One of the very best frameworks to build new sites on is Twitter Bootstrap. Mobile-first, lightweight and powerful; it’s a great starting point.

The only issues with Bootstrap are that it’s both easily recognized due to extensive use, and time-consuming to modify due to its comprehensive approach.

Solving these problems are 10 premium Bootstrap templates from Bootstraptor. Use them to extend Bootstrap, get a headstart on customizing for your clients, or use them as they are. And thanks to our sister-site, MightyDeals.com, you can get these these 10 premium templates for $10; that’s just $1 per template!

All templates are built with valid HTML and use responsive techniques to ensure they perform perfectly across a complete range of devices. But that’s not all, the precise coding of Bootstrap means the templates are primed for an SEO campaign, and once customers have found the site, the clean design makes them super user-friendly.

There are business templates, landing pages, parallax templates, multi-page and single-pages, scroller templates and pricing tables. The contemporary designs are ideal for updating out-of-date sites.

This fantastic 74% discount deal is available for a limited time, so jump over to MightyDeals.com and grab it while you can.

Have you developed a site with Bootstrap? How easy did you find it to extend? Let us know in the comments.

16 Professional Royalty-Free Music Tracks – only $17!

Ensuring that attackers don’t forge requests in your web applications can be a tricky businesses, one that often requires a hand-rolled solution.

As soon as you have a session, you need to start thinking about cross site request forgery (CSRF). Every request to your site will contain authentication cookies, and HTML forms don’t abide by the same origin policy (SOP).

One method of ensuring that destructive requests (PUTs/POSTs/DELETEs) to your site are made from your domain, is by only allowing requests with a Content-Type header of application/json. The only way to set this header is via Ajax, and Ajax requests are limited to the same domain.

However, there have been active vectors in the past that have allowed header injection (such as some of the Flash exploits), and Egor, who is the expert in these things, assures me it’s not enough.

The classic method of preventing CSRF attacks is via a token that you pass with every destructive request. The idea is that attackers can’t get hold of this token (because of the SOP), and thus can’t forge requests.

If you’re using Rails, you get this for free. If you’re using Rack, than Rack CSRF is your best bet. It’ll deal with generating tokens and checking requests. The only part you have to handle is on the client side.

jQuery has a neat feature called ajaxPrefilter, which lets you provide a callback to be invoked every Ajax request. You can pass a CSRF token to the client side via, say, a meta tag. Then set a header using ajaxPrefilter.

var CSRF_HEADER = 'X-CSRF-Token';
    
    var setCSRFToken = function(securityToken) {
      jQuery.ajaxPrefilter(function(options, _, xhr) {
        if ( !xhr.crossDomain ) 
            xhr.setRequestHeader(CSRF_HEADER, securityToken);
      });
    };
    
    setCSRFToken($('meta[name="csrf-token"]').attr('content'));
    

In the example above we’re retrieving our CSRF token from a meta tag in the page. Then we’re ensuring that any local Ajax requests forward the token as part of the request’s header.

A hacking group accused of being operated by the Chinese army now seems to be going after industrial control systems.

A Chinese hacking group accused this February of being tied to the Chinese army was caught last December infiltrating a decoy water control system for a U.S. municipality, a researcher revealed on Wednesday.

Academic advances suggest that the encryption systems that secure online communications could be undermined in just a few years.

The encryption systems used to secure online bank accounts and keep critical communications private could be undone in just a few years, security researchers warned at the Black Hat conference in Las Vegas yesterday. Breakthroughs in math research made in the past six months could underpin practical, fast ways to decode encrypted data that’s considered unbreakable today.

A roundup of the most interesting stories from other sites, collected by the staff at MIT Technology Review.

The Billionaire Prince Who Says Saudi Arabia Is in Far Bigger Trouble than the Other Royals Admit
In contrast to Saudi Arabia’s official position, some influential Saudis are worrying about America’s oil boom and attempts to reduce oil consumption.
—Kevin Bullis, energy editor