Feedly – Page 35 – Nuffing.com

August 24, 2020

How to Protect Your Laravel Web Application Against the OWASP Top 10 Security Risks

https://ift.tt/321qsQ0

I remember the first time one of my sites got hacked.

The client emailed saying their website was taking ages to load. I jumped online as soon as I got home from college and noticed somebody had used SQL injection to inject a <script> tag into all the product titles.

The script attempted to redirect visitors to a malicious website. I was devastated.

This was back in 2004, and I had just taught myself ASP and SQL Server. It was a sobering moment and one that brought home the realisation that any website could be a target, no matter how small.

It also taught me about the importance of web security, and it’s been at the forefront of my development process ever since.

No site can ever be completely safe — the sheer number of high-profile breaches are a testament to this. But you can follow some best practices to make your site less of a target for a casual malicious actor or automated script.

OWASP & Laravel

The Open Web Application Security Project (OWASP) is an international non-profit organisation dedicated to creating awareness about web application security.

The OWASP Top Ten is a standard awareness guide about web application security and consists of the topmost critical security risks to web applications.

Laravel is one of my favourite PHP frameworks. I’ve used it extensively over the years for anything from small business sites to large fintech and e-commerce applications demanding security at the core.

The great thing is, Laravel takes care of many of these security features out the box.

I’ll run through the OWASP Top Ten and note how you can harden your Laravel web applications with some basic security best practices.

1. Injection

“Injection flaws, such as SQL, NoSQL, OS, and LDAP injection, occur when untrusted data is sent to an interpreter as part of a command or query. The attacker’s hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorisation.” — OWASP Top 10

The Laravel query builder uses PDO parameter binding to protect the application against SQL injection attacks. This means you don’t have to sanitise values being passed as bindings.

Be aware that Laravel also allows you to run raw SQL queries. You should avoid this if possible. Stick to Eloquent instead.

Bear in mind that PDO does not support binding column names. You should never use input from users to dictate the table column name, including columns used in an ORDER BY statement.

If you do need some flexibility, ensure you check the column names against a whitelist.

2. Broken Authentication

Everyday tool composition — Photo by Dan Nelson / Unsplash

“Application functions related to authentication and session management are often implemented incorrectly, allowing attackers to compromise passwords, keys, or session tokens, or to exploit other implementation flaws to assume other users’ identities temporarily or permanently.” — OWASP Top 10

There are several strategies you can use to protect your application from this type of attack.

Use CAPTCHA for any endpoints that can be exploited using brute-force techniques. This includes login, registration, and forgot password forms. CAPTCHA will stop most automated attacks. Go with something like Google’s reCAPTCHA rather than developing your own implementation.
Rate-limit login attempts. If used in conjunction with CAPTCHA, it allows for a great defence-in-depth strategy. Laravel has a middleware that can be used straight away in your routes or controllers to throttle requests.
Build multi-factor authentication for your member and admin accounts. There are great packages available that you can use to generate QR codes and validate one-time password codes upon login. Avoid other means of delivering this code, such as email or SMS. It simply isn’t secure enough.
Never commit any default login details or sensitive API credentials to your code repository. Maintain these settings in the .env file in the project root.
Configure sessions securely: they should be sent over HTTPS only and never display in your application. The secure setting can be enabled in the session.php config file of your Laravel application.

3. Sensitive Data Exposure

Numbered boxes detail — Photo by Tim Evans / Unsplash

“Many web applications and APIs do not properly protect sensitive data, such as financial, healthcare, and PII. Attackers may steal or modify such weakly protected data to conduct credit card fraud, identity theft, or other crimes. Sensitive data may be compromised without extra protection, such as encryption at rest or in transit, and requires special precautions when exchanged with the browser.” — OWASP Top 10

Not a week goes by without news about another high-profile data breach. And most concerning of all is that at times, these breaches reveal how the company used weak security practices. Weak password hashes and unsecured S3 buckets are common occurrences.

Here are a few ways you can combat this:

Ensure you serve the entire application over HTTPS with a TLS certificate. If users try to access the HTTP equivalent, redirect them to the secure route instead and make use of HSTS headers.
Hash all passwords using an adaptive salted hashing function. These are hash functions where the work factor can be increased over time as processor power increases. Laravel supports both Bcrypt and Argon2 by default.
Encrypt all sensitive data stored at rest. Never use your own developed encryption functions. Instead, use Laravel’s built-in encryption functions that use OpenSSL to provide AES-256 and AES-128 encryption.
If you use enumeration for files or primary keys to identify records, you could be inadvertently be exposing information about your system. Using a URL like /member-profile/23 will reveal you have (at least) 23 members on your system. If you include uploaded files like /user-images/45.jpg, you could open yourself to an enumeration attack where a malicious actor could try all number combinations and extract all user images from your website. To combat this, use a different scheme like UUIDv4 to identify records that are public and might require protection. For files, use automatically generated file names or a hashed folder structure to prevent enumeration.

Never trust user-uploaded files. If these uploaded files are not validated or handled correctly, they can allow access to your entire system. The OWASP Unrestricted File Upload page includes several precautions to take. You can implement most of these using Laravel’s validation functionality:

Setting a minimum and maximum file upload size.
Limiting the number of simultaneous file uploads.
Only allow specific file types by checking their MIME.
Rename all files upon upload.
Upload files to a non-public directory or third-party object storage like AWS S3. You don’t want somebody uploading a PHP shell script, allowing them to run commands directly on your server.

