The &#39;standard&#39; location would be a .ssh directory in your $HOME. i.e.

    /Users/$USER/.ssh/

You should protect this directory with permissions 700. You can setup a config file to automatically use the .pem, and set the username when sshing to EC2 instances.

I want to have the exact distance between the Y-coordinate of an element an the Y-value=0, which I consider as the top of the document.

    myElement.getBoundingClientRect().top;

But the value of getBoundingClientRect() seems to change while scrolling. How can I get the real distance between myElement and the Y-coordinate=0 (top of document)?

JavaScript getBoundingClientRect() changes while scrolling

I&#39;ve got a database project as part of my solution in Visual Studio 2013. Been working perfectly for the last 3 weeks and now suddenly today it won&#39;t build and so I cannot publish any changes. I&#39;m getting an MSBuild error: 

&gt; &quot;C:\Program Files
&gt; (x86)\MSBuild\Microsoft\VisualStudio\v12.0\SSDT\Microsoft.Data.Tools.Schema.SqlTasks.targets(513,5):
&gt; Error:  MSB4018: The &quot;SqlBuildTask&quot; task failed unexpectedly.
&gt;     System.MethodAccessException: Attempt by method &#39;Microsoft.Data.Tools.Schema.Sql.Build.SqlTaskHost.OnCreateCustomSchemaData(System.String,
&gt; System.Collections.Generic.Dictionary`2&lt;System.String,System.String&gt;)&#39;
&gt; to access method
&gt; &#39;Microsoft.Data.Tools.Components.Diagnostics.SqlTracer.ShouldTrace(System.Diagnostics.TraceEventType)&#39;
&gt; failed.&quot;

Anyone got any ideas? All I did this morning was pull down the latest changes from source control. I can&#39;t see how that would mess up the actual `MSBuild` process, and the guy who checked in last doesn&#39;t have any issues at all. 


Visual Studio 2013: Database Project MSBuild error

Where should I keep this file for security? At the moment it is on my desktop - should I put it somewhere else?





where do I keep my amazon .pem file on a mac

<p>Where should I keep this file for security? At the moment it is on my desktop - should I put it somewhere else?</p>


How do I export a security certificate from Chrome v37 on a Mac?

Previously I could click on the little lock icon next to the URL, select &quot;Connection,&quot; select the certificate, and an &quot;Export&quot; button would appear.

Not so anymore!

How to Export Certificate from Chrome on a Mac?

We all know situations when you cannot go open source and freely distribute software - and I am in one of these situations.

I have an app that consists of a number of binaries (compiled from C sources) and python code that wraps it all into a system. This app used to work as a cloud solution so users had access to app functions via network but no chance to touch the actual server where binaries and code are stored.

Now we want to deliver the &quot;local&quot; version of our system. The app will be running on PCs that our users will physically own. We know that everything could be broken, but at least want to protect the app from possible copying and reverse-engineering as much as possible.

I know that docker is a wonderful deployment tool so I wonder: it is possible to create encrypted docker containers where no one can see any data stored in the container&#39;s filesystem? Is there a known solution to this problem?

Also, maybe there are well known solutions not based on docker?

Encrypted and secure docker containers

A recent vulnerability, [CVE-2014-6271][1], in how [Bash][2] interprets environment variables [was disclosed][3]. The exploit relies on Bash parsing some environment variable declarations as function definitions, but then continuing to execute code following the definition:

    $ x=&#39;() { echo i do nothing; }; echo vulnerable&#39; bash -c &#39;:&#39;
    vulnerable

But I don&#39;t get it. There&#39;s nothing I&#39;ve been able to find in the Bash manual about interpreting environment variables as functions at all (except for _inheriting functions_, which is different). Indeed, a proper named function definition is just treated as a value:

    $ x=&#39;y() { :; }&#39; bash -c &#39;echo $x&#39;
    y() { :; }

But a corrupt one prints nothing:

    $ x=&#39;() { :; }&#39; bash -c &#39;echo $x&#39;

    $ # Nothing but newline

The corrupt function is unnamed, and so I can&#39;t just call it. Is this vulnerability a pure implementation bug, or is there an intended feature here, that I just can&#39;t see?
 
