The DMZ

Simon

18:00

@AJHenderson Well, wouldn't it be because it's one of the most popular web language?

Adnan

@Simon Don't listen to them. They know nothing

AJ Henderson

well that's just it

it is popular because it is forgiving

but it being forgiving also makes it easy to have problems that are harder to detect

TildalWave

I totally don't agree with this suggested edit:

2

A: What useful things can I do with the html5 "keygen" element?

The purpose of the element is to provide a secure way to authenticate users. The tag specifies a key-pair generator field in a form. More can be found here http://www.w3schools.com/html/html5_form_elements.asp

AJ Henderson

unless you know what you are doing and write solid code

it also means that a great PHP developer is a valuable thing, but proving you are a great PHP developer is harder to do

TildalWave

@Adnan Cheers!

Adnan

18:02

@TildalWave I finally saw someone reject a suggested edit here.

Simon

@AJHenderson Oh yeah, about that. When I'm gonna be done with school and decide that I wanna be doing some programming, I assume that I should write an application and share the source with companies?

TildalWave

@Adnan Oh I reject some... the worst one I've seen was on one of The Bear's posts from anonymous poster

AJ Henderson

@Simon and or make meaningful contributions to an established project

Simon

Anonymous posters are fucking pussies. There, I said it.

AJ Henderson

or write a plugin

Adnan

18:03

@TildalWave Once you get 10K, you'll be able to see review history for all users.

Simon

@AJHenderson Oh, that's a good idea. Do I have enough knowledge to do so, though? That's the question.

AJ Henderson

if you have to work with existing code and keep your code clean it's far more impressive than writing something from scratch in my book (and much closer to the real world)

Adnan

The vast majority of edits is accepted

I'm really not convinced that 90% (or more) of the edits are good edit.

TildalWave

@Adnan Can't I already? :O

Adnan

@TildalWave I mean you can see all the history in one place

You don't have to go to each user

Simon

18:05

@AJHenderson Very true, I doubt I'll often be asked to work on a brand-new application.

TildalWave

@Adnan ah yes that's handy... but I'm not trusted with it yet :(

Lucas Kauffman

@AJHenderson I heard scouser the other day, I didn't understand it, neither did my friend who was from Manchester

Adnan

I even pride myself that I have the following 'Suggested Edits' stats on SO

> Adnan has approved 1270 edit suggestions and rejected 1059 edit suggestions

TildalWave

Only 4016 rep to go :) I need to jump on some rep train early on, but I always miss those until I can only collect leftovers

Lucas Kauffman

think this guy forgets what HTTPS is for:

0

A: How do indirect, session-specific resource tokens increase security?

I think you defined a reference object as an absolute and associated with finance. How about the following: You are a software vendor, your sw if sold online after a visitor purchases it. Wouldn't you prefer that ONLY the purchaser be able to access a hyperlink for your product? Forget the finan...

AJ Henderson

18:08

@Simon some of my best PHP sample code is actually modules for PHPBB and vBulletin

though I don't work with PHP commercially much

do some consulting with it on rare occasion, but I'm primarily a .Net developer

Simon

@AJHenderson What do you mean by sample code?

Adnan

@Tilda Hmmm.. very interesting. I have almost the same percentage here on Sec.SE as well

> Adnan has approved 49 edit suggestions and rejected 38 edit suggestions

AJ Henderson

like, the code I use to demonstrate my ability in PHP if someone wants to see what I can do

because it can be clean code that integrates with a larger system cleanly

and you can polish it as a deliverable that people can actually use as well

Simon

Ah ok so you'd just take PHPBB and add/modify some stuff?

AJ Henderson

well they have a bit of a module system

where you can write plugins that integrate with the libraries

lynks

18:10

@AJHenderson try to sort a collection that contains NULLs: NULL < -1, and NULL == 0 so the result is anyone's guess...

Simon

Oh ok

Adnan

@Simon I've been working with PHP for almost 7 years now

Lucas Kauffman

I hate php.

TildalWave

@Adnan Can you see stats for me too?

Simon

@Adnan Are you still alive?

Adnan

18:10

With JavaScript for 3 years

I mean commercially work

The biggest mistake people make is making them into something they're not.

