Search

How should applications legitimately requiring access to sensitive resources to carry out their functionality be granted access to those resources? The answer to this question depends on users. This article introduces user-driven access control, an alternate permission model that adheres to the principle of least privilege while reducing the burden on users to make explicit permission decisions. [ABSTRACT FROM PUBLISHER]

Vulnerability data sources are used by academics to build models, and by industry and government to assess compliance. Errors in such data sources therefore not only are threats to validity in scientific studies, but also might cause organizations, which rely on retro versions of software, to lose compliance. In this work, we propose an automated method to determine the code evidence for the presence of vulnerabilities in retro software versions. The method scans the code base of each retro version of software for the code evidence to determine whether a retro version is vulnerable or not. It identifies the lines of code that were changed to fix vulnerabilities. If an earlier version contains these deleted lines, it is highly likely that this version is vulnerable. To show the scalability of the method we performed a large scale experiments on Chrome and Firefox (spanning 7,236 vulnerable files and approximately 9,800 vulnerabilities) on the National Vulnerability Database (NVD). The elimination of spurious vulnerability claims (e.g. entries to a vulnerability database such as NVD) found by our method may change the conclusions of studies on the prevalence of foundational vulnerabilities. [ABSTRACT FROM AUTHOR]

Nowadays mobile devices includes a large variety of hardware components and sensors which are used by several applications for obtaining context information or creating new ways of interaction. At the beginning hardware access was limited for installed applications only (native applications) but day after day new web standards arises allowing accessing hardware component and sensor. Geolocation, for example, can be used from web sites in the same way and with equivalent results than in a native application. This article analyses the proximity sensor API (Application Programming Interface) and proposes it use for the detection of different events that can be used in a web environment. For example for improving navigation by going back to the home page or opening a menu by simply moving a finger over the sensor [ABSTRACT FROM PUBLISHER]

Typical applications based on remote sensing imagery start with a visual inspection and selection of scenes and regions of interest to be purchased. In this letter, we propose a so-called Earth observation (EO) epitome as a novel value-added interactive product. Basically, it comprises several image tiles, primitive features, metadata entries, a quick look of the image tiles, and semantic annotations of the image content. It comes with a browser that enables the end user to perform a visual inspection of the image content and semantic annotation of the image objects based on machine learning methods. The epitome offers a more complete description of the content of an EO product. It is envisaged that the epitome will be integrated into the TerraSAR-X Payload Ground Segment and will be offered via user services. [ABSTRACT FROM PUBLISHER]

This article introduces Linked Open Cube Analytics (LOCA) systems for performing statistical analysis on top of combined data. It explores LOCA systems' potential and challenges and presents a proof of concept of such a system. [ABSTRACT FROM PUBLISHER]

The web browser is one of the most significant applications on mobile devices such as smartphones. However, the user experience of mobile web browsing is undesirable because of the slow resource loading. To improve the performance of web resource loading, client-side cache has been adopted as a key mechanism. However, the existing passive measurement studies cannot comprehensively characterize the “client-side” cache performance of mobile web browsing. For example, most of these studies mainly focus on client-side implementations but not server-side configurations, suffer from biased user behaviors, and fail to study “miscached” resources. To address these issues, in this article, we present a proactive approach to making a comprehensive measurement study on client-side cache performance. The key idea of our approach is to proactively crawl resources from hundreds of websites periodically with a fine-grained time interval. Thus, we are able to uncover the resource update history and cache configurations at the server side, and analyze the cache performance in various time granularities. Based on our collected data, we build a new cache analysis model and study the upper bound of how high percentage of resources could potentially be cached and how effectively the caching works in practice. We report detailed analysis results of different websites and various types of web resources, and identify the problems caused by unsatisfactory cache performance. In particular, we identify two major problems— Redundant Transfer and Miscached Resource, which lead to unsatisfactory cache performance. We investigate three main root causes: Same Content , Heuristic Expiration, and Conservative Expiration Time, and discuss what mobile web developers can do to mitigate those problems. [ABSTRACT FROM PUBLISHER]

