Quick Review of Ricoh GXR Digital Camera

Ricoh GXR is an interchangeable unit camera system in which lenses are changed by using a slide-in mount system to attach camera units to the body. The camera also features Built-in flash and accessory shoe, DMI connecto and a 3.0-inch 920,000 pixels transparent LCD.  The camera measures 114 x 70 x 29mm (4.5 x 2.7 x 1.1 in) and weighs 160g (5.6 oz).

The GXR launches with two very different optional lens modules. Although the body is very thin, how pocketable the camera is depends entirely on the lens module mounted: the S10 zoom unit maintains the low profile when not in use (it collapses when powered down) but the A12 prime is a fairly large unit.

Ricoh GXR: Key features

• Unique flat sliding lens mount
• Interchangeable sealed lens/sensor units
• Compact Magnesium Alloy die-cast body with 'GR coating'
• Extensive customization options and external controls
• 3.0" 920,000 pixel LCD
• Built-in flash and accessory shoe
• Optional electronic viewfinder
• HDMI connector

Each lens unit contains instructions and parameters specific to its own sensor and optics, meaning that different lens units will change slightly the features, behavior and performance of the camera body when attached. Some of the lens unit dependant attributes (that we currently know of or can deduce) include:

• Image processing parameters
• Noise reduction
• Menu options - lens units define what menus you see
• Distortion correction (and, presumably, other lens corrections)
• Shutter speed and aperture ranges
• Program mode parameters ('program lines')
• Specific features (manual focus ring, sensor-shift stabilization etc)
• Focus speed
• Continuous shooting speed
• Buffer (no of frames and speed)
• Movie capture capabilities (resolution and frame rate)

Quick Review of Ricoh GXR Digital Camera

Ricoh GXR is an interchangeable unit camera system in which lenses are changed by using a slide-in mount system to attach camera units to the body. The camera also features Built-in flash and accessory shoe, DMI connecto and a 3.0-inch 920,000 pixels transparent LCD.  The camera measures 114 x 70 x 29mm (4.5 x 2.7 x 1.1 in) and weighs 160g (5.6 oz).

The GXR launches with two very different optional lens modules. Although the body is very thin, how pocketable the camera is depends entirely on the lens module mounted: the S10 zoom unit maintains the low profile when not in use (it collapses when powered down) but the A12 prime is a fairly large unit.

Ricoh GXR: Key features

• Unique flat sliding lens mount
• Interchangeable sealed lens/sensor units
• Compact Magnesium Alloy die-cast body with 'GR coating'
• Extensive customization options and external controls
• 3.0" 920,000 pixel LCD
• Built-in flash and accessory shoe
• Optional electronic viewfinder
• HDMI connector

Each lens unit contains instructions and parameters specific to its own sensor and optics, meaning that different lens units will change slightly the features, behavior and performance of the camera body when attached. Some of the lens unit dependant attributes (that we currently know of or can deduce) include:

• Image processing parameters
• Noise reduction
• Menu options - lens units define what menus you see
• Distortion correction (and, presumably, other lens corrections)
• Shutter speed and aperture ranges
• Program mode parameters ('program lines')
• Specific features (manual focus ring, sensor-shift stabilization etc)
• Focus speed
• Continuous shooting speed
• Buffer (no of frames and speed)
• Movie capture capabilities (resolution and frame rate)

Quick Review of Ricoh GXR Digital Camera

Ricoh GXR is an interchangeable unit camera system in which lenses are changed by using a slide-in mount system to attach camera units to the body. The camera also features Built-in flash and accessory shoe, DMI connecto and a 3.0-inch 920,000 pixels transparent LCD.  The camera measures 114 x 70 x 29mm (4.5 x 2.7 x 1.1 in) and weighs 160g (5.6 oz).

The GXR launches with two very different optional lens modules. Although the body is very thin, how pocketable the camera is depends entirely on the lens module mounted: the S10 zoom unit maintains the low profile when not in use (it collapses when powered down) but the A12 prime is a fairly large unit.

