@AviD yeah there was a talk at the last conf. I went to that was basically pictures/stories of a guy getting into all sorts of high security establishments that he shouldn't have been able to
dont get me wrong, I think the talks will go over well. obviously there is enough people coming to hear them... I just personally dont find those the draw.
with contracts, I could poooosbily understand that it needs to be tailored for each situation. (It doesnt. Thats lawyer bullshit.) But NDAs should be 100% standard.
okay, like opensource licenses are pretty standard - sure, you have a halfdozen variants, mostly to account for the FOSS cancer, and some for specfiic meta-organizations (e.g. apache). but THATS IT. Choose one of those, end of story.
@RоryMcCune the worst part is that some of those lawyers do try to sneak in really vicious language, even things that have nothing to do with NDA. so you really do have to read every last line.
like that one that tried sneaking in control of any IP I have.
@JourneymanGeek doesnt matter. Its a total lack of respect towards the employees, treating them as interchangable cogs instead of people who are paid to brain all day.
why the hell is there a statement about exporting from the U.S. and complying with the Department of Commerce??
And we managed to blag a guest pass for the head of Metropolis records through the stranglers bassist, as he had been left off the guest list by accident. Very surreal
@RoryAlsop ahh not a 24-hour one.. I see , yeah some car parks are weird like that. if it's a pay/display unmanned job you think they'd just leave it open 24/7
@RоryMcCune I take back what I said about reading MNDA documents. Now I'm digging through several thousand pages of IBM documentation, dem lawyers have got a lot to learn.
though it all seems mostly not helpful, almost zero information about security is available.
except for one example, about how to use debugging logs to track when somebody is trying to break the security. Of course, this is a language for client-side applications, running in the scope of the user's client. So those logs are especially trustworthy, especially in the case of a malicious user.
heh. FINALLY some information about 4GL that actually makes some sense
> First, sit on a banana, then you roll over and eat fried chicken(while rolling) then jump up and kill the walrus of the 4th demonsion, then the gods of hot sauce and hairy chinese food will present to you the procedures to exucute those files.
so its like this - since I cannot find any actual security information for Informix-4GL, such as secure coding and etc, I'm trying to figure out what possible issues could possibly be an issue for insecure coding.
taking into consideration that 4GL is designed for the client part of client/server systems; the 4GL connects directly to a specific database; connection details are in the ODBC connection (not in code) and code only constrains to the specific connection; user authentication, authorization, etc is implemented in the database itself, not in the 4GL; and of course users run the app on their client and connect directly to the database.
aside from possible confused deputy type attacks, and framework-level bugs - what else could possibly be in play here?
there is no direct memory management; direct access to the db precludes SQLi type attacks; etc etc.
Let S be a string in the set (0,1) produced by taking the AND of the output of two maximal length linear feedback shift registers of large period (say 128 bits). It's easy to see from the truth table of the AND gate that you will end up with a string consisting of (approximately) 75% zeroes and 2...
So far I have posted 4 questions on this site. The first three questions all received +1. I interpret this to mean that my questions are acceptable and do not violate any site rules. But yet none of my questions on this site have yet been answered.
I am starting to wonder if I should just s...
Is a question about whether a specific setup (say, Windows Firewall) is/isn't vulnerable to specific things (say, a non-admin user account trying to get around it) on-topic here?
the setup I have in mind is a little more complicated than that....I just want to check before I write a whole big question :)
What I'm trying to do is take a group of computers and make them completely incapable of Internet access, but for security reasons, which is why I thought of this exchange.
@TerryChia :) ...I'm working with a bunch of other people, and some of them have broken the rule in the past...the higher ups have decided that company machines should have their web access completely disabled.
@Shokhet Borderline. What kind of expertise are you after? If you want to reach experts in configuration file syntax, SU. If you want to reach experts in policies (e.g. does this provide adequate logging), Sec.SE.
@Gilles So I think I know how to do it, but I was asked for my opinion on if it would work... I don't see any way to break my colleague's system, but I thought I'd ask the real experts.
@JourneymanGeek Oh really? What happened by you guys?
@AviD So if most of the security decisions happen server-side then there would seem to be a limit to concerns in the client code. It would partially depend on the level of trust placed on the client computing environment, but things like sensitive data written to client-side logs, or code opening up exposures like TCP ports (unlikely) or registered hooks to other programs that could be abused (perhaps more possible) could still be relevant
@AviD the other one to watch for would be if they try to artificially add restrictions in the client (e.g. DB permissions aren't fine grained enough so they try to restrict stuff in the client, which is obv. bypassable)
That's true for desktops. Our machines are laptops, which people take home (and to "really secure" internet cafes!) to finish up different things after hours...my coworker thinks that the system level is better for that, because our problem is actually people connecting to other networks.
yeah.... nope. not gonna happen. way too easy to bypass, if they wanted to - and I am assuming these are programmers, who are at least mildly technical.
His plan (I thought I mentioned this earlier, but perhaps not) was to set up an admin account with Windows Firewall, and allow no connections. Give the user a regular account, and then lock the BIOS so the boot device can't be changed.
This isn't a company; it's a school that wants their students to be able to type notes on their laptops, but not have web access....basically, computers as glorified typewriters.
lets say, hypothetically, that this makes sense. if these machines are owned by the school, and intended only for this use, I would say they should get machines with no wifi hardware (otherwise shut it off in the bios); cut the wire for the ethernet port (or even fill it with cement) - some BIOSes will let you shut it off at that level too. Basically shut off the hardware, and protect the BIOS with a STRONG, UNIQUE system password. Intel's vPro may help here.
@Shokhet ahhh okay
so why computers at all?
@Shokhet and, FTR, I disagree with that statement, strongly
@AviD hey hey no falling behind here, microservices are in (you wouldn't want to be running a stinky monolith would you?) and so you need a containerized substructre for them, right!
So far I have posted 4 questions on this site. The first three questions all received +1. I interpret this to mean that my questions are acceptable and do not violate any site rules. But yet none of my questions on this site have yet been answered.
I am starting to wonder if I should just s...