Best of all, you can wrap this all into a Laravel rule and simply call this rule as part of your validation flow.

4. XML External Entities (XXE)

Source code of the iOS contact tracing app — Photo by Markus Winkler / Unsplash

“Many older or poorly configured XML processors evaluate external entity references within XML documents. External entities can be used to disclose internal files using the file URI handler, internal file shares, internal port scanning, remote code execution, and denial of service attacks.” — OWASP Top 10

This vulnerability applies to any system that parses XML. A security researcher found this vulnerability in Facebook a few years ago. This SensePost article goes into more detail about how this was accomplished.

The quickest way to prevent this attack is to disable external entity resolution when using the default PHP XML parser. This is done by setting libxml_disable_entity_loader to true.

If you cannot disable this functionality, make sure that your XML parser is updated and that you’re using at least SOAP v1.2 or higher where applicable. Always be vigilant when it comes to user-uploaded or third-party XML.

5. Broken Access Control

“Restrictions on what authenticated users are allowed to do are often not properly enforced. Attackers can exploit these flaws to access unauthorised functionality and/or data, such as access other users’ accounts, view sensitive files, modify other users’ data, change access rights, etc.” — OWASP Top 10

In 2011, attackers made off with details of over 200,000 Citigroup customers after discovering an exploit in the way they handled customer account numbers. Once they logged into an account, all they had to do was change the customer number in the URL to jump to the record of another customer.

This allowed them to create an automated process that would cycle through all possible numbers and capture all the confidential data.

The system didn’t have any authorisation checks in place to ensure the account number being accessed belonged to the logged-in user.

Always perform authorisation checks on any operations that are only available to logged-in users. This includes the page (for example, allowing you to update details), as well as the destination of the form submit.
There are popular RBAC (Role-Based Access Control) packages that can be used with Laravel allowing you to manage user permissions and roles. You can also use Laravel’s built-in authorisation services.

6. Security Misconfiguration

Photo by Philipp Katzenberger / Unsplash

“Security misconfiguration is the most commonly seen issue. This is commonly a result of insecure default configurations, incomplete or ad hoc configurations, open cloud storage, misconfigured HTTP headers, and verbose error messages containing sensitive information. Not only must all operating systems, frameworks, libraries, and applications be securely configured, but they must be patched/upgraded in a timely fashion.” — OWASP Top 10

When configuring your web application, always consider the principle of least functionality. Harden your installation by removing or disabling all services you don’t need.

Back in 2001, the Nimda worm wreaked worldwide havoc by exploiting several IIS (Internet Information Server) vulnerabilities.

Many systems had IIS installed by default, even though they didn’t use the Microsoft web server at all. The result was a high infection rate that could have been prevented by hardening the system and uninstalling any services not required by the system or network.

Keep all server software and any dependencies in your web application up to date.
Disable directory listing for your web server.
Disable debugging on production servers. Even on staging servers, debugging can reveal sensitive server information by outputting all your environment variables. Make use of the debug_hide app configuration option in Laravel to prevent this.

7. Cross-Site Scripting (XSS)

“XSS flaws occur whenever an application includes untrusted data in a new web page without proper validation or escaping, or updates an existing web page with user-supplied data using a browser API that can create HTML or JavaScript. XSS allows attackers to execute scripts in the victim’s browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites.” — OWASP Top 10

Never display user-supplied input without escaping the data. Laravel’s template engine, Blade, automatically escapes content rendered using the default syntax. This sends it through PHPs htmlspecialchars function.

Escaping all output this way will reduce your website visitors’ exposure to XSS and CSRF (Cross-Site Request Forgery) attacks.

Unfortunately, it’s not always as simple as that. If you’ve ever included WYSIWYG HTML editors in your application such as TinyMCE or CKEditor, you know this poses a risk (especially since escaping the output would result in a bunch of HTML tags rather than the formatted content).

In these instances, use a package like HTMLPurifier to remove any potentially malicious code.

8. Insecure Deserialisation

Lover’s Lock — Photo by Micah Williams / Unsplash

“Insecure deserialisation often leads to remote code execution. Even if deserialisation flaws do not result in remote code execution, they can be used to perform attacks, including replay attacks, injection attacks, and privilege escalation attacks.” — OWASP Top 10

Be wary of unserialising anything from untrusted sources. This includes cookies your application might create. A malicious user can edit that cookie in their browser and use this as an attack vector against your application.

By default, all cookies created by Laravel are encrypted and signed. This means they’ll be invalid if a client tampers with them.

9. Using Components with Known Vulnerabilities

Boat sinking — Photo by Diego Gennaro / Unsplash

“Components, such as libraries, frameworks, and other software modules, run with the same privileges as the application. If a vulnerable component is exploited, such an attack can facilitate serious data loss or server takeover. Applications and APIs using components with known vulnerabilities may undermine application defenses and enable various attacks and impacts.” — OWASP Top 10

Because most of the dependencies you may be using in Laravel are open source, it allows malicious users to analyse the packages and find ways to exploit vulnerabilities. A few ideas to mitigate this problem:

Ensure you keep all dependencies up to date.
Remove any dependencies not in use. This will reduce the potential number of attack entry points.
Subscribe to security bulletins and include a security scanner (such as Snyk) as part of your CI/CD pipeline.
Consider using an LTS (Long Term Support) version of Laravel rather than the latest version. LTS versions receive security fixes for three years rather than the one year for non-LTS releases.