The security of computer systems often relies upon decisions and actions of end users. In this paper, we set out to investigate users’ susceptibility to cybercriminal attacks by concentrating at the most fundamental component governing user behavior—the human brain. We introduce a novel neuroscience-based study methodology to inform the design of user-centered security systems as it relates to cybercrime. In particular, we report on an functional magnetic resonance imaging study measuring users’ security performance and underlying neural activity with respect to two critical security tasks: 1) distinguishing between a legitimate and a phishing website and 2) heeding security (malware) warnings. We identify the neural markers that might be controlling users’ performance in these tasks, and establish relationships between brain activity and behavioral performance as well as between users’ personality traits and security behavior. Our results provide a largely positive perspective on users’ capability and performance vis-à-vis these crucial security tasks. First, we show that users exhibit significant brain activity in key regions associated with decision-making, attention, and problem-solving (phishing and malware warnings) as well as language comprehension and reading (malware warnings), which means that users are actively engaged in these security tasks. Second, we demonstrate that certain individual traits, such as impulsivity measured via an established questionnaire, are associated with a significant negative effect on brain activation in these tasks. Third, we discover a high degree of correlation in brain activity (in decision-making regions) across phishing detection and malware warnings tasks, which implies that users’ behavior in one task may potentially be predicted by their behavior in the other. Fourth, we discover high functional connectivity among the core regions of the brain, while users performed the phishing detection task. Finally, we discuss the broader impacts and implications of our work on the field of user-centered security, including the domain of security education, targeted security training, and security screening. [ABSTRACT FROM PUBLISHER]

Recent years have witnessed the increasing threat of phishing attacks on mobile computing platforms. In fact, mobile phishing is particularly dangerous due to the hardware limitations of mobile devices and the habits of mobile users. In this paper, we did a comprehensive study on the security vulnerabilities caused by mobile phishing attacks, including web page phishing attacks, application phishing attacks, and account registry phishing attacks. Existing schemes designed for web phishing attacks on personal computers (PCs) cannot effectively address the various phishing attacks on mobile devices. Hence, we propose MobiFish, which is a novel automated lightweight antiphishing scheme for mobile platforms. MobiFish verifies the validity of web pages, applications, and persistent accounts by comparing the actual identity to the claimed identity. MobiFish has been implemented on a Nexus 4 smartphone running the Android 4.2 operating system. We experimentally evaluate the performance of MobiFish with 100 phishing URLs and corresponding legitimate URLs, as well as phishing apps. The results show that MobiFish is very effective in detecting phishing attacks on mobile phones. [ABSTRACT FROM AUTHOR]

This research aims to describe the phases and the proper procedures for recovering storage device data, analyzing the computational forensics tools: Autopsy Forensic Browser and Foremost, used for information retrieval, review the evidence and give it probative value before a jury. Check which of the tools used is the best performer, stressing the runtime and the performance of these tools. [ABSTRACT FROM PUBLISHER]

Domain-generation algorithms (DGAs) allow attackers to manage infection-spreading websites and command-and-control (C&C) deployments by altering domain names on a timely basis. DGAs have made the infection and C&C architecture more robust and supportive for attackers. This detailed taxonomy of DGAs highlights the problem and offers solutions to combat DGAs through detection of drive-by download and C&C activity from the compromised machine. [ABSTRACT FROM PUBLISHER]

Web applications are getting closer to the performance of native applications taking advantage of new standard-based technologies. The recent HTML5 standard includes, among others, the Web Workers API that allows executing JavaScript applications on multiple threads, or workers. However, the internals of the browser’s JavaScript virtual machine does not expose direct relation between workers and running threads in the browser and the utilization of logical cores in the processor. As a result, developers do not know how performance actually scales on different environments and therefore what is the optimal number of workers on parallel JavaScript codes. This paper presents the first performance scalability analysis of parallel web apps with multiple workers. We focus on two case studies representative of different worker execution models. Our analyses show performance scaling on different parallel processor microarchitectures and on three major web browsers in the market. Besides, we study the impact of co-running applications on the web app performance. The results provide insights for future approaches to automatically find out the optimal number of workers that provide the best tradeoff between performance and resource usage to preserve system responsiveness and user experience, especially on environments with unexpected changes on system workload. [ABSTRACT FROM PUBLISHER]

The performance of user-facing applications is critical to client platforms. Many of these applications are event-driven and exhibit “bursty” behavior: the application is generally idle but generates bursts of activity in response to human interaction. We study one example of a bursty application, web-browsers, and produce two important insights: (1) Activity bursts contain false parallelism, bringing many cores out of a deep sleep to inefficiently render a single webpage, and (2) these bursts are highly compute driven, and thus scale nearly linearly with frequency. We show average performance gains/energy reductions of 14%/17% respectively on real hardware by statically moving threads from multiple cores to a single core. We then propose dynamic hardware driven thread migration and scheduling enhancements that detect these bursts, leading to further benefits. [ABSTRACT FROM PUBLISHER]