Ricoh GXR: Key features

• Unique flat sliding lens mount
• Interchangeable sealed lens/sensor units
• Compact Magnesium Alloy die-cast body with 'GR coating'
• Extensive customization options and external controls
• 3.0" 920,000 pixel LCD
• Built-in flash and accessory shoe
• Optional electronic viewfinder
• HDMI connector

Each lens unit contains instructions and parameters specific to its own sensor and optics, meaning that different lens units will change slightly the features, behavior and performance of the camera body when attached. Some of the lens unit dependant attributes (that we currently know of or can deduce) include:

• Image processing parameters
• Noise reduction
• Menu options - lens units define what menus you see
• Distortion correction (and, presumably, other lens corrections)
• Shutter speed and aperture ranges
• Program mode parameters ('program lines')
• Specific features (manual focus ring, sensor-shift stabilization etc)
• Focus speed
• Continuous shooting speed
• Buffer (no of frames and speed)
• Movie capture capabilities (resolution and frame rate)

Bug: Lessons for Developers

Sanitize all inputs. That includes every bit of data processed by the application, whether loaded from a Facebook user’s profile, loaded from a database, submitted with a form, or received from the query string of an address. Never assume that a given parameter will be clean or of the expected type.

Sanitize all outputs. When displaying a notice or error message, load predetermined strings instead of using dynamic inputs. Never reuse the address of a page without fitering it for injection attempts. Filter any information you output to an application page or via an AJAX interface.

Avoid user-generated HTML. Generally, users should never be allowed to input HTML, FBML, or other rich-text formats. When allowing rich-text data, use pre-built, tested code for processing and displaying it, rathering than trying to create your own filters.

Check every page. Many vulnerabilities appear in secondary pages, such as ad loaders or AJAX interfaces. Verify security precautions in every part of the application. If possible, consider storing secondary files in a folder other than that of the application’s canvas pages.

Verify Facebook sessions. Never rely on a cookie, a query string, or data generated within the application to verify the current user. Facebook provides applications with session information they can always check before making requests or loading information.

Use server whitelisting. If your application does not use AJAX or does not otherwise make requests using the Facebook JavaScript API, take advantage of the server whitelist feature in the application properties and only allow requests from your server.

Understand third-party code. Take the time to examine any code given to you by other developers, such as JavaScript tools or advertising network receiver files, before including them in your application. In particular, third-party code that arnesses a user’s session secret violates rules given by Facebook.

Don’t simply obfuscate. Never rely on JavaScript obfuscation or compression to hide vulnerabilities in application pages. Such techniques may slow down an attacker for a short while, but they can always be worked around or reversed.

Educate your users. Avoid incorporating design patterns that train users to accept bad practices, such as entering third-party passwords. Communicate clearly your policies on privacy, data retention, and information security.

Bug: Lessons for Developers

Sanitize all inputs. That includes every bit of data processed by the application, whether loaded from a Facebook user’s profile, loaded from a database, submitted with a form, or received from the query string of an address. Never assume that a given parameter will be clean or of the expected type.

Sanitize all outputs. When displaying a notice or error message, load predetermined strings instead of using dynamic inputs. Never reuse the address of a page without fitering it for injection attempts. Filter any information you output to an application page or via an AJAX interface.

Avoid user-generated HTML. Generally, users should never be allowed to input HTML, FBML, or other rich-text formats. When allowing rich-text data, use pre-built, tested code for processing and displaying it, rathering than trying to create your own filters.

Check every page. Many vulnerabilities appear in secondary pages, such as ad loaders or AJAX interfaces. Verify security precautions in every part of the application. If possible, consider storing secondary files in a folder other than that of the application’s canvas pages.

Verify Facebook sessions. Never rely on a cookie, a query string, or data generated within the application to verify the current user. Facebook provides applications with session information they can always check before making requests or loading information.

Use server whitelisting. If your application does not use AJAX or does not otherwise make requests using the Facebook JavaScript API, take advantage of the server whitelist feature in the application properties and only allow requests from your server.

