Sec.se moderator here...
You can definitely push all the q's in the [encryption] and [security] tags over to us (some of them have already been migrated). They are all on topic, though I can't guarantee how quickly some of the more niche questions will get answers.
This includes:
Is BitL...
This is about the following question: What do I need to configure, to make sure my software uses /dev/urandom?
Please critique the question. If you believe it has violated any rules, please cite the rule that it violates, with a citation or link to the rule.
One person mentioned they believe t...
@AviD I had commented that the hashing one might be a better fit on crypto, and that there were a couple less suitable (as they were mostly answerable just by reading HIPAA) but yep - all fine
@AviD nahh - lets make it easy for them. Once they come over we can always speak to @Ninefingers and see if he wants the crypto one, and the HIPAA ones are definitely not on topic anywhere else so we can either keep em here or close
I hope I made it clear about the hipaa ones though, the ones that are about just RTFP wouldnt be good for us anyway, cuz at best they would be lawyer-y types.
@AviD I'll add my supporting comment - I think you and @Gilles are right. We need a 'one best answer' with all these existing answers rolled into one. From the perspective of someone coming here to find the answer, they should see one top-voted answer with everything they need in it.
heh - I think you are right. It could be a wide range of questions, eg what do I need to do to ensure php uses /dev/urandom etc, or just one question (which should then have all the answers in one)
@RoryAlsop but thats the point, I dont think splitting it up to separate questions would be better. especially since part of the question is which programs are relevant.
so the broad coverage, is part of being specific. so to speak.
@AviD I initially upvoted and edited to remove the one-item-per-answer request. When DW reverted my edit, I reverted my vote and voted to close. Now that Rory's edited again, I changed my vote again and morally rescind my vote to close
@Gilles, I'm getting an edit from you although it says "These edits were suggested by users who have not yet earned full edit privileges". This is odd.
I mean, I have to wonder how they build these things in house at all. The spec file that ships with the package has missing build time requirements (resulting in compile time failures) and previous versions had fatal rpmbuild errors.
In the old days on their downloads page they only had the source rpm and tarballs. Now they actually provide packages for el6 and F15. I just can't understand how they build those two.
Well, what I mean is that I'm guessing someone installed all the necessary libraries and packages on a workstation, and build against it. Which, sure, can be fine. In the past I've run into packaging problems, though.
For instance, they don't have all of the dependencies set up correctly in the package, but since they were installed on their system everything goes scrumptiously.
These days you're supposed to use something like mock. It sets up a setarch chroot for whatever target OS is, looks at the BuildRequires in the spec, installs those packages, etc
I'll accept pcre, so 's?he ' would be appropriate.
@AviD Sure, I was really only calling out mock as an example because it's what I'm familiar with.
Ok, so I got a working build. And, after comparing the specs, I'm happy to say that build time requirements are the only thing they screwed up this time.
Previously they had problems where they were installing files but not listings them as managed.
F5 Networks, Inc. () is a networking appliances company. It is headquartered in Seattle, Washington and has development and marketing offices worldwide. It originally manufactured and sold some of the very first load balancing products. In 2010, F5 Networks featured in Fortune's 100 Fastest-Growing Companies list.
F5 Networks' flagship product, the BIG-IP network appliance, was originally a network load balancer but today also offers other functionality such as access control and application security. Add-on modules to F5's BIG-IP family of products offer email filtering and intelligent ...
@RoryAlsop I think declared is the right word. Agreement implies involvement in the decision process.
Also, for the record, the old man saying, 'afternoon' doesn't so much bother me. I'm "that guy" who uses the generic "Good Morning" greeting at all hours of the day.
@ScottPack Same here, I must admit. As long as I've just recently woken up, it can be "morning" any time. I don't like rushing the day into afternoon though.
That is, unless you're actually rushing a workday into the afternoon to make quitting time come sooner. ;-)
Really, it conveys everything in my mind just as well as saying I'm going to reference PTES and NIST 800-115, neither of which you'll ever read as my client... and then I'm going to start with little quiet things and social engineering to sneak in. Then I'll throw the whole kitchen sink and Nessus the crap out of you just to see what happens at the end.
@JeffFerland You know those two little buttons that say, "Thorough Checks" and "Safe Checks Only"? I can't tell you how giddy those two little check boxes make me.
@AviD Next interview I get, I can't wait to explain how XSS can crash the server itself. Who cares about the job? Just telling that story with a straight face will be awesome.
You see, it's like this. Here I was, checking out a XSS PoC, and well, they had WebMin running. You know how there's a plugin to do things like 'dd'? Yeah, well..