Embedded systems execute applications with varying performance requirements. These applications exercise the hardware differently depending on the computation task, generating varying workloads with time. Energy minimization with such workload and performance variations within (intra) and across (inter) applications is particularly challenging. To address this challenge, we propose an online approach, capable of minimizing energy through adaptation to these variations. At the core of this approach is a reinforcement learning algorithm that suitably selects the appropriate voltage/frequency scaling (VFS) based on workload predictions to meet the applications’ performance requirements. The adaptation is then facilitated and expedited through learning transfer, which uses the interaction between the application, runtime, and hardware layers to adjust the VFS. The proposed approach is implemented as a power governor in Linux and extensively validated on an ARM Cortex-A8 running different benchmark applications. We show that with intra- and inter-application variations, our proposed approach can effectively minimize energy consumption by up to 33% compared to the existing approaches. Scaling the approach to multicore systems, we also demonstrate that it can minimize energy by up to 18% with 2\times reduction in the learning time when compared with an existing approach. [ABSTRACT FROM AUTHOR]

With the emergence of online platforms for (social) sharing, collaboration and backing up, mobile users generate ever-increasing amounts of digital data, such as documents, photos, and videos, which they upload while on the go. Cellular Internet connectivity (e.g., 3G/4G) enables mobile users to upload their data but drains the battery of their devices and overloads mobile service providers. Wi-Fi data offloading overcomes the aforementioned issues for delay-tolerant data. However, it comes at the cost of constrained mobility for users, as they are required to stay within a given area while the data is uploaded. The up-link of the broadband connection of the access point often constitutes a bottleneck and incurs waiting times of up to tens of minutes. In this paper, we advocate the exploitation of the storage capabilities of common devices located on the Wi-Fi access point's LAN, typically residential gateways, NAS units or set-top boxes, to decrease the waiting time. We propose Hoop, a system for offloading upload tasks onto such devices. Hoop operates seamlessly on http(s) post , which makes it highly generic and widely applicable; it also requires limited changes on the gateways and on the web servers and none to existing protocols or browsers. Hoop is secure and, in a typical setting, reduces the waiting time by up to a factor of 46. We analyze the security of Hoop and evaluate its performance by correlating mobility traces of users with the position of the Wi-Fi access points of a leading community network (i.e., FON) that relies on major national ISPs. We show that, in practice, Hoop drastically decreases the delay between the time the photo is taken and the time it is uploaded, compared to regular Wi-Fi data offloading. We also demonstrate the practicality of Hoop by implementing it on a wireless router. [ABSTRACT FROM PUBLISHER]

The Internet revolution has led to the rise of trackers--online tracking services that shadow users' browsing activity. Despite the pervasiveness of online tracking, few users install privacy-enhancing plug-ins. [ABSTRACT FROM AUTHOR]

A content security policy (CSP) can help Web application developers and server administrators better control website content and avoid vulnerabilities to cross-site scripting (XSS). In experiments with a prototype website, the authors' CSP implementation successfully mitigated all XSS attack types in four popular browsers. [ABSTRACT FROM AUTHOR]

NoSQL data storage systems have become very popular due to their scalability and ease of use. Unfortunately, they lack the security measures and awareness that are required for data protection. Although the new data models and query formats of NoSQL data stores make old attacks such as SQL injections irrelevant, they give attackers new opportunities for injecting their malicious code into the statements passed to the database. Analysis of the techniques for injecting malicious code into NoSQL data stores provides examples of new NoSQL injections as well as Cross-Site Request Forgery attacks, allowing attackers to bypass perimeter defenses such as firewalls. Analysis of the source of these vulnerabilities and present methodologies can mitigate such attacks. Because code analysis alone is insufficient to prevent attacks in today's typical large-scale deployment, certain mitigations should be done throughout the entire software life cycle. [ABSTRACT FROM PUBLISHER]