Understand third-party code. Take the time to examine any code given to you by other developers, such as JavaScript tools or advertising network receiver files, before including them in your application. In particular, third-party code that arnesses a user’s session secret violates rules given by Facebook.

Don’t simply obfuscate. Never rely on JavaScript obfuscation or compression to hide vulnerabilities in application pages. Such techniques may slow down an attacker for a short while, but they can always be worked around or reversed.

Educate your users. Avoid incorporating design patterns that train users to accept bad practices, such as entering third-party passwords. Communicate clearly your policies on privacy, data retention, and information security.

Bug: Lessons for Developers

Sanitize all inputs. That includes every bit of data processed by the application, whether loaded from a Facebook user’s profile, loaded from a database, submitted with a form, or received from the query string of an address. Never assume that a given parameter will be clean or of the expected type.

Sanitize all outputs. When displaying a notice or error message, load predetermined strings instead of using dynamic inputs. Never reuse the address of a page without fitering it for injection attempts. Filter any information you output to an application page or via an AJAX interface.

Avoid user-generated HTML. Generally, users should never be allowed to input HTML, FBML, or other rich-text formats. When allowing rich-text data, use pre-built, tested code for processing and displaying it, rathering than trying to create your own filters.

Check every page. Many vulnerabilities appear in secondary pages, such as ad loaders or AJAX interfaces. Verify security precautions in every part of the application. If possible, consider storing secondary files in a folder other than that of the application’s canvas pages.

Verify Facebook sessions. Never rely on a cookie, a query string, or data generated within the application to verify the current user. Facebook provides applications with session information they can always check before making requests or loading information.

Use server whitelisting. If your application does not use AJAX or does not otherwise make requests using the Facebook JavaScript API, take advantage of the server whitelist feature in the application properties and only allow requests from your server.

Understand third-party code. Take the time to examine any code given to you by other developers, such as JavaScript tools or advertising network receiver files, before including them in your application. In particular, third-party code that arnesses a user’s session secret violates rules given by Facebook.

Don’t simply obfuscate. Never rely on JavaScript obfuscation or compression to hide vulnerabilities in application pages. Such techniques may slow down an attacker for a short while, but they can always be worked around or reversed.

Educate your users. Avoid incorporating design patterns that train users to accept bad practices, such as entering third-party passwords. Communicate clearly your policies on privacy, data retention, and information security.

Lessons for Facebook

Stop the charade. Nearly all instances of user information and content are essentially public. Many users have an understanding of privacy and control not reflected by the findings of this series and others. Either take necessary action to address these issues, or drop illusory privacy controls.

Talk to developers. Several resources exist for helping developers get started on the Platform, but Facebook has published much less content reminding developers of security precautions. If you associate your brand with third-party code, you have a reponsibility to help ensure the safety of that code.

Truly verify applications. The current Verified Applications program apparently does not address basic security flaws. Also, while opening the floodgates to any application has benefits, it also poses serious risks that may justify putting a few limits or checks in place.

Limit application access. While it’s encouraging to hear that Facebook will be adding granular access controls in response to the Canadian Privacy Commissioner, it’s disheartening that such steps took so long and are still nearly a year off from full implementation.

Take clickjacking seriously. This series has only begun to demonstrate the implications of clickjacking. Single-click authorization of applications, even when one exempts from the Platform, only adds to the danger of clickjacking on Facebook pages.

Improve request verification. The Facebook JavaScript API may provide much useful functionality, but it also opens the door to simple API requests with merely a session secret. Other means exist for ensuring that requests come legitimately from an application instead of an attacker.

Distinguish your brand. With the current Facebook Platform, any vulnerability in a third-party application becomes a vulnerability for Facebook. Either users should be able to trust applications to the same degree as Facebook, or Facebook should more clearly distinguish third-party content.

Educate your users. People click applications without a second thought to the risks of rogue applications or possible security problems. Users may seek to share personal information with friends, but fail to realize how that information is used by third-party code.