@AviD well more years of free finding for all my web app. reports :)
it's a good illustration of the fact that people won't even take basic steps to protect themselves, so you can see why security pros are cynical of people having security as "their top priority"
@AviD well depends on the company/App. Our standard finding reports as a low, but for me if it was something like a bank I might bump that to medium more for reputatational risk than anything else.
I generally reserve highs for "can be used on it's own to compromise the security of the system in a relatively fundamental way"
@RоryMcCune yeah, that's what I was thinking. thanks.
@RоryMcCune one of my partner/clients asked me to review a report that some other consulting company gave them. Irrelevant of the quality of testing, the accuracy of reporting the risk levels kinda depressed me.
they were throwing out terminology they clearly didn't understand...
misusing DREAD (and STRIDE, not sure why they were even bothering) all over the place in various interesting ways
and one of the most elaborated findings was explaining how THIS is really DOM based XSS (welcome to a decade ago), and not "regular" XSS, and the difference between them... and oh yeah btw, this was actually regular reflected XSS and not DOM based at all.
I guess they thought it was DOM based because it happens on the client? Dunno.
I did learn one intersting thing, though - they pointed to a vulnerable jQuery version that surprised me.
I saw these ppl like 5 years ago and i told them I would work on it if they would let me rewrite it in php. They hired someone else. but, its been hacked so many times, they fired that guy.
@Simon fun punch card fact. Did you know that in IBM, after they stopped using Punch cards for coding, they kept making them as people liked using them for taking notes on in meetings (apparently they were a good size to fit into shirt pockets)
doing sanity check on a sample I'm using on a track I've had signed and the google results for said sample are a bunch of links to the original documentary and me talking about it in chat -.-
@RоryMcCune Cool. I know it's been posted here before. Just figured it's been awhile, so worth the re-post. And damn, I'd forgotten how frickin' thick those accents are.
it never ceases to disappoint me when I open up the mastered version of one of my tracks after some other... individual has decimated my beautiful arrangement
@kalina well it's a story of two friends who go through difficult times and then part company... and baby hands.... and meat dragons... and extraplanar rifts.... and the destruction of the world.
@RоryMcCune no it's not, it's about the first four episodes being shock comedy and then the community wanting more episodes and the writer making a point that beating a dead horse is ugly
@Adi - you would need to demonstrate the protection on that front end. You don't need to worry about the encrypt at rest or in transit, but you have to be able to show appropriate protection of your web app
@Adi any sensible QSA would have to tell you that the front-end (HTML, Javascript, etc) is definitely in scope. If that is sufficiently isolated from the back-end / web application, you might be able to scope those out, but at the very least you would have to include delivery of the HTML / JS / etc (i.e. the webserver itself, SSL, etc.).
as @RоryMcCune said, if your app gets pwned, those files/code could be replaced.
also, paypal is not PCIable (at least, as far as I know, it didnt used to be...)
@RоryMcCune well, not any more. Really, it's been yeeeaaars since I was associated with that term.