Website publishers can derive enormous performance benefits and cost savings by directing traffic to their sites through content distribution networks (CDNs). However, publishers who use CDNs must trust they won't modify the site's JavaScript, CSS, images, or other media en route to end users. A CDN that violates this trust could inject ads into websites, downsample media to save bandwidth, or, worse, inject malicious JavaScript code to steal user secrets it couldn't otherwise access. The authors present Stickler, a system for website publishers that guarantees the end-to-end authenticity of content served to users that simultaneously lets publishers reap the benefits of CDNs. Crucially, Stickler achieves these guarantees without requiring modifications to the browser. [ABSTRACT FROM PUBLISHER]

Everyone loves Web 2.0 applications. They are easy to use and fast, and can be accessed from any computer or smartphone without installation. They let us easily communicate and share data with one another, shop simply, and access vast amounts of information. However, they're also frequently mentioned in connection with novel exploits, data leaks, or identity theft. Active content, tight integration, and the overall complexity of the continuously evolving Web 2.0 technology create new risks that we can hardly grasp. Turning back on the technology is not a solution because we would lose many features that we've come to rely on. But how can we achieve both a pleasant user experience and security in a place as messy as the Web 2.0 landscape? First, we can look to understand the wide range of attacks as well as the complex security situation and attack surface of Web 2.0 applications. Second, we can study the open research challenges in this field and assess how best to approach these issues. [ABSTRACT FROM PUBLISHER]

Until recently in Earth history, very large herbivores (mammoths, ground sloths, diprotodons, and many others) occurred in most of the World's terrestrial ecosystems, but the majority have gone extinct as part of the late-Quaternary extinctions. How has this large-scale removal of large herbivores affected landscape structure and ecosystem functioning? In this review, we combine paleo-data with information from modern exclosure experiments to assess the impact of large herbivores (and their disappearance) on woody species, landscape structure, and ecosystem functions. In modern landscapes characterized by intense herbivory, woody plants can persist by defending themselves or by association with defended species, can persist by growing in places that are physically inaccessible to herbivores, or can persist where high predator activity limits foraging by herbivores. At the landscape scale, different herbivore densities and assemblages may result in dynamic gradients in woody cover. The late-Quaternary extinctions were natural experiments in large-herbivore removal; the paleoecological record shows evidence of widespread changes in community composition and ecosystem structure and function, consistent with modern exclosure experiments. We propose a conceptual framework that describes the impact of large herbivores on woody plant abundance mediated by herbivore diversity and density, predicting that herbivore suppression of woody plants is strongest where herbivore diversity is high. We conclude that the decline of large herbivores induces major alterations in landscape structure and ecosystem functions. [ABSTRACT FROM AUTHOR]

General visualization tools typically require manual specification of views: analysts must select data variables and then choose which transformations and visual encodings to apply. These decisions often involve both domain and visualization design expertise, and may impose a tedious specification process that impedes exploration. In this paper, we seek to complement manual chart construction with interactive navigation of a gallery of automatically-generated visualizations. We contribute Voyager, a mixed-initiative system that supports faceted browsing of recommended charts chosen according to statistical and perceptual measures. We describe Voyager's architecture, motivating design principles, and methods for generating and interacting with visualization recommendations. In a study comparing Voyager to a manual visualization specification tool, we find that Voyager facilitates exploration of previously unseen data and leads to increased data variable coverage. We then distill design implications for visualization tools, in particular the need to balance rapid exploration and targeted question-answering. [ABSTRACT FROM AUTHOR]

Bibliographic data such as collections of scientific articles and citation networks have been studied extensively in information visualization and visual analytics research. Powerful systems have been built to support various types of bibliographic analysis, but they require some training and cannot be used to disseminate the insights gained. In contrast, we focused on developing a more accessible visual analytics system, called SurVis, that is ready to disseminate a carefully surveyed literature collection. The authors of a survey may use our Web-based system to structure and analyze their literature database. Later, readers of the survey can obtain an overview, quickly retrieve specific publications, and reproduce or extend the original bibliographic analysis. Our system employs a set of selectors that enable users to filter and browse the literature collection as well as to control interactive visualizations. The versatile selector concept includes selectors for textual search, filtering by keywords and meta-information, selection and clustering of similar publications, and following citation links. Agreement to the selector is represented by word-sized sparkline visualizations seamlessly integrated into the user interface. Based on an analysis of the analytical reasoning process, we derived requirements for the system. We developed the system in a formative way involving other researchers writing literature surveys. A questionnaire study with 14 visual analytics experts confirms that SurVis meets the initially formulated requirements. [ABSTRACT FROM AUTHOR]