10. Insufficient Logging and Monitoring

“Insufficient logging and monitoring, coupled with missing or ineffective integration with incident response, allows attackers to further attack systems, maintain persistence, pivot to more systems, and tamper, extract, or destroy data. Most breach studies show time to detect a breach is over 200 days, typically detected by external parties rather than internal processes or monitoring.” — OWASP Top 10

When it comes to your application and server, log everything, including failed login attempts and password resets.

Laravel comes with Monolog out of the box. You can even integrate it with a third party logging service like Papertrail and receive alerts for specific log events.

Conclusion

Thank you for reading, I hope this has proven useful! Sign up to my newsletter or visit my blog where I’ll share insightful web development articles to supercharge your skills.

Resources

The OWASP website is a brilliant source of information, and they provide several in-depth guides about many of the security issues mentioned above.

programming

via Laravel News Links https://ift.tt/2dvygAJ

August 24, 2020 at 09:42PM

August 24, 2020

Making Good Great: Upgrading the Ka-Bar BK-16, Coating Removal

https://ift.tt/3j9ew5t

The Ka-Bar Becker BK-16 is a great knife with two glaring issues that you can easily remedy and upgrade yourself. Here’s how to fix one of them.

In addition to being a Le Cordon Bleu-trained chef, Ethan Becker is also a master knife designer. The brains behind many of Ka-Bar’s best designs, Becker’s insights result in some of the best fixed blades available, all at a very reasonable price.

Of the knives in his stable, my favorite, and perhaps the internet’s favorite, is the BK-16, a midsize knife with excellent ergonomics and the ability to do just about anything you ask of it. The BK-16 is an excellent blade, but there were two glaring issues for me.

First, a cake frosting-thick coating inhibits good slicing and clean cutting. Second, the sheath really leaves a lot to be desired.

Here, I give solutions to the first problem, detailing how to remove the coating. This will work on many coated blades, especially those in the Ka-Bar lineup. If the knife’s coating is a spray-on as opposed to a PVD coating, this has a chance of working (though always test in an inconspicuous spot first).

We’ll talk more about making Kydex sheaths in an article coming soon.

Coating Removal: Supplies

Paint Stripper

First, make sure it’s not paint thinner or mineral spirits. While these can take off a small bit of paint or thin coatings, they can’t get rid of the coatings here.

I used a gel-based stripper available at both Home Depot and Lowe’s called CitriStrip. It lacks some of the high-powered solvents that other strippers do but worked just as well. Not worrying about fumes or the disposal of hazardous chemicals is a good thing.

Putty Knife

While you could try this with a butter knife or a chisel, this is exactly what a putty knife is designed to do. And they’re cheap.

Disposable Gloves

Although CitriStrip won’t burn your skin off at the slightest contact, it’s still a powerful solvent and will cause skin irritation. Avoid touching it if you can. Plus, with all of us quarantining, you probably already have some disposable gloves.

Safety Glasses

For all its orangey goodness, CitriStrip in the eyes would still be a major problem.

Other Stuff That’s Nice to Have

To make the process even easier, use an old toothbrush, a Q-tip, a wire brush, a small screwdriver, and a magnetic parts tray.

All but the magnetic parts tray will help you get rid of the last flecks of the coating. While technically only the coating on the blade needs to be removed, those of us who like to unlock completeness achievements in video games will try to get rid of coating even in the screw holes under the handle scales.

A magnetic parts tray keeps your parts in the same place. If you don’t have one, get one. It’s incredibly handy, and you’ll use it for a myriad of other things.

Upgrading the Ka-Bar BK-16: Starting the Process

First, you need to disassemble your knife completely, removing the handle scales, any lanyard you may have on the knife, and the hardware attaching the handle scales. When you’re finished, the knife should look like this:

After you have the knife completely naked, set up a container for the stripping agent. Here, I used a disposable lasagna tray, but anything made of glass should also work (please wash thoroughly if the container is not disposable).

Once the knife is stripped, pour out enough stripper until the bottom of the tray is mostly covered. After that, you can just lay the knife in there and make sure the entire knife is covered. To aid in retrieval, I bent a nail and put it through the lanyard hole:

Once the knife is coated, let it sit in the stripper. I let my BK-16 soak for 24 hours despite the recommended 8-hour period. The end result was glorious; the coating all but fell off the knife. Here it is about 30 seconds into the stripping process:

And here’s the knife 15 seconds after that:

After the flats are cleared off, it’s time for detail work. I needed a wire brush to clean up the plunge lines (I should have taped up the edge; working on a knife like this without the edge taped is a safety hazard):

I then used a small flathead screwdriver to clean up the interior steel from the milled holes in the handle. This is entirely unnecessary, but again, I’m a completist.

Finally, I used a Q-tip to rid the screw holes of the coating. This was the last thing I did before reassembling the knife, and I’m convinced there’s not a single speck of coating left on my BK-16.

Coating Removal: Results

Here’s what the knife looks like nude, post-strip. The grind lines are very visible, which I suppose will bother some people, but the laser marking and the stone washing look nice to me.

