.0">
   <connectionStrings>
      <add name="MembershipConnectionString" connectionString="connectionString"/>
   </connectionStrings>

   <system.web>
      <compilation debug="true"/>

      <authentication mode="Forms" />
   </system.web>
</configuration>

Each of these sections can optionally be encrypted, either programmatically or through aspnet_regiis.exe, a command-line tool. When encrypted, the scrambled text is stored directly in the configuration file. For example, if we were to encrypt the <connectionStrings> section above the resulting Web.config file might look like the following: (Note: a large chunk of the <CipherValue> has been removed for brevity.)

<?xml version="1.0"?>
<configuration xmlns="http://schemas.microsoft.com/.NetConfiguration/v2.0">

   <connectionStrings configProtectionProvider="DataProtectionConfigurationProvider">
      <EncryptedData>
         <CipherData>
            <CipherValue>AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAed...GicAlQ==</CipherValue>
         </CipherData>
      </EncryptedData>
   </connectionStrings>

   <system.web>
      <compilation debug="true"/>

      <authentication mode="Forms" />
   </system.web>
</configuration>

There are some configuration sections that you cannot encrypt using this technique:

  • <processModel>
  • <runtime>
  • <mscorlib>
  • <startup>
  • <system.runtime.remoting>
  • <configProtectedData>
  • <satelliteassemblies>
  • <cryptographySettings>
  • <cryptoNameMapping>
  • <cryptoClasses>
In order to encrypt these configuration sections you must encrypt the value and store it in the registry. There's an aspnet_setreg.exe command-line tool to help along with this process; this tool is discussed later in this article in the "Encrypting Configuration Settings in ASP.NET Version 1.x" note.

The Differences Between Web.Config and Machine.Config
Web.config files specify configuration settings for a particular web application, and are located in the application's root directory; the machine.config file specifies configuration settings for all of the websites on the web server, and is located in $WINDOWSDIR$\Microsoft.Net\Framework\Version\CONFIG.

Encryption Options
Protecting configuration sections in ASP.NET 2.0 uses the provider model, which allows for any implementation to be seamlessly plugged into the API. The .NET Framework 2.0 ships with two built-in providers for protecting configuration sections:

  • The Windows Data Protection API (DPAPI) Provider (DataProtectionConfigurationProvider) - this provider uses the built-in cryptography capabilities of Windows to encrypt and decrypt the configuration sections. By default this provider uses the machine's key. You can also use user keys, but that requires a bit more customization. Refer to How To: Encrypt Configuration Sections in ASP.NET 2.0 Using DPAPI for more information on this process. Since the keys are machine- or user- specific, the DPAPI provider does not work in settings where you wan to deploy the same encrypted configuration file to multiple servers.
  • RSA Protected Configuration Provider (RSAProtectedConfigurationProvider) - uses RSA public key encryption to encrypt/decrypt the configuration sections. With this provider you need to create key containers that hold the public and private keys used for encrypting and decrypting the configuration information. Refer to How To: Encrypt Configuration Sections in ASP.NET 2.0 Using RSA for more information. You can use RSA in a multi-server scenario by creating exportable key containers.
You can also create your own protected settings providers, if needed.

In this article we'll only explore using the DPAPI provider using machine-level keys. This is, by far, the simplest approach since it doesn't require creating any keys or key containers, or ensuring access and permission rights to user-level keys. Of course, it has the downside that an encrypted configuration file can only be used on the web server that performed the encryption in the first place; furthermore, using the machine key would allow the encrypted text to be decrytable by any website on the web server.

Programmatically Encrypting Configuration Sections
The System.Configuration.SectionInformation class abstractly represents a configuration section. To encrypt a configuration section simply use the SectionInformation class's ProtectSection(provider) method, passing in the name of the provider you want to use to perform the encryption. To access a particular configuration section in your application's Web.config file, use the WebConfigurationManager class (in the System.Web.Configuration namespace) to reference your Web.config file, and then use its GetSection(sectionName) method to return a ConfigurationSection instance. Finally, you can get to a SectionInformation object via the ConfigurationSection instance's SectionInformation property.