The aim of the study was to establish the nutritional value of different browse species utilized by communal livestock farmers, in various local municipalities of Amathole and O.R. Tambo districts of the Eastern Cape, South Africa. Leaves from twelve different browse species i.e. Vachellia karroo, Prunus persica, Ziziphus mucronata, Diospyros dichrophylla, Vepris lanceolata, Haemanthus coccineus, Grewia occidentalis, Schotia latifolia, Calpurnia aurea, Olea europaea subsp. africana, Cordia rudis and Mimusops obovata, were identified and collected during the dry season (June). The chemical composition of these samples was determined using standard laboratory analytical techniques. Nutritional elements of importance analyzed included: Ash, Ca (Calcium), Mg (Magnesium), K (Potassium), Na (Sodium), P (Phosphorous), Zn (Zinc), Cu (Copper), CP (Crude Protein), CF (Crude Fiber), Neutral Detergent Fiber (NDF) and Acid Detergent Fiber (ADF). It was found that, CP, CF and Ash content of the leaves ranged from 1.9-18.5%, 1.7-47.6% and 6.0-20.5% respectively. The NDF and ADF ranged from 17.6-37.26% and 17.6-69.54% respectively. Minerals such as Ca, Mg, K, Na and P ranged from 1.2-9.71%; 0.0-1.436%; 0.0-2.08%; 0.0-0.072% respectively, whilst Zn, Cu, Fe and Mn values were 0.7-23.6 ppm, 6-1 ppm, 3.0-566.9 ppm and 4-662 ppm respectively. In the light of the present data, it can be concluded that certain browse species are within normal range in nutritionally important elements. However, in some plants, imbalances do occur and additional supplementary feeding should be considered. [ABSTRACT FROM AUTHOR]

The role of grazers in determining vegetation community compositions and structuring plant communities is well recognised in grassy systems. The role of browsers in affecting savanna woody plant communities is less clear. We used three long-term exclosures in the Kruger National Park to determine the effect of browsers on species compositions and population structures of woody communities. Species assemblages, plant traits relating to browsing and soil nutrients were compared inside and outside of the exclosures. Our results showed that browsers directly impact plant species distributions, densities and population structures by actively selecting for species with traits which make them desirable to browsers. Species with high leaf nitrogen, low total phenolic content and low acid detergent lignin appeared to be favoured by herbivores and therefore tend to be rare outside of the exclosures. This study also suggested that browsers have important indirect effects on savanna functioning, as the reduction of woody cover can result in less litter of lower quality, which in turn can result in lower soil fertility. However, the magnitude of browser effects appeared to depend on inherent soil fertility and climate. Conservation implications: Browsers were shown to have significant impacts on plant communities. They have noticeable effects on local species diversity and population structure, as well as soil nutrients. These impacts are shown to be related to the underlying geology and climate. The effects of browsers on woody communities were shown to be greater in low rainfall, fertile areas compared to high rainfall, infertile soils.

Mobile phone users access content from websites using their browsers and are tracked by cookies. Users also access content using mobile applications, which are tracked by totally separate identifiers, ?device identifiers.? Traditional approaches to tracking users fail to tie these two domains together. Hence, remote ?fingerprinting? techniques have been suggested that extract set of attributes of a phone to create an almost unique identifier to track the phone user. We present a study of various fingerprinting techniques used at different layers of the networking protocol stack. We highlight the differences between fingerprinting computers and fingerprinting phones. Since fingerprinting is also a threat to user privacy, we present the current research and suggest future research directions in addressing the privacy issues. [ABSTRACT FROM PUBLISHER]

Despite its widespread adoption and popularity, the Hypertext Transfer Protocol (HTTP) suffers from fundamental performance limitations. SPDY, a recently proposed alternative to HTTP, tries to address many of the limitations of HTTP (e.g., multiple connections, setup latency). In this paper, we perform a detailed measurement study to understand the benefits of using SPDY over cellular networks. Through careful measurements conducted over 4 months, we provide a detailed analysis of the performance of HTTP and SPDY, how they interact with the various layers, and their implications on Web design. Our results show that unlike in wired and 802.11 networks, SPDY does not clearly outperform HTTP over cellular networks. We identify negative interactions between the protocols used for Web access (HTTP/SPDY over TCP) and cellular radio resource management as the underlying cause. Overall performance suffers when devices go through a cellular radio state promotion after an idle period, and the consequent increase in latency. This impacts SPDY more because of the use of a single TCP connection. We conclude that a viable solution has to account for these unique cross-layer dependencies to achieve improved Web performance over cellular networks. [ABSTRACT FROM AUTHOR]

