Stackoverflow is not in demise but the current organization is not the best possible after site gained many users, should have more specialized sub-sites like java and c++

one more iteration in the design of the website workflow would make it good

Random rant ?

@schroeder There seems to be agreement (or at least lack of disagreement) on Meta about merging [burp] and [burpsuite]. Could you or some other moderator do it?

@M'vy it's not random and it's not rand, actually it's constructive comment to objective reality

And the post above about stack exchange

however the site seems to be lagging with fixing issues a bit

ok :)

some issues are not recognized to be issues, the Q&A expertise are not enough, someone competent about the web dev and not the subject of Q&A site would have to look at some issues

one of them is HTTPS, when I log via HTTPS and I get HTTPS cookie, the links on the website are HTTP

for example, to chat section

so if cookie is HTTPS, on the HTTP site I got login box

and I don't like it because HTTPS is for reason, so I use HTTPS everywhere now

and regarding secure password storage, I am looking if this can be done on android system for example to help with day to day secure password storage

I am securing my firefox browser and so far

1. selinux sandbox (other options in progress)

2. ublock origin

3. https everywhere

4. Canvas Blocker

5. Cookie Whitelist + cookie deletion on browser exit

6. No resource URI Leak

7. No script (+ no webgl switch)

8. Faked user-agent,

9. Faked platform and CPU (in navigator.*)

It also runs on Wayland in Fedora 24

In that sandbox there's also non-persistent cache

Plugins are disabled too by default anyway

Password not stored because password storage has issues like after asking for single password, all passwords are getting ulocked for at least 1 minute

Also do not accept 3rd party cookies

And webrtc also needs to be disabled

Now tell me that Citrix would be more secure, I have pwned one with thousdands accounts and lacking security patches during regular day to day security check

And then it turned out there were many other issues with it

So you want to maximize fingerprintability?

@CodesInChaos I want to increase security for example, leaking of local files and also leaking passwords

Also I dont like websites listing all my fonts, so I have limited fonts to 14 now (default by sandbox)

To avoid leaking local files I'd run the browser in a VM.

Tbis is designed to be used on development machine where lot's of sensitive data is processed

For testing purposes in dev environment I need to run browser on the graphics card because it very often involves video and audio

but automated tests run on phantomjs

@Aria It sounds like your data classification and handling program is distinctly lacking if you both a) handle sensitive data and b) browse the Internet on the same machine.

@Xander I am already using 50 servers to do this

he complexity is such extreme, everything needs to be sandboxed, and secured without thinking much what are the risks

@Aria To browse the Internet? That's one heck of a YouTube addiction.

plus encrypted

@Xander I am working on dev enviroment, and I work with youtube as well with their APIs for example

I am also downloading and installing various libraries and so on

from internet like maven, pecl, cpan, gems etc

it's a real warzone here and I need to keep it secure to the possible maximum

for example, when I download banking statements to debug them for any bugs in processing, I need to make sure my browser wont spill them out

And then, I can download them to the dedicated virtual machine but doing vm machine for single task is big overkill

I have few vms with eclipse and intellij to handle that but installation of each takes 1 day to update

I am trying to avoid silly bugs like reading local files by the browser

for example my AWS keys

It's just Dev bit

So all Dev is on one machine which has my name on it

@Aria Not doing this on a dev machine is the first thing.

if you can't verify the dev environment is as secure as you want, and libraries, etc. are always being downloaded, you should probably be looking at separating the environments for development and 'normal activities' that need to be more 'secure'.

(just saying)

Can anyone recommend a good password manager?

@Aria - I'd take on board what @Xander, @ThomasWard and @CodesInChaos are saying. It looks like your model is rather inappropriate for your activities, which kind of make it unsecurable in any useful/provable/measurable way

@WilliamMariager yes - the main names at the moment seem to be KeePass and LastPass and a couple of others. I use one of them. It seems good. I haven't reviewed the code, but for my use case it seems okay.

I'm going to use it to handle the various passwords for my company accounts. Should I go with some expensive enterprise solution or should solutions like KeePass/LastPass be fine?

for you to manage the accounts you use in your company? Or for everyone in your company to use?

For me to manage the different accounts I'm currently controlling myself (PayPal, Corporate Banking, various emails, etc).

Those will work for that, but check out whether you are using online (in which case, is the data stored somewhere you are happy with) or offline (stored on your phone or desktop etc)

@RoryAlsop it's simple - someone tries to read files via firefox and then he can't

@Aria that makes no sense sans context

but even I download file in one minute and in second someone reads my local files?

sandbox is good solution to this issue to minimize the risks and make it more usable

once the file is downloaded it's moved out of sandbox so firefox can't read it

sounds like your model is less than effective - why is someone else able to read your file?

remove that from the use case and everything gets bettererererer

because that's how it used to be in the past for example november 2015 with FF

@RoryAlsop I'm guessing online is the best option, so I have access both from home and at the office.