Overall, I’m very pleased with how the stripping went, and the knife definitely slices better now. But it does mean that I have to be more cognizant of rust and more religious in coating my knife with an anti-rusting agent (I like EDCi or WD40).

Coming soon, I’m going to show you step by step how to keep upgrading your Ka-Bar BK-16 by making a Kydex sheath.

The post Making Good Great: Upgrading the Ka-Bar BK-16, Coating Removal appeared first on GearJunkie.

Outdoors

via GearJunkie https://gearjunkie.com

August 24, 2020 at 02:01PM

August 21, 2020

Good News: Vaccine Shows Promise In Clinical Trials. Bad News: It Also Resurrected Hitler As A Zombie

https://ift.tt/3aPmI7Z

Good News: Vaccine Shows Promise In Clinical Trials. Bad News: It Also Resurrected Hitler As A Zombie

ATLANTA, GA—A recent attempt at making a vaccine for the COVID-19 virus has shown mixed results. The latest tests have shown that the trial vaccine does cause an increased immune response to the novel coronavirus. On the other hand, the corpse of Adolf Hitler somehow got exposed to the vaccine, and it has resurrected him as an evil zombie.

“It feels like we’re on the right path,” said researcher Shelly Weaver as she nailed boards to the research facility window. “The results on the immune response are exactly what we wanted to see. At the same time, we probably should have kept the test vaccine away from the corpses of genocidal dictators. Still, it’s better to know it could resurrect them as zombies now rather than find that out later.”

If further tests show the same results, the vaccine could be an important step in getting the nation back to normal, allowing people to go out again without fear of contracting the virus. There may be a new fear, though, of being attacked by a zombie Nazi army led by one of the most evil men in history.

“It’s a mixed bag, for sure,” said pharmaceutical executive Ron Sanders, “but we’re trying to focus on the positive. Sure, there are side effects, but we think they’re manageable.” He then loaded a shotgun.

Breaking: PayPal Now Available

Many of you told us you wouldn’t subscribe until we offered PayPal as a payment option. You apparently weren’t bluffing, so we finally caved and added PayPal. Now — like the unbeliever faced with God’s invisible qualities displayed in nature — you are without excuse.

fun

via The Babylon Bee https://babylonbee.com

August 21, 2020 at 12:16PM

August 20, 2020

Chinese Advertisers Might Have Monetized Your Period

https://ift.tt/3gcKX1b

Image: Ian Waldie (Getty Images)

In a cruel but totally predictable twist, an app that all but guaranteed pregnancy within nine months or-your-money-back was too good to be true.

A data privacy watchdog has found that a top ovulation tracker Premom has been secretly sharing users’ location data, advertising IDs, and multiple device identifiers from Android devices with Chinese data providers for advertising companies. Some of the information is impossible to revoke unless you destroy your device. Data from the app analytics firm Sensor Tower shows that Premom’s ovulation tracker has been downloaded over 120,000 times from the Google Play store and iTunes in July 2020 alone.

The Washington Post has reported that the International Digital Accountability Council (IDAC), which conducted an investigation, has found no evidence that Premom shared health-related information, but persistent, non-resettable hardware identifiers are nearly as bad. With the aforementioned location, device and advertising data, the companies could have inferred users’ identities, tracked browsing activity and use of other apps—and, in doing so, might well have developed behavioral profiles, which can include users’ believed sexual identities, religious affiliations, political preferences, health status, education level, and income bracket. Premom’s privacy policy states that it would “will keep your personal data confidential and we will not give or sell your information to any third parties or non-affiliated companies without your consent.”

Premom, which is free in the Apple App and Google Play stores, appears to generate revenue from its sister brand Easy@Home: an Illinois-based online depot for home medical supplies, including drug tests and ovulation test strips, the latter of which are marketed as complementary products for the app. The first red flag, though, was the litany of data Premom said it collected, up until a recent update in its privacy policy:

name, age, gender, birth date, health-related information, email address, fertility information, social media account names, authentication information, inventory of installed applications on Your device, phonebook or contact data, microphone and camera sensor data, sensitive device data, and other information that you link with our Application.

G/O Media may get a commission

It adds that users may “and may be required to” share information and give Premom access to third-party services. (Now, it says that users can opt out by emailing Premom, something an average user is not likely to know they can do.) It’s especially suspect, IDAC notes, that Premom would supposedly need a list of users’ other apps, which can be used to profile users for ad targeting.

In a letter to Google, the FTC, and the Illinois Attorney General, IDAC identifies Chinese companies Jiguang, UMSNS, and Umeng as Premom data recipients. The Alibaba-owned company Umeng analyzes and publishes reports on app usage statistics, ostensibly for developers. Jiguang, also an analytics company, provides push notification software for apps, which IDAC claims aggressively sucks up data without users’ knowledge or any clear method for stopping it. Not particularly reassuringly, a Jiguang spokesperson said in a statement shared with the Washington Post that it was “100% in compliance with Chinese laws” and also Apple App store and Google Play guidelines. Gizmodo was unable to locate any pertinent information on UMSNS.

Data privacy protection is a mess in the United States, and as of now, there are no federal data privacy regulations. But Illinois, where Premom’s parent company Easy Healthcare Corporation is based, has been working to pass data privacy legislation which would give consumers the right to delete data and know whom it’s been shared with, similar to the landmark policy California enacted this year.