Netflix and Hulu are leading Over-the-Top (OTT) content service providers in the US and Canada. Netflix alone accounts for 29.7% of the peak downstream traffic in the US in 2011. Understanding the system architectures and performance of Netflix and Hulu can shed light on the design of such large-scale video streaming platforms, and help improving the design of future systems. In this paper, we perform extensive measurement study to uncover their architectures and service strategies. Netflix and Hulu bear many similarities. Both Netflix and Hulu video streaming platforms rely heavily on the third-party infrastructures, with Netflix migrating that majority of its functions to the Amazon cloud, while Hulu hosts its services out of Akamai. Both service providers employ the same set of three content distribution networks (CDNs) in delivering the video contents. Using active measurement study, we dissect several key aspects of OTT streaming platforms of Netflix and Hulu, e.g., employed streaming protocols, CDN selection strategy, user experience reporting, etc. We discover that both platforms assign the CDN to a video request without considering the network conditions and optimizing the user-perceived video quality. We further conduct the performance measurement studies of the three CDNs employed by Netflix and Hulu. We show that the available bandwidths on all three CDNs vary significantly over the time and over the geographic locations. We propose a measurement-based adaptive CDN selection strategy and a multiple-CDN-based video delivery strategy that can significantly increase users' average available bandwidth. [ABSTRACT FROM AUTHOR]

Video streaming from sensors and miniaturized devices is attractive for a wide range of web-based applications, e.g., remote surveillance. Existing web-based video streaming frameworks, such as the hypertext transfer protocol (HTTP) live streaming (HLS) and the motion picture experts group’s dynamic adaptive streaming over HTTP (MPEG-DASH), have dependencies between the individual video segments and a manifest file that contains video metadata. Also, existing web-based video players are limited to fetching video segments over TCP/IP networks. The video segment dependencies complicate video segment distribution by resource-constrained source nodes, which may employ non-TCP/IP protocols, such as Zigbee. This paper proposes and evaluates a wireless video sensor network platform compatible DASH (WVSNP-DASH) framework and a WVSNP-DASH player (WDP) for flexible web-based access of video from sensors and other miniaturized source nodes. The WVSNP-DASH framework is based on independently playable video segments with a specific naming syntax that conveys elementary metadata so as to facilitate flexible search, transfer, distribution, and playback. The WDP employs elementary processes of version 5 of the hypertext markup language (HTML5) for video buffering and playback. Video segments are fetched into the HTML5 file system space, permitting flexible video fetching over a wide range of protocols, including sensor network protocols. Comparative evaluations of a WDP prototype with optimized HLS and MPEG-DASH players indicate that WDP has low client (receiver) load, while providing significant potential for power savings on the source node serving the video streams. [ABSTRACT FROM PUBLISHER]

Most modern smart TV set-top boxes support internet connection and allow the user to install and run more advanced application programs or plugins/add-ons based on a specific platform. It means that a smart TV set-top box can be a good candidate to act as a hub that combines a wide variety of solutions for smart home services. This paper proposes a home appliance control framework based on a smart TV set-top box. As a core component, a home gateway software module is installed on the smart TV set-top box. And the architecture of the home gateway module is designed so that a home appliance control driver is installed only when necessary. To enable the user to control their home appliances in any place using a Web-based application or a Web browser, the proposed framework supports a WebSocket protocol-based data communication and comprises a Web server where each set-top box?s network location is registered. The proposed framework is verified with a demonstration on a small-scale home model. Both IP-based and serial communication-based home appliances are included in the demonstration system. The demonstration examples show that consumers can control various types of home appliances in any place through a smart TV set-top box solution. [ABSTRACT FROM AUTHOR]