@Aria no - you are writing words without context. I had no problems in November 2015. You need to be much more clear.

Lastpass I need to look at

@WilliamMariager okay - so check with each one where they store data. There are different options - so make sure you are happy with location of data storage

In november 2015 there was exploit spotted in the wild which was reading ssh private keys

@Aria Yes - it never bothered me at all as my context doesn't allow for that

hence - context is key

Much of what you write may be spot on, but in general it is difficult to tell because you are a bit random in your delivery, which leaves them mostly context-free

and hence of no value to anyone who wishes to discuss them with you

but I need usable machine which is used for dev, and running vm for each task is not an option because of extereme about of possible tasks

it just makes me making more mistakes, like using wrong vm for the job etc

I mean about = amount

correct model is: dev environment is for dev only. Promotion to test is a gate. Promotion to live is another. Separate environments should be used for each

Never use the wrong one

Different accounts, passwords etc

the model is well known and understood

I am also working with sandbox on windows, I am trying to build a desktop machine where ransomware initiated by applications like browser, run from desktop, emails would be futile or limited

I know about backups, but sometimes backup is not enough in very fast moving business

even if it's share with DFS

okay - this may just be a language issue, but those lines don't actually make sense

@RoryAlsop So using various users I am doing as well

> I am also working with sandbox on windows, I am trying to build a desktop machine where ransomware initiated by applications like browser, run from desktop, emails would be futile or limited

For each application I have dedicated user

what does that mean?

but this doesn't change the thing that there are files on each account I dont want applications to spill over

again - that doesn't mean anything in English

Firefox runs on "firefox01" user, and then it's sandboxed to it's own folder so it can't read user files as well /proc /sys and /var

On my desktop machine, I run firefox from dedicated user account in selinux sandbox the same way as on Android

I mean, similar

@Aria what you're describing sounds similar to QubesOS or Subgraph OS

Qubes uses VMs for isolation and Subgraph uses containers

But I am using Fedora for development

Only on fedora I have dev cycle the way it's good

sure but you might want to investigate those projects to see how they have implemented the protections they proivide

yes yes

I like Fedora a lot, the worst distro I have seen so far is Tails

It's not even 64bit

Which is horrible from the security standpoint, plus malware in injected html files

security is unconnected to number of bits...

I also manage plenty of cloud accounts, so I erase all cookies every time I close my browser I think it's reasonable

Well there are various things in 32bit and 64bit

But in 64bit there's more of them in use

...

I have no words

@RoryAlsop sometimes there are no words

is reminded of someone he dealt with three days ago when trying to explain basic password security

the only true way to have a dev machine that is 'secure' is to not put anything 'secure' or sensitive on there

to that end, my dev environments all sit on separate VLANs from each other for network isolation, and ACLs control which subnets do have access to them. THe machines themselves are individual VMs. They pull code, etc. from a gitlab instance on my network (which can be reached for git pulls), with individual revokeable SSH keys in the access list for the gitlab. There's no overlap between my normal system where I do things i need secure (banking, access password dbs, etc.) ..

... and the dev machines, except for the IDE, and the only way to 'reach' the dev servers is an SSH connection

and the only area that code sits on where I would really have to worry about changes, etc. is a separate system. SSH access to the dev. machines (VMs) means that they're all isolated from each other, and each VM is for a different dev.

so the only things I have to worry about, for the most part, is who has access to the dev machines (via SSH) and who has access to the physical hypervisor/system, and that's really it.

^ this

there's no actual 'sensitive' data outside that that the app being developed uses, and what data that system can access is isolated and controlled

structurally/architecturally it provides security in a way you can gain assurance over

... and of course my network ACLs, but that's what backups of firewall configurations are for if I screw them up :P

@Aria - worth looking at an equivalent for your environment

also it's important when building stuff to have it in sandbox

@Aria isolated individual VMs for where code being built actually exists. Or locally, a VM running to be that isolated env.

literally, isolation of the sandbox or dev environments from anything else I care about, via VMs or isolated containers, or physical boxes (if you're working bare metal) on separate network segments.

but never mix and match sensitive/secure activity and 'building the application' on the same environment (the VM permits isolation of the sandbox to the VM; containers offer similar isolations though I prefer the VM method)

especially when Security is the concern.