## Update

Per Barmar&#39;s comment, I hypothesized the name of the function was the parameter name:

    $ n=&#39;() { echo wat; }&#39; bash -c &#39;n&#39;
    wat

Which I could swear I tried before, but I guess I didn&#39;t try hard enough. It&#39;s repeatable now. Here&#39;s a little more testing:

    $ env n=&#39;() { echo wat; }; echo vuln&#39; bash -c &#39;n&#39;
    vuln
    wat
    $ env n=&#39;() { echo wat; }; echo $1&#39; bash -c &#39;n 2&#39; 3 -- 4
    
    wat

…so apparently the args are not set at the time the exploit executes.

Anyway, the basic answer to my question is, _yes, this is how Bash implements inherited functions_.

  [1]: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6271
  [2]: http://en.wikipedia.org/wiki/Bash_%28Unix_shell%29
  [3]: https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/


Is the behavior behind the Shellshock vulnerability in Bash documented or at all intentional?

Feel free to correct me if my assumptions are wrong here, but let me explain why I&#39;m asking.

Taken from MSDN, a `SecureString`:

&gt; Represents text that should be kept confidential. The text is encrypted for privacy when being used, and deleted from computer memory when no longer needed.

I get this, it makes complete sense to store a password or other private information in a `SecureString` over a `System.String`, because you can control how and when it is actually stored in memory, because a `System.String`:

&gt;  is both immutable and, when no longer needed, cannot be programmatically scheduled for garbage collection; that is, the instance is read-only after it is created and it is not possible to predict when the instance will be deleted from computer memory. Consequently, if a String object contains sensitive information such as a password, credit card number, or personal data, there is a risk the information could be revealed after it is used because your application cannot delete the data from computer memory.

However, in the case of a GUI application (for example, an ssh client), the `SecureString` _has to be built from a_ `System.String`. All of the text controls _use a string as its underlying data type_.

So, this means that every time the user presses a key, the old string that was there is discarded, and a new string is built to represent what the value inside the text box is, even if using a password mask. _And we can&#39;t control when or if any of those values are discarded from memory_.

Now it&#39;s time to log in to the server. Guess what? _You need to pass a string over the connection for authentication_. So let&#39;s convert our `SecureString` into a `System.String`.... and now we have a string on the heap with no way to force it to go through garbage collection (or write 0&#39;s to its buffer).

**My point is**: no matter what you do, somewhere along the line, that `SecureString` is _going_ to be converted into a `System.String`, meaning it will at least exist on the heap at some point (without any guarantee of garbage collection).

**My point is not**: whether there are ways of circumventing sending a string to an ssh connection, or circumventing having a control store a string (make a custom control). For this question, you can replace &quot;ssh connection&quot; with &quot;login form&quot;, &quot;registration form&quot;, &quot;payment form&quot;, &quot;foods-you-would-feed-your-puppy-but-not-your-children form&quot;, etc.

 - So, at what point does using a `SecureString` actually become
   practical?
 - Is it ever worth the extra development time to completely eradicate
   the use of a `System.String` object?
 - Is the whole point of `SecureString` to simply reduce the amount of time a `System.String` is on the heap (reducing its risk of moving to a physical swap file)?
 - If an attacker already has the means for a heap inspection, then he most likely either (A) already has the means to read keystrokes, or (B) already _physically has the machine_... So would using a `SecureString` prevent him from getting to the data anyways?
 - Is this just &quot;security through obscurity&quot;?

Sorry if I&#39;m laying the questions on too thick, curiosity just got the better of me. Feel free to answer any or all of my questions (or tell me that my assumptions are completely wrong). :)

Is SecureString ever practical in a C# application?