Misread one guy's post.... he spent the last post talking about his server and followed up with a new post... so I told him to nuke his infected server... but he was talking about another website. The one on his server is clean.
... though at least he told me at the start, but still.
@JeffFerland I have a sneaky suspicion there exists a typo somewhere in here -- "(or they’ve this is the 10th call about that same car accident in 3 minutes)"
@JeffFerland I want to counter that, but I don't have enough information on my parentage to do so. :(
In more related news, @JeffFerland, I'm still confused by exactly what that dude wanted. Did he want to add '.' to his PATH, or does he want to add find / -type d to his path?
While I'll agree that there is some confusion, your initial assumption is the one that makes the most sense. Schwartz just seemed to add another interpretation.
Quick question. After compiling a program, I always have to explicitly tell it to run from the current directory by prepending ./ to the name. For example $ ./testprog -argument1
Is there a way to set up some kind of alias which would allow me to call it simply by saying $ testprog -argument1 , ...
What are the security issues in ecommerce?
I currently have:
Transport layer security issues
data being intercepted (ccard details stolen etc)
Vulnerability in web app
SQL Injection
XSS
Client side
malware
stealing ccard details etc.
Am I missing anything else?
Thanks
It's getting better, but I used to find myself responding to advice requests with, "What are you trying to accomplish?" rather than responding to their question.
I have 8 digits and I generate A1,A2,A3 to use first 5 digits.Now I want to generate
A1'=hash(x||A2||A3)
A2'=hash(x||A1'||A2)
A3'=hash(x||A2'||A3')
Which hash function I should use?
Speaking of effective communication, I heard a domestic fight in the street late at night. I rolled out of bed, pulled up some pants, and grabbed my phone. Called 911, told them what and where, and provided a description of the two people involved.
Well, the cops show up and the closest person to them matching the description of shirtless guy in the middle of Congress St. is now me...
@ScottPack Well, the good news is they noticed the other guy before they reached me, but I'll tell you that it's not a very friendly look you get when they think you're the guy from a domestic.
Great answer: Transatlantic ping faster than sending a pixel to the screen? http://superuser.com/questions/419070/transatlantic-ping-faster-than-sending-a-pixel-to-the-screen/419167?atw=1#419167 #networking
Before reading the answer I wanted to comment: The display latency by itself is meaningless, you also need to add the input latency, since the combined latency is what's relevant for a gamer.
I've been wondering about that latency for a long time, but was too lazy to find it out.
@CodeInChaos In suid code, protecting traversal of directories by the user by disallowing any input with a "/" in it instead of making good use of spc_drop_privileges" and spc_restores_privileges`
Setuid isn't my expertise, but I don't get it. It sounds to me like preventing directory traversal, and preventing the opening of files the user has no access to are separate concerns
Setuid isn't my domain of expertise either, but a quick Google search for "setuid coding guidelines" points quickly to the notion of acquiring and release privileges as early as possible.
@AviD, oh yes, of course, I'm not disputing that at all. Just saying that in a course about suid, that should be an important point, more than input validation.
Someone's just edited an old answer about iframe security on SO, more or less suggesting to allow mixed content if necessary (although it's about the other way around)... Hum... Not such a good idea. stackoverflow.com/a/2389719/372643
@Bruno ah, yes. False sense of security, and all that.
on the other hand, it does block the lowest hanging fruit for the countless more programmers who don't bother doing any validation or encoding is enough.
First (and I can't believe a Security site hasn't mentioned this yet), there's more than one way to secure a login. SSL/TLS is not the option option. The other options are perfectly valid too.
Your password is sent to your OpenID Provider. Most use SSL to secure the connection because so many pe...
There are a number of problems with HTTP Digest: no protection of the request/response entities, hard to distinguish from HTTP Basic from a UI point of view, downgradable to HTTP Basic, and also doesn't really help proving the identity of the site.
This is about the following question: What do I need to configure, to make sure my software uses /dev/urandom?
Please critique the question. If you believe it has violated any rules, please cite the rule that it violates, with a citation or link to the rule.
One person mentioned they believe t...
What are the security issues in ecommerce?
I currently have:
Transport layer security issues
data being intercepted (ccard details stolen etc)
Vulnerability in web app
SQL Injection
XSS
Client side
malware
stealing ccard details etc.
Am I missing anything else?
Thanks
I have 8 digits and I generate A1,A2,A3 to use first 5 digits.Now I want to generate
A1'=hash(x||A2||A3)
A2'=hash(x||A1'||A2)
A3'=hash(x||A2'||A3')
Which hash function I should use?