Google also explicitly forbids the extent of data hoovering alleged in IDAC’s letter, particularly the collection of advertising IDs together with device identifiers, without consent. According to the Washington Post, Google briefly removed the app from its store on August 6th, after an inquiry from the paper, but soon restored it.

Supposedly, Premom updated the app and removed the Chinese companies’ access to data, so now you can rest easy in the knowledge that Google Analytics and Facebook will take good care of you. Gizmodo has reached out to Premom and the IDAC and will update the post if we hear back.

geeky,Tech

via Gizmodo https://gizmodo.com

August 20, 2020 at 03:51PM

August 20, 2020

Statamic 3 is now released

https://ift.tt/3aFST9O

After a few months of being in beta, Statamic 3 is now officially launched and available to everyone. This release marks a new beginning for Statamic because the system is now built as a Laravel package. This means you can drop it into just about any Laravel application and have a full CMS at your disposal.

That is just one major feature and here are some other new features from their release announcement:

Statamic 3 is built as a Laravel package, which means you can drop it into just about any Laravel application and have a full CMS at your fingertips without having to wangjangle WordPress or another platform onto a subdomain or (God forbid) subdirectory and glue it and your app together with bubblegum and rubberbands.

Statamic 3 is open source and completely free for personal use. Just grab it off Github and start building.

Statamic 3 is designed to scale. You can start with flat files and transition to a database or cloud storage service when you need to by using data repositories.

Statamic 3 can be used as a headless CMS with our content API and upcoming GraphQL implementation.

Statamic 3 can transform into a static site generator with our ssg package.

Outside of these main features Statamic 3 has a new pricing structure:

Statamic 3 Pro is $259 and includes 1 year of updates and developer support. After that, each additional year of updates and basic support is $59. You will never have to “renew” your site to keep using it or leave it online, but rather only when you want to get the latest updates and support. Your site is yours forever and we like it that way.

Statamic 3 Solo is free and open source! It doesn’t quite have every feature included in Pro, but is certainly more than capable to handle most personal and hobby sites. Head to the pricing page to see the side-by-side feature breakdown.

For complete details and to try it out today head over to the awesome flash dancer Statamic 3 website.

Filed in:
News
/
Statamic

programming

via Laravel News https://ift.tt/14pzU0d

August 20, 2020 at 09:04AM

August 19, 2020

Hangar raises $15 million for its venture studio for government technology startups

https://ift.tt/3kW7X81

Josh Mendelsohn, the former Bloomberg digital campaign advisor and venture studio founder, thinks that cash-constrained government agencies from the local to the federal level aren’t using technology effectively enough to meet the challenges they face.

That’s why the founder of Engine and former managing director of Hattery launched Hangar with a $15 million commitment from his former boss and the Kresge Foundation to build companies that will help solve problems that governments haven’t tackled effectively.

“We’re at an unprecedented moment for our country, and our companies are addressing several significant challenges all at once, from combatting Covid-19, to rebuilding our economy, to reducing the cost of higher education, to addressing disparate outcomes in healthcare,” said Mendelsohn, in a statement.

The company has already hired an in-house team of technologists and business consultants to build businesses to nab some of the $2 trillion that governments across the U.S. spend every year on information technology.

In the year-and-a-half since Mendelsohn first began operating the company building studio in stealth mode, Hangar has already created four businesses including: Camber, which provides mobility data to governments and is being used by public health researchers to monitor and manage COVID-19 outbreaks,

Camber is currently the authoritative provider of mobility data insights to public health researchers, epidemiologists, and state governments tackling COVID-19; Cornea, a predictive toolkit for disaster planning and management; Outcome, a new service for student loans; and Roster, which uses technology to enhance the efforts of community health workers.

“There are so many areas–from healthcare to disaster planning–that are ripe for innovation and new technologies that help to improve the lives and well-being of people and help solve real problems,” said Brian O’Kelley, a New York-based serial entrepreneur and Hangar investor who previously founded AppNexus (and sold it to AT&T for over $1 billion). “With a veteran team that blends deep Silicon Valley and policy experience, Hangar is already making an impact and I’m proud to be supporting their next phase.”

technology

via TechCrunch https://techcrunch.com

August 19, 2020 at 08:48AM

August 18, 2020

VISM G5+ Glock Tool: A Must Have For Glock Owners

https://ift.tt/2Q48Xsv

U.S.A. -(AmmoLand.com)- It isn’t often that I come across a tool that is as simple as the VISM G5+ Glock Tool that is as invaluable as it has been. When I was at NRAAM 2018, I thought that my friend (and unofficial non-biological father) Steve Fisher of Sentinel Concepts was on some potent drugs when he told me that I had to swing by the NcSTAR booth to check it out.

Spoiler: It turns out that Papa Fisher wasn’t on drugs and had stumbled onto the greatest all in one Glock tool that either of us had seen to date. While this is a bit of a spoiler, I like it enough to have purchased a couple and often give them as gifts.

The VISM G5+ Glock Tool features five distinct tools in one with a bonus bottle opener built-in. Over the last couple of years, I have owned one; it has become a staple in my range bags as well as my tool kit.

VISM G5+ Glock Tool

Takedown Punch

The Glock punch is one of the most used tools in my kit due to the sheer volume of shooting I do with my range guns. When it comes time to do a deep clean every couple thousand rounds, the pistol gets stripped to a completely bare frame.