Lucas Kauffman

@Adnan I did too, built some stuff on Drupal, but still do nto like it :p

Adnan

When people come from .Net and Java to PHP and JavaScript.

Lucas Kauffman

@Adnan I'd expect the opposite :P

Adnan

@LucasKauffman sorry, fixed

AJ Henderson

@Adnan interesting how that works too. Visual FoxPro had the same issue. Amazing reporting and analysis package for it's day but people made the horrible mistake of trying to make full blown desktop apps out of it

Adnan

18:12

They want turn PHP into Java or .Net

I've seen it happen a lot of times

AJ Henderson

though in fairness, .Net uses JavaScript as well

Lucas Kauffman

so does every other framework :p

Simon

I'd like an example of how you can turn some PHP into Java, or at least attempt to.

Adnan

It's just like when you have a new girlfriend and you start asking her to wear your ex's dresses and fragrance.

AJ Henderson

@Simon he more means that PHP is an interpreted scripting language, not a full on programing language

Lucas Kauffman

18:13

@Simon you can use the often non-existing function diagrams and use cases

AJ Henderson

there are limits to what should be attempted with it

Simon

@Adnan Best analogy ever.

Adnan

They're made for different purposes around TOTALLY different mentalities

AJ Henderson

some people ignore those limits

Adnan

The lengths some people go is amazing.

AJ Henderson

18:14

@Adnan and your ex weighed 100 pounds less

Adnan

Has anybody seen WordPress's source code?

Lucas Kauffman

@Adnan parts of it

AJ Henderson

@Adnan yes, I've attempted plugins for it

Simon

I mean if you wanna make a Web Application, let's say a forum like PHPBB or vBulletin, could you really do it wrong because you've come from Java/.NET?

Lucas Kauffman

there's a really good wordpress IDS plugin from @MichaelHampton

@Simon you could do it wrong if you try to transalte php into Java or .NET

the design is completely different

AJ Henderson

18:16

@Simon it isn't about what language you've come from so much as trying to do things with a language that the language isn't designed to do. The way languages are designed to work differ and concepts don't cross over gracefully generally

Simon

@LucasKauffman But it's a scripting language! How could you do that?

Adnan

@AJHenderson +10

AJ Henderson

it's one of the harder things to grasp when you haven't written code commercially though

you have to really get to know applications in multiple languages to really appreciate it fully I think

Simon

@AJHenderson I guess I don't have enough experience, yeah.

Lucas Kauffman

@Simon to be honest, what's important is that you use tools you are comfortable with and which serve your purpose

Simon

18:17

@LucasKauffman +43987545734987534985734872342342B

I like to hear that.

Adnan

Has anybody seen the amount of MVC and OO libraries for javascript?

Lucas Kauffman

@Adnan and there aren't tons for PHP :p?

to be honnest if I were to code any app in Java for the web I'd use Spring MVC

Adnan

@LucasKauffman That's pretty much my point

Oh sorry, I meant JavaScript

Lucas Kauffman

aaah :p

AJ Henderson

@LucasKauffman just be aware with the most popular platforms, there is a fair bit of code out there that isn't ideal, just like VB code in the day and hypocrits in the Catholic church. The most popular one around attracts the majority of the idiots

who decide because it is popular instead of because of what it can do and being the right tool for their needs

Simon

18:20

What's PHP's biggest weakness, the fact that developers are slow at bug fixing?

Lucas Kauffman

@AJHenderson yea I wouldn't use it if I wanted to build my own personal webpage, but I would use it for a significant web application

AJ Henderson

it's interpreted, so it's fairly slow

Lucas Kauffman

@Simon I think that often there are too many bad examples out there

AJ Henderson

and it's loosely typed which means that bugs can hide easily

how forgiving PHP is is simultaneously its biggest strength and its biggest weakness

copy

@Simon Probably this: me.veekun.com/blog/2012/04/09/php-a-fractal-of-bad-design

Don't take it personally

AJ Henderson

18:22

there are optimized PHP engines that do help with the speed issue, but it's still not the best option for heavy data processing

unless you can offload the processing to SQL

Scott Pack

@AJHenderson Typed variables are the devil.

Simon

@copy I definitely cannot read all that right now but I'll keep the link for sure, thanks.

