paychecks ... most significant digits always end prematurely by at least two orders of magnitude, but they do get the least significant digit right about 10% of the time :)
I will put an inplant in my hand by dangerousthings (xNTi) 1. It has NTAG216 by NXP which supprts security bytes to lock write or read and write by password. How safe is that?
Is it safe enough to have my PUBLIC key (readable to everyone but not writable. Not too bad if someone overwrites it but ...
> WARNING This kit definitely contains dangerous things. The xNT transponder device has not been tested or certified by any regulatory agency for implantation or use inside the human body. Use of this device is strictly at your own risk.
neah as long as they don't claim it does something it doesn't and include all the warnings where required by law, they should be fine... it's just a fancy tag, we've been using them for a long time now, mostly on livestock and pets, but sometimes also on alien abductees just for the kicks of it
I'm having a brainblink moment, I am rewriting someone's coding guidelines, and I cannot come up with a better example than the wrong one they have.
In a properly-architected and -designed system, what would be a good scenario that would require a blacklist for input validation, instead of a whitelist?
I honestly cannot think of any valid use case right now.
and please do not say "oh you need to block quotes in strings, to prevent SQL injection!"
Last time I had a discussion about input validation, we concluded that there is never a valid scenario for blacklisting, except if dictated by business rules (in which case it is a higher level validation)
@Jacco actually I would say that example is closer to permissions, than validation.
but thats just me being pedantic.
so, given such a document, and assuming I dont think the concept of blacklist should be taken out altogether - what kind of example could I leave them with?
See this is why I hate correcting other people's documents. It's shoddy and no overriding rationale.
I'm thinking about that one. The only thing I can come up with is when you have to filter a specific case which you know triggers a vulnerability (due to a bug or design flaw which you cannot address at this point in time).
@Jacco ... which rules out "properly designed". Yeah.
I mean, sure, it is more than likely that these coders ARE concatenating SQL queries directly, in which case it makes sense to talk about quotes and such. But blech.
hmm damn. @Jacco while writing that out - I actually like the way it works! - I realized that even quotes for SQL strings is not blacklist, it should be encoded...
I was in a client meeting on Thursday, it was all I could do to not stand up and scream "YOU CALL YOURSELF A DEVELOPER, YOU GODDAMN SONUVABEECH??"
"Coffee is for coders only!"
Luckily I was not there about their software.
If I was, the recommendation I would give them would be to trash every stupid line of Classic ASP code they have on the spot, and rewrite the whole goddamn system properly.
That's my nice recommendation.
My real recommendation would be to fire every single goddamn coder they have there, and hire real developers that have a clue.
Just take a look a the level for the questions tagged [php] on stackoverflow. many of those asking these questions are earning a living and calling themselves professional coders.
I was rejected at a job interview for 'not understanding design patterns' because I mentioned that most MVC are, off course, not really implementing the MVC design pattern and that ORM is horrible because of the object-relational mismatch.
denial is a good method of preserving one's ego (or: one's ego comes up with a solution to avoid the need to move from your current position). I always hope that I don't exhibit the same behaviour.
I'm still struggling to understand why so many programmers are set on implementing their own security measures (as opposed to using some library) while at the same time they happily pull in whole frameworks to simply write 'hello,world' to screen.
@Jacco that too. There are probably more horridly broken libraries for any security function (e.g. encryption, passwords, authz, etc) than good ones. Odds are you would wind up with one that makes things worse, if you didnt already know better.
After the first unsuccessful use it gets easier: simply slap another tag to the prosthetic limb. — Deer Hunter2 mins ago
On second thought, you may qualify for a Darwin award. An inflammation, sepsis, and amputation are acute risks to your security. — Deer Hunter9 mins ago
that Darwin award comment is a tad unsubtle to my taste
most men I know and including myself are exactly the opposite and turned off by stupidity, and I personally require that a person I'm spending time and such with also has a healthy sense of humor (because otherwise I stand no chance LOL)
that and when presented with the individual statements describing behavior, most people will claim that they're closer towards acceptable behavior than they perhaps are
I, for example, would definitely circle the "not crazy" option
@kalina the big ones do. Across from where I grew up in Orkney was the testing ground for the really big ones - we went and lay under where the blade came down (this one was bigger than a 747 wingspan) and it was really 'whoosh'-y
@RоryMcCune so...? I spent the first four hours of the day dancing, the second four hours of the day travelling, 2 hours of the day dying on the roadside and then an hour chatting and then sleep
@RоryMcCune perfect day for it. We walked for about an hour this morning in Edinburgh, then spent some time in Falkirk and Slmannan before arriving home and now chilling in the back graden listening to loud Suede :-)
That's how I used to do all my marathon training - go out on the lash until very late with a friend, wake up on her couch then run until throwing up became awfully likely
@RоryMcCune did you see there's a wee adventure race we might try this year - the Bing Blazer. Only 11km, but 6 separate ascents (and descents) of West Lothian bings :-)
@RоryMcCune yeah that should still be well within the tree line... it's almost as if something happened to the place suddenly more than slow erosion or none at all if there's trees growing there and stop it... is a lot of that glacial?
@TildalWave hmm must be a scottish thing, I dont think apart from commercial forestry we see many trees near the tops of our hills, that said they are pretty rocky...
@RoryAlsop history does say, women weren't allowed rights until the 20th century, if women were involved their contribution would be classed as slavery
@RоryMcCune yeah but they're not pointy peaks like in the Alps, they're with pretty flat tops like older mountain massives so I'd think that soil would persist for longer and that would mean trees... unless something stripped most of the soil off, or the soil is too salty or something like that
@kalina in that time period, (about 3900 years ago) in the highlands, there is nothing to suggest slavery, or an over-dominating male 'power' - between then and the Roman's arrival, most of the tree loss was from farmers (male and female - very little distinguishing them)
A common problem that I see with questions is that they ask something like "Is (x) secure", which to me is an unanswerable question, the same way as asking "is the city north", it has no meaning in an absolute sense and requires context
In order for a question to make sense the asker needs to pr...
