Computer security is shit

21

Speaking infosec, when do you think the bubble will pop? Two weeks before my startup gets acquired and everything falls to shit?

1 Like
22

Not a security dude here, but how many items can be reordered?

Why couldnā€™t the installer recompile in a random order? Source is open, so there should be no issue in distribution.

(<ā€” installer dude)

1 Like
23

Ya can, but no one does. As an installer dude, to reorder any of that cryto shit would probably make you commit seppuku.

Plus I think they are in a preferred order, but I havenā€™t looked as openssl code in, oh, long enough :slight_smile:

24

When the government quits paying people stupid money?

3 Likes
25

So Iā€™m in a protected industry like Lockheed, Boeing, and general dynamics? Sha-weet!!

26

If you saw consistent trends across from most platforms and then a mixed ordering of cipher suites coming from OpenSSL but the same cipher suites, itā€™d probably be safe to guess it was the one Linux distro that did that. Also they are sent in the order of preference (strongest to weakest) so you could mix it up and get undesired results.

27

I usually reserve my infosec ramblings for other blogs, but since there are quite a few others on the Boings in the industry, and this thread is hereā€¦

Does anyone have any impressions of the Software Assurance Marketplace? Iā€™m not too enamored with a lot of what DHS has done, but it seems like an example of them throwing money behind a worthwhile project.

28

enh have you read the current news about Boeing?

1 Like
29

Ha-ha!! /nelson

3 Likes
30

Speaking of security, I wrote an internet facing api method thatā€™s basically:

$param =~ s/[^a-zA-Z0-9]//g;

Thatā€™s totes secure, right guys? ā€¦guys?

4 Likes
31

I have never looked at the source, but getting ridiculous with things like preprocessor defines is why we pay C programmers well, no?

But of course non-trivial, and requires consideration in the source to begin with.

Preferential order is quite a bit more problematic.

Shipping a completely isolated compiler that exists for the duration of the install is another, but probably doable.

32

You stole that code from Bobby Tables, didnā€™t you?

2 Likes
33

Why do data sanitization when you can pound your inputs with half assed regexes? I mean, who cares (Iā€™ll actually fix that one tomorrow :D)

2 Likes
34

True, the attacks of the early/mid-90s were so easy, and things were so badly locked down, that there wasnā€™t as much digging needed. Back then there were still a lot of servers running fingerd and telnet was still running on everything (and not running an open SMTP relay was sort of impolite). Itā€™s way hairier today in part because of the sophistication of attacks/attackers, and just due to the sheer volume of attackers. Iā€™m glad I am only very peripherally involved.

35

I miss getting fingerdā€¦

3 Likes
36

You should have a .plan for that

7 Likes
37

Someone types faster than me.

3 Likes
38

Itā€™s PHP, so thereā€™s no point in worrying.

1 Like
39

Oh, no, its muuuuuch worse.

1 Like
40

Assuming thatā€™s PHP/not Perl, I hurt inside remembering it, but there are some filter_* builtins in PHP5 that are nice. I had to walk a hideously insecure PHP3 badly ported to PHP4 web tool Iā€™d just inherited through a code audit with an InfoSec team. So, so fun. At least they paid me for it.

I still get calls from recruiters for PHP things, I now tell them I am emotionally unable to code PHP.

2 Likes