okay, like opensource licenses are pretty standard - sure, you have a halfdozen variants, mostly to account for the FOSS cancer, and some for specfiic meta-organizations (e.g. apache). but THATS IT. Choose one of those, end of story.
@RоryMcCune I take back what I said about reading MNDA documents. Now I'm digging through several thousand pages of IBM documentation, dem lawyers have got a lot to learn.
though it all seems mostly not helpful, almost zero information about security is available.
except for one example, about how to use debugging logs to track when somebody is trying to break the security. Of course, this is a language for client-side applications, running in the scope of the user's client. So those logs are especially trustworthy, especially in the case of a malicious user.
heh. FINALLY some information about 4GL that actually makes some sense
> First, sit on a banana, then you roll over and eat fried chicken(while rolling) then jump up and kill the walrus of the 4th demonsion, then the gods of hot sauce and hairy chinese food will present to you the procedures to exucute those files.
so its like this - since I cannot find any actual security information for Informix-4GL, such as secure coding and etc, I'm trying to figure out what possible issues could possibly be an issue for insecure coding.
taking into consideration that 4GL is designed for the client part of client/server systems; the 4GL connects directly to a specific database; connection details are in the ODBC connection (not in code) and code only constrains to the specific connection; user authentication, authorization, etc is implemented in the database itself, not in the 4GL; and of course users run the app on their client and connect directly to the database.
aside from possible confused deputy type attacks, and framework-level bugs - what else could possibly be in play here?
there is no direct memory management; direct access to the db precludes SQLi type attacks; etc etc.
Let S be a string in the set (0,1) produced by taking the AND of the output of two maximal length linear feedback shift registers of large period (say 128 bits). It's easy to see from the truth table of the AND gate that you will end up with a string consisting of (approximately) 75% zeroes and 2...
So far I have posted 4 questions on this site. The first three questions all received +1. I interpret this to mean that my questions are acceptable and do not violate any site rules. But yet none of my questions on this site have yet been answered.
I am starting to wonder if I should just s...
@TerryChia :) ...I'm working with a bunch of other people, and some of them have broken the rule in the past...the higher ups have decided that company machines should have their web access completely disabled.
@Shokhet Borderline. What kind of expertise are you after? If you want to reach experts in configuration file syntax, SU. If you want to reach experts in policies (e.g. does this provide adequate logging), Sec.SE.
@AviD So if most of the security decisions happen server-side then there would seem to be a limit to concerns in the client code. It would partially depend on the level of trust placed on the client computing environment, but things like sensitive data written to client-side logs, or code opening up exposures like TCP ports (unlikely) or registered hooks to other programs that could be abused (perhaps more possible) could still be relevant
@AviD the other one to watch for would be if they try to artificially add restrictions in the client (e.g. DB permissions aren't fine grained enough so they try to restrict stuff in the client, which is obv. bypassable)
That's true for desktops. Our machines are laptops, which people take home (and to "really secure" internet cafes!) to finish up different things after hours...my coworker thinks that the system level is better for that, because our problem is actually people connecting to other networks.
His plan (I thought I mentioned this earlier, but perhaps not) was to set up an admin account with Windows Firewall, and allow no connections. Give the user a regular account, and then lock the BIOS so the boot device can't be changed.
lets say, hypothetically, that this makes sense. if these machines are owned by the school, and intended only for this use, I would say they should get machines with no wifi hardware (otherwise shut it off in the bios); cut the wire for the ethernet port (or even fill it with cement) - some BIOSes will let you shut it off at that level too. Basically shut off the hardware, and protect the BIOS with a STRONG, UNIQUE system password. Intel's vPro may help here.
@Shokhet ahhh okay
so why computers at all?
@Shokhet and, FTR, I disagree with that statement, strongly