Unable to change WS Policy Store to “App Server Connection” in JDeveloper

Today when trying different settings with Basic Authentication and SOA Suite, I wanted to from the embedded OWSM Policy Repository of JDeveloper to the one stored on the application server. In JDeveloper you can do that through preferences (Tools | Preferences). See this blog for more details.

Click on the App Server Connection option and choose an existing connection through the Connections drop-down or add a new one by clicking New.



Unfortunately (more...)

The Age of Transparency

It seems that Boing just lost a 4 billion dollar deal to supply fighter jets to Brazil, because the Brazilians were miffed that the NSA spied on them.

You also live in a transparent world. If the NSA was unable to weed out Edward Snowdon in their hiring procedure, do (more...)

Finally connected the dots …

My son (10) has been asking about VPNs a lot lately. Which I thought was because of all of the news lately about the NSA. I ended up showing him tunnel bear, which he quickly installed on his laptop and iPhone. I complimented my son for his interest in security (more...)

My vJUG Session: Don’t Be That Guy! Developer Security Awareness

I've been invited to talk at the vJUG which is the newest JUG around. A virtual JUG reaching out to interested Java Developers over all time zones and locations. The  aim is to get the greatest minds and speakers of the Java industry giving talks and presentations for this community, (more...)

Control Your Information

It appears that international credit bureau company Experian was inadvertently selling private information to online criminals posing as “private investigators”. These criminals then used Social Security numbers, birthdays and drivers license records to commit identify theft. Ironically, Experian is also selling protection against identity theft to private customers…

Do you know (more...)

Oracle Forms and Java 7u51

Java 7u51 is scheduled for release in January. It will have some consequences for you Forms installation that you need to address.

As far as I know there is no problems with using 7u51 on the server side, only on the client side.


WebLogic Server and entropy

After input from Jacco H. Landlust and Edwin Biemond I have rewritten my post about entropy.


Entropy pool

In computing you often need random numbers. They are used for encrypting stuff but (more...)

A System for Oracle Users and Privileges with Automatic Expiry Dates

Tired of tracking down all the users in the database to deactivate them when they cease to exist, or change roles, or fulfill their temporary need to the database? Or, tracking down privileges you granted to existing users at the end of their requested period? The solution is to think (more...)


Sercurity ist ein Thema, dem mit dem ich mich nicht unbedingt besonders gerne und besonders häufig beschäftige, aber auf einen Verweis auf den Artikel Fix for oradebug disable auditing available ( von Alexander Kornbrust kann ich nicht verzichten, da dort der (more...)

Last Successful Login Time in SQL*Plus in Oracle 12c

If you have been working with Oracle 12c, you may have missed a little something that appeared without mush fanfare but has some powerful implications. Let's see it with a small example--connecting with SQL*Plus.

C:\> sqlplus arup/arup

SQL*Plus: Release Production on Mon Aug 19 14:17:45 (more...)

Fix for oradebug disable auditing available (

2 days ago I gave a presentation “Oracle 12c from the attackers perspective” at the DOAG SIG Security. I learned some interesting things, especially that a fix for the Oracle oradebug “disable auditing” problem is available since 9 months.

Oradebug allows to run OS commands and to enable/disable Oracle SYSDBA (more...)

Tightening Security with SELECT ANY DICTIONARY in Oracle 12c

Developers and users sometimes request the SELECT ANY DICTIONARY system privilege to enable them to view various data dictionary tables.  This may be fine for querying DBA_TABLES, etc, but the Oracle data dictionary contains a LOT of information.  Some of the views/tables are compromising from a security standpoint. (more...)

How One Man Killed the Cloud

While I was not surprised that the U.S. intelligence agencies monitor web activity, I was surprised at the scale revealed by the Edward Snowdon leaks.

If there are still American cloud providers that do not routinely provide the NSA with wholesale access to their customers’ data, it will only (more...)

Create a CA, issue server/client certificates and test them via Apache

Here is a quick way of creating your own CA and issue server and client certificates via OpenSSL.

I will test the certificates via the Apache HTTP Server by configuring one and two-way SSL.

I use Oracle Linux 5.

You should of cause only use this for test scenarios.

Install (more...)

BI Mobile Security Toolkit for

The Oracle Business Intelligence Mobile Security Toolkit for Apple iPad (iOS 5 & 6) is now available for download at http://goo.gl/Mq6rI

The Oracle BI Mobile Security Toolkit "provides the ability to generate a signed version of the Oracle BI Mobile HD application. The toolkit (more...)

Protect the Apache HTTP Server against CRIME SSL/TLS attacks

It is now possible to protect Apache on both Windows and Red Hat servers against CRIME SSL/TLS attacks.

I have updated my Hardening the Apache HTTP Server post accordingly.

Using the Apache HTTP Server as a forward proxy to the Internet

Often you do not want servers in your internal network segments to be able to access the Internet directly.
One way to get controlled access to the Internet is to place an Apache HTTP Server in a DMZ network segment. Internal servers can then use the Apache server as a (more...)

Rolling the Mega API with Ruby

(blogarhythm ~ Can you keep a secret? - 宇多田ヒカル)

Megar (“megaargh!” in pirate-speak) is a Ruby wrapper and command-line client for the Mega API.

In the current release (gem version 0.0.3), it has coverage of the basic file/folder operations: connect, get file/folder listings and details, upload and download files. You can use it directly in Ruby with what I hope you'll find is a very sane API, but it also sports a basic command-line mode for simple listing, upload and download tasks.

If you are interested in hacking around with Mega, and prefer to do it (more...)

SSL Server Certificates – Lessons learned

It is not difficult to create an SSL/TLS certificate and configure an Apache HTTP Server to use it. But I found that there are some things you need to know that does not necessarily make much sense. Here are some lessons learned and a couple of tips.

Intermediate and Root (more...)


These are some amazing statistics…