Part of the reason for this is the internals need to be cleaned exceptionally well. The other purpose is I want to remove as much metal as possible so I can use a toothbrush and dish soap to scrub the hell out of the stippled frames. You wouldn’t believe the amount of dead skin some of my more aggressive frames collect over time.

I do rather like the fact that the tool body has a place to rest your thumb so you can get a great grip on it should you have some stubborn pins.

While there are a bunch of punches out there that will do the job, the 3/32″ hardened steel punch has a nice chamfer on the tip to make sure that you don’t gouge the polymer should your aim not be dead on as the pin is pushed through.

Not only is the hardened steel 3/32″ punch the right diameter, but unlike other all-in-one Glock tools, it is also the right length as well.

One of the most significant failings with other punches on the market is they aren’t long enough to drive the pin out of the frame entirely. Thankfully this isn’t a problem with the VISM G5+ Glock Tool with its 1 7/16″ long punch. Nothing is more annoying than being forced to pull a pin out the rest of the way with your fingers when it should just drop into your parts tray.

Glock Pin Centering Tool

There has been some confusion about the reason that the factory Glock tool has a square handle with rounded corners. Some seem to think that it is because Glock is cheap; others believe that it was designed to prevent the tool from rolling off a workbench.

Regardless of frame mods or generation of your pistol, the G5+ tool has two radiuses that will seat the pin to the right depth with ease.

It turns out that its real purpose is to help you center the pins in the frame during reassembly. The VISM G5+ tool has two different radiuses that allow you to quickly seat the pins to just the right depth for your gun.

Striker Takedown Tool

During the Glock Armorer’s course, they teach you to use the slide to take apart the striker assembly for service. While it is nice to have the tool essentially built into the gun, it isn’t as stable as I would like when working on several pistols in a row or doing something like trying different combinations of trigger bars, connectors, and strikers to fine tune trigger feel.

The striker disassembly tool is one of the more clever features on the VISM G5+ Glock Tool.

I rather like the additional stability that the VISM G5+ tool provides and have pretty much stopped using the striker channel as Glock teaches in the armorer’s course when maintaining pistols.

Glock Floorplate Tool

While all the other tools built into the VISM G5+ tool are helpful, none of them are as awesome as the MagPopper. If you have ever taken the baseplate off a Glock magazine, you know exactly how much of a pain in the butt it can be.

The magazine baseplate tool is the best part of the VISM G5+ in my opinion.

The Glock armorer’s manual teaches you to insert a Glock punch into the baseplate fully until it is held captive by the floorplate retainer, then to use your thumb to push the baseplate past the two retaining tabs. Let me tell you… it isn’t a smooth operation.

The simplicity of the MagPopper is what makes it so dang good.

With the G5+ tool’s MagPopper, what used to be a giant pain is a simple operation. Funny how the right tool can make a difficult task a cinch.

Once you slide the hook into the baseplate hole, you only need to squeeze the tool and magazine body together and the baseplate pops right off.

All you need to do is insert the hook into the baseplate hole and squeeze the mag body and tool together. As the name implies, there is a satisfying pop as the baseplate slides right off.

I have to say, the MagPopper is hugely superior to how Glock teaches magazine disassembly in their armorer’s course.

Glock Front Sight Tool

The front sight tool on the VISM G5+ tool is yet another tool that is significantly better than other tools I have used in the past. To get the front sight tool out of the handle, you need to push the button to release it. Once the tool is in the open position, it locks in place with the same button.

The folding front sight screw tool is well thought out.

Once the front sight tool is extended, NcSTAR added a magnet inside the nut driver so that you no longer have to do gymnastics with your sight post, the screw, your slide, and the tool.

No more weird hand yoga to make sure that the screw doesn’t fall into oblivion.

One of the things that many other front sight tools get wrong is the nut driver is just too thick. For example, the Strike Industries All-In-One Glock Tool has a nut driver that is too thick and prevents you from removing the front sight on roughly 1 out of every four pistols I have tried it on over the years.

Bonus Tool: Bottle Opener

I don’t much like the idea of consuming alcohol and handling firearms but do understand it happens when cleaning guns after a long range trip. I don’t drink much myself, so I resorted to some delicious Jarritos sodas, which the G5+ opened like a champ.

I can’t recommend using the bottle opener while handling firearms, it is there, and I am sure that some will appreciate the heck out of it.

I guess there isn’t much reason not to include the bottle opener since the MagPopper fulcrum needs to be there anyhow, just be responsible when handling firearms.

Should You Buy A VISM G5 Glock Tool?

If you own a Glock, yes. There isn’t anything else on the market that is a better tool to include the tools that Glock offers to its certified armorers. It is well designed and made from pretty stout materials, so it should last quite a while.

After using the hell out of mine for a few years on my personal guns that get reconfigured often as well as servicing rental guns at the range I instruct at, I am impressed at how well it has held up after being my primary Glock armorer’s tool.

Aside from some slight finish wear and a bit of rust from leaving it in the bed of my truck, the VISM G5+ Glock Tool looks pretty dang good for a tool that has serviced several hundred pistols.

The VISM G5+ Glock Tool carries an MSRP of $27.99 but can be found for a street price of less than $20 should you shop around some. Learn more about the VISM G5+ Glock Tool on the NcSTAR website.

About Patrick R.