I&#39;m trying to implement JWT in my authentication system and I have a few questions. To store the token, I could use cookies but it&#39;s also possible to use `localStorage` or `sessionStorage`.

Which would be the best choice? 

I have read that JWT protects the site from CSRF. However, I can&#39;t imagine how that would work assuming I save the JWT token in cookie storage.

How would it then protect from CSRF?

**Update 1**  
I saw some usage samples like the following:

    curl -v -X POST -H &quot;Authorization: Basic VE01enNFem9FZG9NRERjVEJjbXRBcWJGdTBFYTpYUU9URExINlBBOHJvUHJfSktrTHhUSTNseGNh&quot;

How can I implement that when I make a request to server from the browser? I also saw that some implement the token in the URL:

    http://exmple.com?jwt=token

If I would make a request via AJAX then I could set an header like `jwt: [token]` and then I could read the token from header. 

**Update 2**  

I installed the Advanced REST Client Google Chrome extension and was able to pass the token as a custom header. Is it possible to set this header data via Javascript when making a GET request to the server? 

Where to save a JWT in a browser-based application and how to use it

I&#39;m using an amazon Ubuntu EC2 instance which is only has a command line interface. I want to setup UI for that server to access using remote desktop tools. Is there any way to apply GUI to the EC2 instance?

How To Set Up GUI On Amazon EC2 Ubuntu server

I am tired of all these &quot;upload to S3&quot; examples and tutorials that don&#39;t work , can someone just show me an example that simply works and is super easy?

How to upload a file to amazon S3 super easy using c#

Is there a way to get an item depending on a field that is not the hashkey?

Example

My Table Users: `id (HashKey), name, email`

And I want to retrieve the user having email as &#39;test@mail.com&#39;

How this can be done?

I try this with boto:

    user = users.get_item(email=&#39;john.doe@gmail.com&#39;)

I get the following error: 

    &#39;The provided key element does not match the schema&#39;



DynamoDB : The provided key element does not match the schema

What is the difference between EC2 and Beanstalk? I want to know regarding SaaS, PaaS and IaaS.

To deploy a web application in Wordpress I need a scalable hosting service. If there anything better than my purpose, please let me know as well.

FYI - I want to host and deploy multiple Wordpress and Drupal sites. 

I do not want to give more time for the server and focus on development. But the cloud hosting needs to be auto scalable. 

Difference between Amazon EC2 and AWS Elastic Beanstalk

I&#39;m having this issue since yesterday, and I&#39;m having trouble for find a solution.

I&#39;m trying to send somethings to my S3 bucket, but this message appear in my console when I try:

    { [CredentialsError: Missing credentials in config]
      message: &#39;Missing credentials in config&#39;,
      code: &#39;CredentialsError&#39;,
      errno: &#39;Unknown system errno 64&#39;,
      syscall: &#39;connect&#39;,
      time: Thu Oct 09 2014 14:03:56 GMT-0300 (BRT),
      originalError: 
       { message: &#39;Could not load credentials from any providers&#39;,
         code: &#39;CredentialsError&#39;,
         errno: &#39;Unknown system errno 64&#39;,
         syscall: &#39;connect&#39;,
         time: Thu Oct 09 2014 14:03:56 GMT-0300 (BRT),
         originalError: 
          { code: &#39;Unknown system errno 64&#39;,
            errno: &#39;Unknown system errno 64&#39;,
            syscall: &#39;connect&#39;,
            message: &#39;connect Unknown system errno 64&#39; } } }


And this is my code:



    var s3 = new AWS.S3();
    AWS.config.loadFromPath(&#39;./AwsConfig.json&#39;); 
    
    	s3.putObject(params, function(err) {
    		if(err) {
    			console.log(err);
    		}
    		else {
    			console.log(&quot;Succes&quot;);
    		}
	});


The credentials are correct. Does anyone know what can be? I&#39;ve searching but I not find anywhere the solution.