AJ Henderson

@ScottPack lack of covariance is the devil (the thing I hate most about .Net)

Simon

It seems that everything I like has been designed badly. I'm thinking about Android and PHP.

Lucas Kauffman

@AJHenderson covariance?

AJ Henderson

18:23

particularly for returns

Scott Pack

Covariance matrix

bivariate Gaussian probability density function centered at (0, 0), with covariance matrix [ 1.00, 0.50 ; 0.50, 1.00 ]. ]] In probability theory and statistics, a covariance matrix (also known as dispersion matrix or variance–covariance matrix) is a matrix whose element in the i, j position is the covariance between the i th and j th elements of a random vector (that is, of a vector of random variables). Each element of the vector is a scalar random variable, either with a finite number of observed empirical values or with a finite or infinite number of potential values specif...

AJ Henderson

ie, if I have a method GetPassenger in vehicle that returns vehicle passenger, I want to be able to override it in Car to say it is a CarPassenger

but in .Net you can't do that

copy

@Simon You should look into alternatives like Python and Ruby and then reconsider your options

AJ Henderson

you can only know that it is a VehiclePassenger

which forces you in to really twisted logic with generic types

and is a general pita

which I fight with on a nearly literally daily basis

Scott Pack

@AJHenderson Perl has the ability to return a scalar or array depending on what you're storing it into. Is that like what you're saying?

Simon

18:24

@copy My problem is that I'm being lazy. Both Python and Ruby look to be very interesting but I don't feel dedicated enough to learn them.

Lucas Kauffman

@Simon did we say you had a choice

AJ Henderson

@ScottPack I don't think so

what I'm talking about is the ability for a return type of a member to be altered to a more specific type in a more specific derived class

Simon

@LucasKauffman May I complete my damned maths class first, please?

Scott Pack

@AJHenderson That sounds awfully close to that object oriented bullshit.

copy

@Simon I'm not very interested in development, but a good start could be to build something small and easy. I did that with Django and it worked out nicely

AJ Henderson

18:26

it is OOP

but it's really hard to make a good OOP design when you can't expose more details of your objects as they become more specific

Lucas Kauffman

@copy I never got the hang of Django

Scott Pack

Whatever. It's all programmer nonsense anyway.

Lucas Kauffman

maybe I should take it up again

I prefered having the flexibility of a micro framework

AJ Henderson

I've never even heard of django

Lucas Kauffman

@AJHenderson It's the most commonly used python web framework

AJ Henderson

18:28

ah

Python is one of the few things I've never touched

so that explains it

Lucas Kauffman

@AJHenderson Instagram is written in it

AJ Henderson

Instagram is another thing I've never touched

I'm a photographer ;)

Lucas Kauffman

35

Q: What are some famous websites built in Django?

I've tried to search it here and google'd it but can't find any info nor a relevant question. What are some famous sites that have been built in Django? Thanks!

django

copy

@LucasKauffman I'm a lazy engineer, I don't want to write form validation and admin interfaces and all those things by hand

Simon

@ScottPack Can a non-programmer succeed in security?

Lucas Kauffman

18:30

@copy yea I know, I just liked the flexibility, my next app will probably be in Rails (@RoryMcCune yes I know :P) or Django

AJ Henderson

@copy I believe the term you are looking for there is "productive"

@Simon yes, but it can be limiting in certain aspects of security

the finer points of things like working with exploits requires a knowledge of coding and the actual way computers work under the hood, but most of security doesn't

Simon

@AJHenderson Let's say Web application security. You would need to think how it's done programming-wise, right?

AJ Henderson

well, web application security only really works if the developers know security

and how to write secure code

some penetration could be done without knowledge though

but again, it's helpful

Simon

@AJHenderson So, some programmers do know security? ^^

Lucas Kauffman

@AJHenderson yea but also policies are important

Rory McCune

18:33

ya know powershell is really handy at times...

([DirectoryServices.DirectorySearcher]"objectcategory=computer").findall() | ForEach-Object {Get-wmiobject win32_share -ComputerName $_.properties.dnshostname | Format-Table -Property PSComputername, name, description }

AJ Henderson

@LucasKauffman yes, but if developers don't know how to implement a secure product, you are up a creek regardless of policies

Lucas Kauffman

@AJHenderson I've seen people running several CMS, development languages and types of REST interfaces through eachother (SOAP and JSON)

Xander

@RoryMcCune Enumerating a network, are we?