@ThomasWard I got it, but it's not that simple, sandbox is still required

@Aria let me ask you a question

what is your definition of a "sandbox"?

I need to use cloud infrastructure to do dev, test and build

sandbox is separation of folder access (on linux) and limitation of syscalls

basically from sandbox you can't access all files as usual

it also makes it harder to break, and also I am limiting CPU and memory with cgroups

I can't have 50 development machines, that's the main issue

i didn't say you needed 50

all with my name on it, I can have 3 desktops and 10 cloud machines in total

but I have over 200 projects on it

just for dev, all desktops with GUI

I have continuous integration so at any time I can open project and stage it to production

^ why do you have to do this downloading and debugging on the same system as where the sandbox resides?

i'm not asking about your infrastructure. I understand your goals here.

well, I can't use dedicated machine just to download bank statements

on the same machine I may need to download other files like emails

So I want to make sure that when I download it, it is moved out of sandbox shortly after

@Aria sounds like you're looking for a 'sandbox' like a local VM inside VirtualBox on the desktop, where you can download the file, and then put it in shared storage so that your host machine can see the file as well as the guest, in a specific location on the host's disk.

It's easier to harden one smartphone, if possible

the issue of mobiles is an issue i'm not going to delve into, because there's other solutions for mobile testing.

I use KVM

So have have around 10 KVM systems and 3 desktops and all are fully allocated

it will take a year to budget what's needed and it will give me one more desktop

On some accounts I need other people to login and do the build, so they can't su or hack into other accounts

so all is up to date and sandboxed

in one KVM machine I need to have windows xp to test websites

virtual machines are not resource effective for dev

you cant have each developer in dedicated room

;-)

and then, sometimes these environments go without updates for year, so they need to be hardened

when I am off

red flag #1 there

now it's all up to datre

going without updates for a year means you can't harden it.

but someone after me wont be such maniac with it

I have it automated now, but as history shows, normally people stop doing it

with selinux they cant do suid etc

even strace is limitred

I'm just going to leave this here, and then go do something that isn't going to cause as much of a brain bleed... maybe staring at this python code i've been mulling over for a year will help...

I think ^ that sums it up, because you're mixing browsing of the 'net (Standard User Activity) and Sensitive Data on the same machine. SELinux isolations or not.

among other issues and concerns.

I think you underestimate scope of the problem

But cube linux seems OK but it's not for development

Fedora is perfect for the job

I have even working wayland on it

I mean Qubes

qubes-os.org

but one day, I will put KVM machine for everything

but for now on one VM I need to run all Dev AWS keys and code for example

when I'll have more VMs, I can separate AWS keys between VMs

But now, they are separated by user accounts and sandboxes

because rouge app can write to user account and put backdoor

with sandbox I can see what's going on

my DNS infrastructure is not secured

it's out of my control for the moment

have no idea why there's DNS resolving public zones in LAN

it's also not like there havent been any security incidents there

and that I put WPA2-EAP for no reason ;-)

This Quebes says it will download in 12h

This stuff is not usuable in enterprise

plus, going out of budget is common engineering or rather "management" mistake

there's a reason why there's sandbox in Android and iOS

I think, @Aria, that until you properly grok what @Xander and @ThomasWard have written, then you are expending effort in the wrong areas, and failing to secure anything.

@Aria What @RoryAlsop says.

I have a grave concern that you don't actually understand security, but instead have just picked up small fragments of good practice and unfortunately just linked them without an underlying picture of what they do

@Aria I think you trivialize the solution.

I am secured I havent got any breaches for some time but there have been incidents

Those are not necessarily related

I am just puzzled by your (at large) ignorance of major issue as Continuous Integration and lack of experience with it

What are the dangers and what are solutions for these

Interestingly, that is part of the problem. This is an area I work with every day. And this is why I am trying to help you (along with the other folks) to understand what you are missing

You havent asked any questions but you have said a lot of irrelevant stuff, go and read about development dont waste time on talking nonsese

you'r not getting what I am saying at all

and not trying to understand either

over-reacting that's all

it's not about sandbox or vms, it's about bigger picture in complex systems

Guess what @Aria - that's exactly what we have been trying to educate you. But now not going to bother - rudeness is not good behaviour

and part of that bigger picture is android for example

Just no, @aria.

@Aria One doesn't really need to ask many questions when you make it so clearly apparent that you're already lost on the wrong path.

@Aria I might suggest you look at the Sec.SE scores and experience of the people you're dismissing as talking "nonsense". they've been in the security industry a very long time and have a wealth of experience, which it might be considered unwise to dismiss