SamuraiNet Blog

I was looking into various methods for backing up websites on my localhost and have come up with 3 options. I’m sure there are more, but these require tools you already have.

Internet Explorer 6 (I don’t have IE7 installed yet, so I did it with IE6)

Internet explorer 6 offers the ability to “work offline” which downloads all data to your localhost and allows you to act as tho you are viewing the live site. In order to enable this, you bookmark the page and select “make available offline.” If you want more than just that one page, goto customize and you are prompted for getting pages it links too also. What is nice is that you can specify how deep you want IE6 to go. If you select 2, for example, all links on the page will be followed and downloaded. All links on these pages will be treated similarly and the process stops. You are then prompted for how you want to synchronize these local copies. You have 2 options: manually synchronizing and scheduling. Scheduling will do it at a specified time every n number of days. Since IE6 is “working offline” paths don’t need to be modified.

FireFox 2

Firefox 2 offers a similar solution, however; it does not appear to have the synchronization by default. To do this you “save page as” and then have the option of saving as a text file, as the single page, or “complete” which will build up all the files needed for that page. Unlike IE6 you cannot get pages linked to. There is a Firefox add-on that will provided added functionality, but this article’s scope is default functionality. Also, Firefox does not change links to localhost paths.

WGET

The previous options are great for GUI systems, however; if you are a sysadmin or a web developer and need to make a backup of a current live site before replacing it with a new version neither of these options are very good for you. So I provide a command line, no GUI option. running wget with the -r (recursive) option will provide the same functionality as IE6. Simply create a directory, change directory into it, and run:

wget -r site.com

and you have all the client side data. Much eaiser and without GUI.

These options bring up 2 more topics I’d like to cover. First is from the perspective of the site owner. Suppose you don’t want people going around downloading your content. For a dedicated person, this is not preventable, but you can make it more difficult and annoying. IE6 and wget both follow the robots.txt rules, this is not an issue for Firefox 2 since it doesn’t have this functionality by default anyways. In short, other than making it less convenient and data you send to a client (HTML, CSS, Javascript) will be available for backup which is obvious since it is client side data and the web would be useless if it was inaccessible.

The other topic is client side security. Browsers disallow cross site AJAX requests. This is a security feature to stop a malicious individual from putting AJAX calls to other sites on their page and stealing your personal information. Browsers do however allow this behavior from the localhost. So by downloading and viewing this malicious code it will execute. Also, by putting JavaScript code on your local file system you allow malicious individuals to access these files.

Interestingly it seems that Internet Explorer 6 actually beats the default install of Firefox 2 in this test. Seems Microsoft did a good job on this feature. wget doesn’t really enter into that comparison since both are browsers and wget is utility, however; it also tops Firefox 2 by having recursiveness. As backup utilities wget and Internet Explorer 6 are tied since they both preserve pages, links included. Personally, I prefer wget since I’m not a fan of GUI or tools that won’t run under linux.

In a recent study by PCTools, Windows Vista was found to be far more vulnerable to malware than Windows 2000. These tests were run on both server and client editions of the operating system and the following statistics were provided: Windows Vista was found to allow 639 threats per thousand computers while Windows 2000 only was allowing 586.

Based on these statistics 64% of Vista users are in danger, however; only 59% of Windows 2000 users are in danger. These numbers seem damaging to Microsoft considering that Vista has been marketed as the most secure version of Windows to date. However, after a bit of examination, these statistics are not quite as blunt as they seem.

The 5% difference between the two operating systems is not a large margin. Also Dennis Kudin points out that software such as Internet Explorer 7 will not run on Windows 2000. Internet Explorer 7 provides security that requires newer service packs that Windows 2000 simply cannot run. This provides a whole new target for Vista that Windows 2000 does not have. Windows Vista provides the UAC (User Access Control) system to stop processes from being administrators without permission. Most Windows 2000 users ran under administrator by default, which would allow malware to be more effective.

Microsoft’s director of project management security, Austin Wilson, commented on his blog that Vista was tested fully and stated “We study the malware space very carefully and publish our results twice a year in the Security Intelligence Report. This report is compiled from statistics on malware infections based on over 450 million executions of the Malicious Software Removal Tool (MSRT) every month. Microsoft is a member of AMTSO (Anti Malware Testing Standards Organization) and its charter includes defining test methodology so that there is a minimum quality bar to all testing of this type.“

It seems that PC Tools may have been rather hasty in their claim, however; with all the “added security features” and testing that Vista has undergone a 64% infection rate seems to be a bit high. Even with the security provided by UAC and Vista’s built in security, Austin Wilson recommends, and rightfully so, that users still run firewall and anti-virus software.

Sources:

http://www.scmagazineus.com/Report-Vista-…Windows-2000/article/110008/

http://blogs.msdn.com/windowsvist…-vista-windows-2000-and-malware.aspx

http://dkudin.spaces.live.com/…6B73AF165%21135.entry