Patrick is a firearms enthusiast that values the quest for not only the best possible gear setup but also pragmatic ways to improve his shooting skills across a wide range of disciplines. He values truthful, honest information above all else and had committed to cutting through marketing fluff to deliver the truth. You can find the rest of his work on FirearmRack.com as well as on the YouTube channel Firearm Rack or Instagram at @thepatrickroberts.

The post VISM G5+ Glock Tool: A Must Have For Glock Owners appeared first on AmmoLand.com.

guns

via AmmoLand.com https://ift.tt/2okaFKE

August 18, 2020 at 02:37PM

August 18, 2020

Lunar Lander Tiny House

https://ift.tt/317xZgR

Link

How’d you like to spend your weekends in a lunar lander? Catamaran designer Kurt Hughes turned his skills towards building an earthbound structure inspired by the iconic space vehicle. His 250 sq.ft. “fishing shack” sits along the banks of the Columbia River, and is made from carbon fiber panels, plywood, and epoxy.

fun

via The Awesomer https://theawesomer.com

August 18, 2020 at 12:30PM

August 17, 2020

Deploying a Minecraft Docker Server to the cloud

https://ift.tt/2E3VDCb

One of the simplest examples that people have used over the years of demoing Docker is quickly standing up and running a Minecraft server. This shows the power of using Docker and has a pretty practical application!

Recently I wanted to set up a server but I wanted to persist one and as I have given away my last raspberry pi I needed to find a new way to do this. I decided that I would have a go at running this in Azure using the $200 free credits you get in your first month.

The first thing I decided to do was to check out the existing Docker Images for Minecraft servers to see if there were any that looked good to use, to do this I went to Docker Hub and searched for minecraft:

I liked the look of minecraft-server repo, so I clicked through to have a look at the image and link through to the Github repo.

To start I decide to just test out running this locally on my machine with the ‘simple get started’ Docker Run command:

$ docker run -d -p 25565:25565 --name mc -e EULA=TRUE
 itzg/minecraft-server

In the Docker Desktop Dashboard, I can see I have the container running and check the server logs to make sure everything has been initialized properly:

If I load up Minecraft I can connect to my server using local host and my open port:

From there, I can try to deploy this in Azure to just get my basic server running in the cloud.

With the Docker ACI integration, I can log into Azure using:

$ docker login azure

Once logged in, I can create a context that will let me deploy containers to an Azure resource group (this proposes to create a new azure resource group or use an existing one):

$ docker context create aci acicontext
Using only available subscription : My subscription (xxx)
? Select a resource group  [Use arrows to move, type to filter]
> create a new resource group
  gtardif (westeurope)

I can then use this new context :

$ docker context use acicontext

I will now try to deploy my minecraft server using the exact same command I ran previously locally :

$ docker run -d -p 25565:25565 --name mc -e EULA=TRUE itzg/minecraft-server
[+] Running 2/2
 ⠿ Group mc  Created                     4.6s
 ⠿ mc        Done                        36.4s
mc

Listing my azure containers, I’ll see the public IP that has been provided for my Minecraft server:

$ docker ps 
CONTAINER ID        IMAGE                   COMMAND             STATUS         PORTS
mc                  itzg/minecraft-server                       Running        51.105.116.56:25565->25565/tcp

However, if I follow the logs of the ACI container, the server seems to be stuck in the initialization, and I cannot connect to it from Minecraft.

$ docker logs --follow mc

In the logs we see the Minecraft server reserves 1G of memory, which happens to be the default memory allocated to the entire container by ACI ; let’s increase a bit the ACI limit with the –memory option :

$ docker run -d --memory 1.5G -p 25565:25565 --name mc -e EULA=TRUE
itzg/minecraft-server

The server logs from ACI now show that the server initialized properly. I can run $ docker ps again to get the public IP of my container, and connect to it from Minecraft and start playing !

This is great, but now I want to find a way to make sure my data persists and reduce the length of the command I need to use to run the server.

To do this I will use a Compose file to document the command I am using, and next I will add a volume to this that I can mount my data to.

version: '3.7'
services:
 minecraft:
   image: itzg/minecraft-server
   ports:
     - "25565:25565"
   environment:
     EULA: "TRUE"
   deploy:
     resources:
       limits:
         memory: 1.5G

Looking at our command from before we have moved our image name into the image section, our -p for ports into the ports and added our EULA acceptance into the environment variables. We also ensure the server container has enough memory to start.

The command to start this locally is now much simpler:

$ docker-compose --project-name mc up

And to deploy to ACI, still using the ACI context I created previously:

$ docker compose --project-name mc2 up 
[+] Running 2/2
 ⠿ Group mc2  Created                                6.7s
 ⠿ minecraft  Done                                   51.7s

Of course with compose, this allows the compose application to include multiple containers (here we only have the “minecraft” one). The containers are visible in the progress display (here the “minecraft” line).
And listing the containers shows the application name and the container name mc2_minecraft :

$ docker ps
CONTAINER ID                   IMAGE                  COMMAND      STATUS      PORTS
mc                             itzg/minecraft-server               Running     20.50.245.84:25565->25565/tcp
mc2_minecraft                  itzg/minecraft-server               Running     40.74.20.143:25565->25565/tcp