This jumble of words should be made clearer by a simple code example (which I'm taking directly from David Hayden's blog entry Encrypt Connection Strings AppSettings and Web.Config in ASP.NET 2.0 - Security Best Practices: 

private void ProtectSection(string sectionName,
            string provider)
            {
            Configuration config =
            WebConfigurationManager.
            OpenWebConfiguration(Request.ApplicationPath);
            ConfigurationSection section =
            config.GetSection(sectionName);
            if (section != null &&
            !section.SectionInformation.IsProtected)
            {
            section.SectionInformation.ProtectSection(provider);
            config.Save();
            }
            }
            private void UnProtectSection(string sectionName)
            {
            Configuration config =
            WebConfigurationManager.
            OpenWebConfiguration(Request.ApplicationPath);
            ConfigurationSection section =
            config.GetSection(sectionName);
            if (section != null &&
            section.SectionInformation.IsProtected)
            {
            section.SectionInformation.UnprotectSection();
            config.Save();
            }
            }

This method David has created - ProtectSection(sectionName, provider) - can be called from an ASP.NET page, passing in a section name (like connectionStrings) and a provider (like DataProtectionConfigurationProvider), and it opens the Web.config file, references the section, invokes the ProtectSection(provider) method of the SectionInformation object, and saves the configuration changes.

The UnProtectSection(provider) method decrypts a particular configuration section. Here only the section to decrypt needs to be passed in - we don't need to bother with the provider because that information is stored in the markup accompanying the encrypted section (i.e., in the above example, the <connectionStrings> section, after being encrypted, included the provider: <connectionStrings configProtectionProvider="DataProtectionConfigurationProvider">).

And.................... You're Done!
Keep in mind that once the data is encrypted, when it's read from an ASP.NET page (i.e., reading the connection string information from a SqlDataSource control or programmatically, via ConfigurationManager.ConnectionStrings[connStringName].ConnectionString), ASP.NET automatically decrypts the connection string and returns the plain-text value. In other words, you don't need to change your code one iota after implementing encryption. Pretty cool!

At the end of this article you'll find an ASP.NET 2.0 website download that has a page that shows the site's Web.config file in a multi-line TextBox, with Button Web controls for encrypting various portions of the configuration file. That example illustrates using both the ProtectSection() and UnProtectSection() methods shown above.

Using the aspnet_regiis.exe Command-Line Tool
You can also encrypt and decrypt sections in the Web.config file using the aspnet_regiis.exe command-line tool, which can be found in the %WINDOWSDIR%\Microsoft.Net\Framework\version directory. To encrypt a section of the Web.config using the DPAPI machine key with this command-line tool, use:

-- Generic form for encrypting the Web.config file for a particular website...
aspnet_regiis.exe -pef section physical_directory –prov provider
   -- or --
aspnet_regiis.exe -pe section -app virtual_directory –prov provider


-- Concrete example of encrypting the Web.config file for a particular website...
aspnet_regiis.exe -pef "connectionStrings" "C:\Inetpub\wwwroot\MySite" –prov "DataProtectionConfigurationProvider"
   -- or --
aspnet_regiis.exe -pe "connectionStrings" -app "/MySite" –prov "DataProtectionConfigurationProvider"



-- Generic form for decrypting the Web.config file for a particular website...
aspnet_regiis.exe -pdf section physical_directory
   -- or --
aspnet_regiis.exe -pd section -app virtual_directory


-- Concrete example of decrypting the Web.config file for a particular website...
aspnet_regiis.exe -pdf "connectionStrings" "C:\Inetpub\wwwroot\MySite"
   -- or --
aspnet_regiis.exe -pd "connectionStrings" -app "/MySite"

You can also specify that aspnet_regiis.exe should perform encryption/decryption on the machine.config file instead. See the technical documentation for the ASP.NET IIS Registration Tool (Aspnet_regiis.exe) for more information on the available command-line switches.

Encrypting Configuration Settings in ASP.NET Version 1.x
In order to protect configuration settings in ASP.NET version 1.x, developers needed to encrypt and store the sensitive settings in the web server's registry, storing it in a "strong" key. Rather than storing the encrypted content in the configuration file, as in ASP.NET, the configuration file would contain a reference to the registry key holding the encrypted value, a la:

<identity impersonate="true"
          userName="registry:HKLM\SOFTWARE\MY_SECURE_APP\identity\ASPNET_SETREG,userName"
          password="registry:HKLM\SOFTWARE\MY_SECURE_APP\identity\ASPNET_SETREG,password" />

Microsoft made available the aspnet_setreg.exe command-line tool for encrypting the contents of sensitive configuration information and moving it to a "strong" registry entry. Unfortunately this tool only works on specific configuration settings, whereas ASP.NET 2.0 allows encrypting any configuration section.

For more information on using aspnet_setreg.exe in an ASP.NET 1.x application, see KB #32990 (How to use the ASP.NET utility to encrypt credentials and session state connection strings). Unfortunately, this command-line program only encrypts predefined sections of the configuration settings, and does not allow you to encrypt your own added database connection strings and other sensitive information.