---

My credentials(fake):



    {
    	&quot;accessKeyId&quot;: &quot;BLALBLALBLALLBLALB&quot;,
    	&quot;secretAccessKey&quot;: &quot;BLABLALBLALBLALBLLALBLALLBLALB&quot;,
    	&quot;region&quot;: &quot;sa-east-1&quot;,
    	&quot;apiVersions&quot;: {
    	  &quot;s3&quot;: &quot;2006-03-01&quot;,
    	  &quot;ses&quot;: &quot;2010-12-01&quot;
    	}
    }

---------------


EDIT:

For help, all the code:


    var fs = require(&#39;fs&#39;);
    var AWS = require(&#39;aws-sdk&#39;);


    var s3 = new AWS.S3();
    AWS.config.loadFromPath(&#39;./MYPATH.json&#39;); //this is my path to the aws credentials.
    
    
    var params = {
    		Bucket: &#39;testing-dev-2222&#39;,
    		Key: file,
    		Body: fs.createReadStream(file)
    	};

	s3.putObject(params, function(err) {
		if(err) {
			console.log(err);
		}
		else {
			console.log(&quot;Success&quot;);
		}
	});


-----


New err:


    Error uploading data:  { [PermanentRedirect: The bucket you are attempting to access must be addressed using the specified endpoint. Please send all future requests to this endpoint.]
      message: &#39;The bucket you are attempting to access must be addressed using the specified endpoint. Please send all future requests to this endpoint.&#39;,
      code: &#39;PermanentRedirect&#39;,
      time: Thu Oct 09 2014 14:50:02 GMT-0300 (BRT),
      statusCode: 301,
      retryable: false }

AWS Missing credentials when I try send something to my S3 Bucket (Node.js)

So there are plenty of tutorials on how to convert a `PEM` to a `PPK` using `puttyGen`. However my issue is that my windows machine had the only `PEM` copy and I converted it into a `PPK` and deleted it. Now I need to figure out how to convert a `PPK` into a `PEM` so that my mac can `ssh` into the server. I still have access to the server so I could also just make a new key if I had to, anyone know how to convert `PPK` to `PEM`?  

Create a PEM from a PPK file

I would like to know how to connect over ssh using a .pem file to any server.

Currently I&#39;m executing the following command:

    ssh user@mydomain.com

What option should I use?

Connect over ssh using a .pem file

I have a `.pem` file containing my private key. However, a BitBucket deployment key has this format: 

&gt; ssh-rsa AAAAB3NzaC3yc2EAAAADAQABAAABAQDfZxX2LXOJlo5MP2tLP4fmQyjIAcATwATFKwM6K3mtT7+LKx1jk6YlFlEcj2CFxJHHTy6LCdDqoVzL3iNcD+mDl7NbcNEHytZNJnFQ5lAHPxDVa9ZbLnmP1OlfUvsQS+jAt7yMSwd8gZ6McOJfp9ZUn+r5LLpjYkF+AMQFPsf+6lhSJaOjOTbsA39OJwlnnSO6HF3W2Om+8Bgdpa/E4En5RZTBwFCAvLaaXY3XgN76xCR24TwTWFicBHWeLdADGFXB7OBOv4y805fNGbNKOl3Yb21mG89aUQlYjobeLqImyIrrEhX36hEdMW/t6zZK/1I0QC//uLa+GjJoeuPW4WY3
&gt; ubuntu@Box

It is usually found using: 

`cat ~/.ssh/id_rsa.pub | pbcopy`

How do I extract my public key, in this format, from a `.pem` file? 

Content Type	Original Author	Original Content on Stackoverflow
Question	leblaireau	View Question on Stackoverflow
Solution 1 - Security	Daniel Scott	View Answer on Stackoverflow

where do I keep my amazon .pem file on a mac

Security Problem Overview

Security Solutions

Solution 1 - Security

Visual Studio 2013: Database Project MSBuild error

JavaScript getBoundingClientRect() changes while scrolling

Attributions