AJ Henderson

@Simon I hope so. I'm a developer, well software architect, but that's effectively a type of developer

Rory McCune

@Xander yarr restricted Citrix test, but they forgot to block powershell :)

AJ Henderson

18:34

it's becoming something that more and more developers are being trained in atleast at a basic level

Xander

@RoryMcCune LOL. Nice. :-)

AJ Henderson

and there is certainly an option in any good software development program to focus on it

Lucas Kauffman

@AJHenderson indeed

if I ever get my hands on the retard in this hotel that decided that 100 MB should be enough traffic per 24 hours anno 2013...

Simon

@AJHenderson Don't most companies simply ask your experience in x language for y years for, let's say, a backend developer and don't expect you to actually know much about security?

AJ Henderson

but yes, it is entirely possible to be very good at security and not have any software development knowledge, lots of it is policy and infrastructure type things and being able to assess risk and what meaningful countermeasures make sense

and being able to understand a broad range of threats

which are far more than just technical

@LucasKauffman cellphone tether ftw

Lucas Kauffman

18:38

@AJHenderson It's also application related

@AJHenderson different country, roaming would make up for a nice bill

AJ Henderson

@LucasKauffman ah, ouch

Lucas Kauffman

@AJHenderson I've booked another hotel for next week though

need to check if they have a pool

lynks

I guess it all depends on what area of security you are talking about. Knowing language constructs really helps me when revenging. Also not being able to script anything would really slow down a pen-tester.

Lucas Kauffman

@lynks revenging?

lynks

@LucasKauffman reverse engineering

AJ Henderson

18:40

@Simon it depends on the position, but the lack of paying attention to it is a big part of why we have such a mess in terms of data security currently

Lucas Kauffman

ah

AJ Henderson

security in the real world is laughable at most companies

Lucas Kauffman

@AJHenderson It's also because security makes things "more complex" and requires more time to implement

AJ Henderson

2 out of 3 jobs I've had so far I could have walked off with enough information to destroy the company my first day on the job if I had so desired

lynks

@LucasKauffman what I mean is. If I had no idea what a for loop was, I would struggle to make sense of one when it appears in assembly.

AJ Henderson

18:41

and there wouldn't have even been a way for them to know it was me

Lucas Kauffman

@lynks mov ecx, 10

loop label

:P

lynks

@LucasKauffman partially unrolled, reverse conditionals etc...

Lucas Kauffman

@lynks how do you add that code makeup in a chat message

lynks

@LucasKauffman backtick

Simon

@AJHenderson I see.

AJ Henderson

18:43

luckily college programs are starting to improve in providing general training

Lucas Kauffman

for l in lynks

@AJHenderson we only had security in the last year

AJ Henderson

and the really clueless people that kind of migrated in to the field with no formal training are starting to drop out of the workforce

and the landscape of attacks is increasing, so hopefully we'll see an improvement soon

Lucas Kauffman

my first webapp written in php even checked authorization based on a parameter passed in a GET request

AJ Henderson

@LucasKauffman wow, really, we started it in sophomore year at my school, but then again, I did go to a highly rated college

lynks

@LucasKauffman there is nothing necessarily wrong with that?

Lucas Kauffman

18:44

@AJHenderson well it depended on the teacher mostly

@lynks yes it was, because if you changed the variable admin=1 in the get request you'd get admin privileges :P

lynks

@LucasKauffman ahh, understood. Remind me of the old days when register_globals was turned on by default in php.ini...

Lucas Kauffman

@AJHenderson My php class was given by a maths teacher

AJ Henderson

@LucasKauffman that's almost like making trusting the UID in your cookie

who would do something like that

Lucas Kauffman

@AJHenderson me in my first year of development!