In order to encrypt your own content you can use a couple of techniques. The different options are described in Keith Brown's The .NET Developer's Guide to Windows Security Wiki page on How To Store Secrets On A Machine. For a look at implementing the registry approach, which is what the aspnet_setreg.exe command-line tool does for the predefined configuration sections, refer to: How To: Store an Encrypted Connection String in the Registry.

Conclusion
In this article we saw different encryption options ASP.NET 2.0 provides for protecting configuration sections, as well as how to encrypt sections of the Web.config using both programmatic techniques and aspnet_regiis.exe, a command-line tool. Protecting your sensitive configuration settings can help ensure that your site is more hardened against nefarious hackers by making it more difficult to discover the sensitive configuration settings. And with the ease of encrypting and decrypting this information in ASP.NET 2.0, there's really no excuse not to protect your sensitive configuration settings in this manner.

Happy Programming!

  • By Scott Mitchell

    • 转自:

    Encrypting Configuration Information in ASP.NET 2.0 Applications

    [新闻]联发科称“死机短信”不会伤害手机硬件
    博客园首页 社区 新闻频道 小组 博问 网摘 闪存]]>    安装 Sql Server Query Visualizerhttp://www.cnblogs.com/YellowWee/archive/2007/08/30/876044.htmlYellowWee(端木柒)YellowWee(端木柒)Thu, 30 Aug 2007 08:48:00 GMThttp://www.cnblogs.com/YellowWee/archive/2007/08/30/876044.htmlhttp://www.cnblogs.com/YellowWee/comments/876044.htmlhttp://www.cnblogs.com/YellowWee/archive/2007/08/30/876044.html#Feedback0http://www.cnblogs.com/YellowWee/comments/commentRss/876044.htmlhttp://www.cnblogs.com/YellowWee/services/trackbacks/876044.html 

    1. 编译 VS2008 Beta2 安装目录下（我的是"D:\Program Files\Microsoft Visual Studio 9.0\Samples\1033\CSharpSamples.zip\LinqSamples\QueryVisualizer" ）的 QueryVisualizer 项目。
    2. 关闭所有运行的 Vs2008。
    3. 把编译好的 SqlServerQueryVisualizer.dll 拷贝到 "Program Files\Microsoft Visual Studio 9.0\Common7\Packages\Debugger\Visualizers\" 目录下。
    4. 启动VS2008，debug，就可以看到传说中的"放大镜(Magnify Glass)"了。

    安装之前：



    安装之后：




    [新闻]金融危机引爆Web2.0变革：社区网站价值被高估
    博客园首页 社区 新闻频道 小组 博问 网摘 闪存]]>    生活的五项调整http://www.cnblogs.com/YellowWee/archive/2007/08/22/865955.htmlYellowWee(端木柒)YellowWee(端木柒)Wed, 22 Aug 2007 12:23:00 GMThttp://www.cnblogs.com/YellowWee/archive/2007/08/22/865955.htmlhttp://www.cnblogs.com/YellowWee/comments/865955.htmlhttp://www.cnblogs.com/YellowWee/archive/2007/08/22/865955.html#Feedback0http://www.cnblogs.com/YellowWee/comments/commentRss/865955.htmlhttp://www.cnblogs.com/YellowWee/services/trackbacks/865955.html        身体使用手册(You:The Owner's Manual) 中概括了5项调整，使自己的寿命和生活质量发生翻天覆地的变化，仅仅5项。它们是：

        1. 控制血压
        2. 戒烟
        3. 每天运动30分钟
        4. 控制精神压力
        5. 坚持简单易行的健康饮食习惯

             如果能做到这5项调整，在今后10年里，你的病亡或病残的几率只有你同龄人的1/10。




    [新闻]MySpace称目前是收购创业公司良机
    博客园首页 社区 新闻频道 小组 博问 网摘 闪存]]>    C# 中的扩展方法---Extension methods in C#http://www.cnblogs.com/YellowWee/archive/2007/08/21/863727.htmlYellowWee(端木柒)YellowWee(端木柒)Tue, 21 Aug 2007 03:16:00 GMThttp://www.cnblogs.com/YellowWee/archive/2007/08/21/863727.htmlhttp://www.cnblogs.com/YellowWee/comments/863727.htmlhttp://www.cnblogs.com/YellowWee/archive/2007/08/21/863727.html#Feedback0http://www.cnblogs.com/YellowWee/comments/commentRss/863727.htmlhttp://www.cnblogs.com/YellowWee/services/trackbacks/863727.html阅读全文

    [新闻]诺基亚推出触摸屏手机N97
    博客园首页 社区 新闻频道 小组 博问 网摘 闪存]]>