Re: [W3af-develop] 2 ideas

2011-02-08 Thread Steve Pinkham
On 02/08/2011 05:15 AM, Taras wrote: Hi, all! There are 2 ideas: 1. What do you think about simple false-positive management in w3af? For example, we can add capability to read list of regex patterns from special file and test them against request before it will be reported. It can be

[W3af-develop] From OWASP summit 2011: Tools Interoperability (Data Instrumentation)

2011-02-08 Thread Steve Pinkham
I'm planning on remotely attending the following OWASP Summit session (as well as others), and I think it is relavent both to the w3af project and open source web appsec improvement in general. http://www.owasp.org/index.php/Summit_2011_Working_Sessions/Session056 Unfortunately, it's not

Re: [W3af-develop] Sprint #13 - Javier's playground

2011-02-08 Thread Javier Andalia
Hello everyone, The sprint 13 has finally been filled up. I included some tasks [1] that (when done) will make our lives happier :-) If you think that something else related to them should be included please let us know. Thanks! Javier [1]

Re: [W3af-develop] core/data/db/history.py and .trace files

2011-02-08 Thread Leandro Reox
A very common no-sql document related database are IBM Lotus Notes db ( .nsf ) . These dbs are usually used for team room applications or for storing transaccional data between IBM mainframe and other platforms like HP-NON STOP most seen on Banking environments. Inside IBM doors these nsf

Re: [W3af-develop] core/data/db/history.py and .trace files

2011-02-08 Thread Andres Riancho
Lean, Do you know if the format is open? Do we have a Python binding to write to them? Any clue on how they scale in performance when saving thousands of registries? Regards, On Tue, Feb 8, 2011 at 4:42 PM, Leandro Reox leandro.r...@gmail.com wrote: A very common no-sql document related

Re: [W3af-develop] core/data/db/history.py and .trace files

2011-02-08 Thread Leandro Reox
Andres, Sadly the format is not open. Theres a few ways to write and retrieve data via Python to this kind of databases (like jython + and the notes.jar classes - notessql drivers on win, etc). Regarding performance a 100.000 records with attachments databases are very common on IBM

Re: [W3af-develop] core/data/db/history.py and .trace files

2011-02-08 Thread Andres Riancho
The only issue with mongodb is that its a daemon, I'm not sure if we want to have mongod as a w3af dependency. It could complicate packaging and install process. Regards, -- Andres Riancho El feb 8, 2011 6:39 p.m., Leandro Reox leandro.r...@gmail.com escribió: Here is a living proof of MongoDB

Re: [W3af-develop] core/data/db/history.py and .trace files

2011-02-08 Thread Andres Riancho
Steve, On Tue, Feb 8, 2011 at 8:45 PM, Steve Pinkham steve.pink...@gmail.com wrote: On 02/03/2011 12:04 PM, Andres Riancho wrote: Do we know about any noSQL database that's file based like sqlite? Maybe we could use this small rewrite to compare the performance of those backends. Regards,

Re: [W3af-develop] core/data/db/history.py and .trace files

2011-02-08 Thread Andres Riancho
Steve, On Tue, Feb 8, 2011 at 9:07 PM, Andres Riancho andres.rian...@gmail.com wrote: Berkeley DB is what was used as a file based key-value store before sqlite, but has no major benefits in most uses over sqlite which is why it didn't spring to mind. ;-) If you have many threads writing

Re: [W3af-develop] core/data/db/history.py and .trace files

2011-02-08 Thread Steve Pinkham
On 02/08/2011 07:07 PM, Andres Riancho wrote: Steve, On Tue, Feb 8, 2011 at 8:45 PM, Steve Pinkham steve.pink...@gmail.com wrote: On 02/03/2011 12:04 PM, Andres Riancho wrote: Do we know about any noSQL database that's file based like sqlite? Maybe we could use this small rewrite to compare

Re: [W3af-develop] core/data/db/history.py and .trace files

2011-02-08 Thread Steve Pinkham
On 02/08/2011 08:08 PM, Andres Riancho wrote: Steve, noSQL servers are usually fast because they are in-memory systems. sqlite can be used in that mode also if you like. mongodb is not an in-memory db! In practice, it is. It stores all indexes in memory and uses memory mapped files. It

[W3af-develop] sqlite3 weirdness (AKA I hate python ;-)

2011-02-08 Thread Steve Pinkham
Meh. sqlite has been threadsafe since 2006, and the python adapter still won't let you use connections across multiple threads because you might have an old version. You're using an explicitly unsupported workaround (check_same_thread=False) that may cause dataloss due to optimisations in python