:P

AJ Henderson

@LucasKauffman that was a major PHPBB2 security bug

lynks

18:46

@AJHenderson one of the challenges on alhazred.net involves a uid-in-cookie situation. But it's a little more complex :P

AJ Henderson

that amazingly took several years to be found

they were on minor version 15 I think before it was fixed

@lynks I remember my headaches trying to write out the dependencies on that for wiicafe's legacy code when they switched that and we wanted to update PHP and not need to turn it back on

Lucas Kauffman

@AJHenderson I only did make that mistake once :P

AJ Henderson

hmm, 10 rep away from 13k

Lucas Kauffman

@AJHenderson my second application was a bit of a monster too, it was secure but all my HTML was generated by PHP rather than using an HTML template with PHP in it

AJ Henderson

my biggest work in PHP was actually an application framework that I was working on with high security design

it actually sandboxed the entire evaluation of PHP code behind an outer layer that checked everything going in and out

Lucas Kauffman

18:51

@AJHenderson oh so you had to rewrite part of the PHP sourcecode then :P

AJ Henderson

I worked around it using includes

all the source code was actually stored external to the script that ran it

they had to request access and build a collection of inputs and only those inputs were passed to the execution of the code that was stored away

variables going in could only get in after filtering and code could only be accessed after permission checks

Lucas Kauffman

cool

AJ Henderson

I unfortunately never fully finished it because the payment processing company I was doing it for went out of business and the contract dropped

but it was an interesting project

I think I might have offloaded parts of the permission checking to SQL stored procs as well so that PHP couldn't even access them without credentials

because SQL simply wouldn't return results

but it was a number of years ago now, so the exact design has grown a bit fuzzy

fuzzy

Simon

Oh, @AJHenderson, is ASP.NET faster than PHP?

AJ Henderson

depends on what it is doing

for simple page operations, PHP may be faster, particularly on an optimized server, but for data intensive operations, .Net will generally be faster

but those are just general rules

lots of optimizations can be done in either system

Simon

18:57

@AJHenderson Fair enough.

AJ Henderson

php IS really slow on defaults

Simon

@ton.yeung Yeah, execution.

AJ Henderson

but zend optimized code on a zend server can run pretty fast

but is also no longer free then

PHP is interpreted, thus it has to figure out what work needs to be done and do it every time

.Net is still a framework, but it works with an efficiently implemented intermediate language

so it can work a lot faster and IIS will automatically cache a lot of the just in time compilation so that after initial load, the application pool runs quickly

Zend's server does similar things for the PHP execution

but the default command line PHP interpreter doesn't handle it as well

I believe Zend has one as well

Simon

That's nerdy.

AJ Henderson

MS Research actually made a native code compiler for .Net as well

@ton.yeung could be, my php work has always been for shops that couldn't afford Zend

so I've never directly used it

they used it for making Synergy

which was a very interesting project from a security perspective

an OS kernel that was built on managed code

Michael

19:10

HipHop for PHP: for when you find you've accidentally used PHP for a mission critical, high volume website

4

Scott Pack

@Simon Of course.

@Simon A programming background is required for some aspects of security. Things like reverse engineering and exploit development. It's really helpful for penetration testing, so you can tweak the exploits to actually work and the like.

@Simon Familiarity with programming is helpful with vulnerability management

Simon

Basically, it's a big plus.

Scott Pack

@Simon Programming is next to useless for hardening, monitoring, risk assessments, and most security operations tasks.

Basically, it depends on what you want to do.

Simon

Wouldn't these guys be referred as script kiddies though? :P

Scott Pack

For me familiarity with programming is a sometimes useful context for the vast majority of what I do.

@Simon What guys?

Simon

19:20

@ScottPack Those who simply use tools to find vulnerabilities.

Scott Pack

Script kiddies would be the people who use things like metasploit without any understanding of how penetration testing works.

If you think programming is a necessary skill for a security person then I think you have a painfully limited view of what the security field is.

Simon

No idea what the field actually is.

I'm new to this world.

Scott Pack

@Simon Check out page 9 on this brochure. It's probably the best layout I've seen. sans.org/media/online-training/…

@Simon A strong programming background would be a requirement for the Software Security and some basic experience would be a requirement for the Penetration Testing. Shell scripting level experience would be required for Intrusion Analysis and would be useful for Forensics.

Simon

It is definitely nicely structured and grouped. How expensive are these courses?

Scott Pack

Quite.

Simon

19:28

Pen testing is probably the field I'd aim for.

Scott Pack

That's the biggest downfall with SANS. The content is great but it's expensive.

Simon

Meh, I'll get an enterprise to pay it for me.