This paper introduces the solar lab notebook (SLN), an electronic lab notebook (ELN) for improving the process of recording and sharing solar related digital information in an organized manner. SLN is a pure web-based application (available online: http://umbra.nascom.nasa.gov/sln) that runs client-side only, employing a clean and very friendly graphical user interface (GUI) design, and thus providing a true cross-platform user experience. Furthermore, SLN leverages unique technologies offered by modern web browsers, such as the FileReader API, the Blob interface, and Local Storage mechanism; it is coded entirely using HTML5, CSS3, and JavaScript, and powered by the extremely well-documented extensible markup language (XML) file format. For high-security labs, it can be utilized as an ultra-portable and secure digital notebook solution, since it is functionally self-contained, and does not require any server-side process running on either the local or a remote system. Finally, the W3C XML Schema language is used to define a list of rules, namely a data standard, that an SLN file must conform to, in order to be valid. In this way, developers are able to implement their own validation functions in their projects, or use one of the freely available tools to check if a data file is properly structured. Similarly, scientific groups at different labs can easily share information, being confident about the integrity of the exchanged data. [ABSTRACT FROM PUBLISHER]

The advances in communication networks and web technologies, in conjunction with the improved connectivity of test and measurement devices make it possible to implement e-learning applications that encompass the whole learning process. In the field of electrical engineering, automation or mechatronics, it means not only lectures, tutorials, demos and simulations, but also practical labwork for training with real-world devices that are controlled remotely. To make e-labs attractive, they should be easily implemented and accessed on the web by a client. This keypoint raises technical issues that are recalled in this paper. Nonetheless pedagogical issues are equally important. The benefit of a remote lab must be evaluated and compared to simulation labs or hands-on. Here, to foster student motivation, a game-like scenario embedded in a learning management system is proposed. [ABSTRACT FROM PUBLISHER]

Web browsers are one of the most pervasive applications for an entire range of personal computing platforms--from mobile devices to desktops. Using Web technologies (HTML, CSS, JavaScript) to build "Web apps" has the promise of creating portable applications for all platforms. Thus browsers become application containers, requiring increased performance from browser engines. Here, the authors discuss advances in browser technologies that exploit multicore processing. They use the Zoomm browser and the MuscalietJS JavaScript engine as running examples of highly concurrent Web browser and JavaScript engines. They show how concurrency is effectively exploited at different levels: to speed up computation performance, preload network resources, and preprocess resources outside the critical path to speed up page loading and Web workloads. [ABSTRACT FROM PUBLISHER]

Mobile browsers are increasingly being relied upon to perform security sensitive operations. Like their desktop counterparts, these applications can enable SSL/TLS to provide strong security guarantees for communications over the web. However, the drastic reduction in screen size and the accompanying reorganization of screen real-estate significantly changes the use and consistency of the security indicators and certificate information that alert users of site identity and the presence of strong cryptographic algorithms. In this paper, we perform the first measurement of the state of critical security indicators in mobile browsers. We evaluate ten mobile and two tablet browsers, representing over 90% of the market share, against the recommended guidelines for web user interface to convey security set forth by the World Wide Web Consortium (W3C). While desktop browsers follow the majority of guidelines, our analysis shows that mobile browsers fall significantly short. We also observe notable inconsistencies across mobile browsers when such mechanisms actually are implemented. We show where and how these failures on mobile browsers eliminate clues previously designed for, and still present in, desktop browsers to detect attacks such as phishing and man-in-the-middle. Finally, we offer advice on where current standards are unclear or incomplete. [ABSTRACT FROM AUTHOR]

Mozilla's decision to release a new version of its products every six weeks (instead of every year) profoundly affected developers and users and was accompanied by significant changes in the release process. Were such changes enough to allow Mozilla to move faster without breaking things? What lessons can be learned from Mozilla's adoption of rapid releases? To answer these questions, researchers analyzed tens of thousands of commits and bug reports from Firefox and talked to its developers. The results show that, because of integration repositories, build sheriffs, and better testing tools, broken patches were backed out (reverted) earlier, rendering the release process more stable. [ABSTRACT FROM PUBLISHER]

Smartphone based web browsing wastes a lot of power when downloading webpages due to the special characteristics of the wireless radio interface. In this paper, we identify these special characteristics, and address power consumption issues through two novel techniques. First, we reorganize the computation sequence of the web browser when loading a webpage, so that the web browser can first run the computations that will generate new data transmissions and retrieve these data from the web server. Then, the web browser can put the wireless radio interface into low power state, release the radio resource, and then run the remaining computations. Second, we introduce a practical data mining based method to predict the user reading time of webpages, based on which the smartphone can switch to low power state when the reading time is longer than a threshold. To demonstrate the effectiveness of our energy-aware approaches, we develop a testbed with Android phones on T-Mobile UMTS network. Experimental results show that our approach can reduce the power consumption of smartphone by more than 30 percent during web browsing. Moreover, our solution can further reduce the webpage loading time and increase the network capacity. [ABSTRACT FROM AUTHOR]