Next we will want to add a volume to include our Minecraft data and where we can load in other maps if we want. To do this I need to know what folder has the Minecraft data in the Docker image, if I go and inspect our running container in the Docker Dashboard I can see that it is the /Data directory:

If I wanted to add this back in my command line I would need to extend my command with something like:

docker run -d -p 25565:25565 --v /path/on/host:/data --name mc -e 
EULA=TRUE itzg/minecraft-server

I can add this under the volumes in my Compose file:

version: '3.7'
services:
 minecraft:
   image: itzg/minecraft-server
   ports:
     - "25565:25565"
   environment:
     EULA: "TRUE"
   deploy:
     resources:
       limits:
         memory: 1.5G
   volumes:
     - "~/tmp/minecraft_data:/data"

Now when I do a docker compose up and come back to inspect I can see the /data folder in the container is now mounted to my local folder as expected. Navigating to this local folder I can see all Minecraft data.

Now let’s create an Azure File Share and deploy our application to mount /data to the Azure shared persistent folder so we can do the same thing in ACI.

First I need to create an Azure storage account. We can do this using the Azure “az” command line, or through the Azure portal, I have decided to use the portal :

I need to specify a name for the storage account, select the resource group to attach to it, then I let the other options default for this example.

Once the ”minecraftdocker” storage account is created, I’ll create a file share that will hold all Minecraft files:

I just need to specify a name for this file share and a size quota ; let’s call it “minecraft-volume”:

I’ll need to specify an access key to reference that in my compose file, I can get the storage account access key in the left hand side menu, Settings > Access keys.

Then in my compose file, I’ll update the volume specification to point to this Azure File Share:

version: '3.7'
services:
 minecraft:
   image: itzg/minecraft-server
   ports:
     - "25565:25565"
   environment:
     EULA: "TRUE"
   deploy:
     resources:
       limits:
         memory: 1.5G
   volumes:
     - "minecraft:/data"
volumes:
 minecraft:
   driver: azure_file
   driver_opts:
     share_name: minecraftdocker     
     storage_account_name: minecraft-volume      
     storage_account_key: xxxxxxx

Note that the syntax for specifying ACI volumes in Compose files is likely to change in the future.

I can then redeploy my compose application to ACI, still with the same command line as before:

$ docker --context acitest compose  --project-name minecraft up
[+] Running 2/2
 ⠿ Group minecraft  Created                                5.3s
 ⠿ minecraft        Done                                  56.4s

And I can check it’s using the Azure File Share, just selecting the minecraft-volume Share in the Azure portal:

I can connect again to my server from Minecraft, share the server address and enjoy the game with friends!

To get started running your own Minecraft server you can download the latest Edge version of Docker Desktop. You can find the Minecraft image we used on Docker Hub, or start creating your own content from Dockers Official images. Or if you want to create content like this to share, create a Docker account and start sharing your ideas in your public repos.

The post Deploying a Minecraft Docker Server to the cloud appeared first on Docker Blog.

sysadmin

via Docker Blog https://ift.tt/2okjk0A

August 17, 2020 at 12:02PM

August 17, 2020

Take the FBI Handgun Qualification Challenge

https://ift.tt/3h5lsjy

Click on the video above to watch.

The FBI handgun qualification is a well known standard demonstration of handgun proficiency. This longstanding course of fire was updated in 2019 and includes some new challenges which will push yours skills!

The 50-round course of fire covers distances from 3 to 25 yards and includes single hand shooting, off hand shooting, holster work, standing and kneeling positions.

There are two levels of qualifications: 80/100 for standard qualification and 90/100 for instructor level.

The 10 strings of fire offer some very challenging time limits. Lets see if you have what it takes to measure up against America’s G-Men.

Click HERE for the Course of Fire and Scoresheet

This challenge is courtesy of our non-profit FASTER Saves Lives program, which trains school employees how to protect our children.

How FASTER Challenges Work:

Each month we will issue a new challenge to help you practice self defense skills. Just for TRYING the challenge you will receive a custom FASTER Challenge patch to commemorate your effort and support.

The patch is a standard embroidered Velcro-backed 2″ x 3″ patch suitable for putting on hats, jackets, book-bags, range bags, and anywhere else Velcro will stick.

So get out, take the challenge, support FASTER, and have some fun!

1) Go to FASTERSavesLives.org and scroll to the bottom of the page where you will see the heading “Upcoming FASTER Training.” Click that link to begin registration for each challenge.

2) You will see a link that lets you download the course of fire.

3) The "Join the Challenge Now" button is where you actually sign up for the challenge. The cost monthly will be $20 for the challenge patch and for the official targets if you need them. Join the challenge now, because once the month is over, if you still want to take the challenge you can, but the price goes up on the first of the following month.

4) Go to the range or an appropriate space of land, use top-notch gun safety, and take the challenge! Make sure you learn and have fun while you do it! There is no required score. And it’s on the honor system.

5) Please take pics and tag us on our social media accounts and help us spread the word and fund the mission of FASTER Saves Lives! #FASTERChallenge
Facebook: @FASTERSavesLives
Twitter: @FASTERSaves
Instagram: @FASTERSavesLives

6) When your patch arrives in 2-4 weeks, wear it proudly and get others to take the challenges with you.

7) Sign up for the next challenge. We plan on offering a different challenge each month.

If you have questions, contact the Challenge Program leader:
Tom Hall
Tom@FASTERSavesLives.org
740-550-4159