:)

Thomas Pornin

@ScottPack Thorough understanding of "what is going on in the machine" is a very valuable asset for IT security. It so happens that the same level of understanding is also a big part of being a good programmer.

Simon

Oh yeah, that. I barely know how to count bits and that kind of stuff. I'm ashamed of that.

Scott Pack

@ThomasPornin I'm disagreeing with the statement that being a good programmer is a requirement.

Thomas Pornin

19:31

@ScottPack Oh yeah. I am just saying that if you are a poor programmer, then you probably are bad at security too, because a lot of things which may make you a bad programmer also make you bad at security.

Xander

@Simon IMO, this book provides another quite good high-level overview of most of the areas you'll run into in IT Security. amazon.ca/CISSP-All---One-Exam-Guide/dp/0071781749

Scott Pack

@ThomasPornin Oh, sure. I can agree with that.

Thomas Pornin

This is mostly a matter of being sloppy, or not.

Lucas Kauffman

Is anyone here a PCI DSS certified auditor?

Scott Pack

@ThomasPornin Of course, you could replace "programmer" with "systems administrator" and probably be just as accurate.

Simon

19:32

@Xander I'm 200 pages through WAHH, I'll finish that one first :P

I'll note this one though, thanks.

copy

@Simon I can also recommend the videos here: opensecuritytraining.info

Xander

@Simon Yup, that's a good one. It's pretty specific to pen-testing web applications, where as this one is far more general to all areas of IT Security. One at a time is a fine idea. :-)

Simon

@Xander Well, it's the area that fascinates me the most so far.

@copy Cool, thanks.

Scott Pack

@ton.yeung Only when I notice lots of dandruff.

@Simon So, going back to your original question, yes. If you want to get into application testing then having a background in programming is probably somewhat useful.

Simon

@ScottPack Good. I'm not expecting to get a job related to security as soon as I get out of school so I guess it would be good to do programming meanwhile.

Lucas Kauffman

19:43

@Simon You never know, I didn't expect to get one either and landed one anyway

Simon

I might try to get hired by CGI and be @ThomasPornin #1 fan. I'd make his cup of coffee every morning.

Lucas Kauffman

@Simon for him and Tom Leek

Simon

@LucasKauffman Of course but I mean I don't want to be sad because I didn't manage to get one as soon as I'm done.

@LucasKauffman Of course!

Lucas Kauffman

@Simon and you'd be required to sacrifice a virgin every morning

Simon

@LucasKauffman Still not sure about that part.

Lucas Kauffman

19:46

@Simon 't is a requirement as stated within your contract, right after the paragraph of selling your soul to the bear

Simon

He's getting scarier everyday.

Lucas Kauffman

@Simon The good bear giveth, but primarly, the good bear taketh!

2

Simon

Now you're getting scary.

Lucas Kauffman

@Simon I am a high bear priest

Simon

I can see that.

Lucas Kauffman

19:49

@Simon don't forget to say your three ROARs a day

Simon

Anyway, time to go home, be back after raging in traffic.

ROAR, ROAR AND ROAR.

Happy?

Lucas Kauffman

@Simon yes.

Simon

FSDFSDFASDF

That was horribly phrased, let me work on that.

Ok too bad, I'm going home.

Iszi

20:11

Looks like this is probably getting good enough answers as it is, but do we want it here?

10

Q: Why root login via ssh is so bad that everyone advices to disable it?

Everybody in the internet advices to disable root login via ssh as it is bad practice and a security hole in the system, but nodoby explains why it is so. What is so dangerous in enabling root login ( especially with disabled password login )? And what is the difference between X symbol usernam...

ssh root

Michael

20:42

on the topic of php for anyone who hasn't seen it - behold, the PHP hammer: secure.flickr.com/photos/raindrift/7095238893/in/…

inspired by this epic rant me.veekun.com/blog/2012/04/09/php-a-fractal-of-bad-design

Lucas Kauffman

21:03

best joke of php is this one:

addedbytes.com/blog/if-php-were-british

really like `would_you_mind {
// Code here
} actually_i_do_mind (Exception £e) {
// Politely move on
cheerio('Message');
}`

Simon

GUYS, I received my "One ring to rule them all". As expected, it's worth what I paid (10$).

Lucas Kauffman

21:17

@ton.yeung who is this Russel Peters you speak of

Transcript for