Swarmlets are applications and services that leverage networked sensors and actuators with cloud services and mobile devices. This article offers a way to construct swarmlets by composing "accessors,"' which are wrappers for sensors, actuators, and services, that export an actor interface. Actor semantics provides ways to compose accessors with disciplined and understandable concurrency models, while hiding from the swarmlet the details of the mechanisms by which the accessor provides sensor data, controls an actuator, or accesses a service. This architecture can leverage the enormous variety of mechanisms that have emerged for such interactions, including HTTP, Websockets, CoAP, and MQTT. Recognizing that these standards have emerged because of huge variability of requirements for bandwidth, latency, and security, accessors embrace heterogeneity instead of attempting to homogenize. [ABSTRACT FROM PUBLISHER]

Today, millions of users all over the world visit websites using their Smartphones. Mobile devices have several features that may contribute to worsen the user experience when using mobile webs, such as: small displays and virtual keyboards, poor precision to select elements using the finger as cursor. In addition, the mobile Web has a peculiar feature, is not always used in the same place or in the same situations; in many cases environmental factors can adversely affect the user experience while he is using a web application, adverse situations derived from the ambient may be different: noise pollution, an excess of light, not being able to see well the letters while walking, etc. This research presents a novel mobile Web paradigm that allows the adaptation of web applications depending on the environment. The proposed solution introduces a novel Mobile Web Browser based on the principles of the Ambient Intelligence (AmI). This Web browser uses the Smartphone's hardware elements as sensors and microphones to capture the environmental information, which will be intelligently analyzed to detect events and other situations. The identified situations will be communicated to the web application, so that appropriate adaptation are made and there by improve the user experience. [ABSTRACT FROM PUBLISHER]

Mobile Web browsing advancements have largely been driven by the single-minded pursuit of performance. This article takes a different stance and examines the energy efficiency of mobile Web browsing. Focusing on both the network and CPU, the authors find that generational advancements in network technology have reached a point where the mobile CPU is starting to have noticeable impact on Web browsing performance and energy consumption. Achieving energy-efficient mobile Web browsing requires considering both CPU and network capabilities (that is, latency). The authors show that under different network latency conditions, achieving energy-efficient mobile Web browsing mandates different CPU performance capabilities. It is important to understand and leverage such interactions between the network and CPU to deliver high mobile Web performance while maintaining a low energy footprint, which current OS dynamic voltage and frequency scaling governors fail to achieve. The authors' findings suggest that designing future high-performance and energy-efficient mobile Web clients implies looking beyond individual components and taking a full system perspective. [ABSTRACT FROM PUBLISHER]

To provide more relevant content and better responsiveness, many websites customize their services according to users' geolocations. However, if geo-oriented websites leave location-sensitive content in the browser cache, other sites can sniff that content via side channels. The authors' case studies demonstrate the reliability and power of geo-inference attacks, which can measure the timing of browser cache queries and track a victim's country, city, and neighborhood. Existing defenses cannot effectively prevent such attacks, and additional support is required for a better defense deployment. [ABSTRACT FROM PUBLISHER]

Most modern Web applications depend on the integration of code from third-party providers, such as JavaScript libraries and advertisements. Because the included code runs within the page's security context, it represents an attractive attack target, allowing the compromise of numerous Web applications through a single attack vector (such as a malicious advertisement). Such opportunistic attackers aim to execute low-profile, nontargeted, widely applicable data-gathering attacks, such as the silent extraction of user-specific data and authentication credentials. In this article, the authors show that third-party code inclusion is rampant, even in privacy-sensitive applications such as online password managers, thereby potentially exposing the user's most sensitive data to attackers. They propose protected Web components, which leverage the newly proposed Web components, repurposing them to protect private data against opportunistic attacks, by hiding static data in the Document Object Model (DOM) and isolating sensitive interactive elements within a component. This article is part of a special issue on IT security. [ABSTRACT FROM AUTHOR]