did I tell you about the time I got accosted in the mall because I was wearing a sec.se shirt? She wanted to know how I got it, she's on site all the time.
Rails is good in a lot of ways and lets some classes of app. get developed quickly and nicely. The current batch of security problems are a (I think) a consequence of their liking for cool features, and flexibility, and perhaps not thinking through all the consequences...
but I really need to learn html5 and proper CSS - for my main website I have resorted to a WIX hosted Flash site (I know - I'll go sit in the corner...)
@Polynomial The main thing in Haskell is lazy evaluation. It is not really a case of looping, more something like: "yeah, I could loop here forever, but I won't"
@RoryMcCune True, this isn't the first I come across thing like this.
I think it's good that they at least have the self-awareness to see that they're suffering from bad security practices, enough to order a security audit.
im going to throw a poorly encrypted password list somewhere to simulate bad admin. the defending team can just delete it, but it will contain ssh passwords for sudo users until they do. but what sort of crypto scheme to use...
@Adnan i have taken the idea from DefCon, each team gets the same VM, which they must keep alive. ('alive' is determined every 30 seconds or so by a central c&c server, which will do things like login, interact with programs, visit websites etc)
the point is, that all the services that the c&c server uses start out vulnerable. defenders must patch them, while making sure the c&c server still determines that they are alive.
so after the alloted time, each team gets an 'uptime' score, a 'pwnage' score (for capturing oponents flags) and such like that...
so one example i have; c&c logs in as 'carter' pw: 'carter'. c&c runs ~/update <random string>, which is a (very) vulnerable exe, and is also setuid root.
update drops the random string into a text file in some other user's home folder. which the c&c logs in to check. if the strings match, the server has passed the 'alive' test.
to patch it, the defenders would need to recompile the program not to be vulnerable
also make it setuid of the other user, rather than root, which it does not need.
The GOST block cipher, defined in the standard GOST 28147-89, is a Soviet and Russian government standard symmetric key block cipher. Also based on this block cipher is the GOST hash function.
Developed in the 1970s, the standard had been marked "Top Secret" and then downgraded to "Secret" in 1990. Shortly after the dissolution of the USSR, it was declassified and it was released to the public in 1994. GOST 28147 was a Soviet alternative to the United States standard algorithm, DES. Thus, the two are very similar in structure.
The algorithm
GOST has a 64-bit block size and a key length...
The GOST hash function, defined in the standards GOST R 34.11-94 and GOST 34.311-95, is a 256-bit cryptographic hash function. It was initially defined in the Russian national standard GOST R 34.11-94 Information Technology - Cryptographic Information Security - Hash Function. The equivalent standard used by other member-states of the CIS is GOST 34.311-95.
The hash function is based on the GOST block cipher.
Algorithm
GOST processes a variable-length message into a fixed-length output of 256 bits. The input message is broken up into chunks of 256-bit blocks (eight 32-bit little endian ...
Both have a few non-critical weaknesses. Using them for encryption or password hashing is not wrong per se.
Of course, password hashing requires a bit more (as @CodesInChaos says)
What would be wrong is believing that using GOST mystically increases security.
@ThomasPornin Make that: What would be wrong is believing that using anything mystically increases security.
i.e.: Some things may indeed increase security, but there is rarely (if ever) anything mystical about it - the mechanisms should be well understood and not just blindly accepted.
I guess the developer in me is just in pain because he made a remark about "I don't want to bother making other peoples code work with mine". I kind of want to tell him to go build his own processor to avoid writing code that depends on other peoples. :-P
my sister, who is not the sharpest apple on the block, is very sensitive about her husband being from a [racially specific background]. I was asking him once about his new job, and expressed a congratulatory note on how cushy it sounded.
cushy, is a word in hebrew that is a racially insensitive slur, applicable to jungle bunnies.
Needless to say, she exploded at me, started cursing me out in front of our parents, who sat there bewildered together with me. Took a while to figure it out.
@ThomasPornin true, if you include all languages and slangs.
it was just a very funny situation.
She, of course, did not want to admit that she did not know the word.
TBF, it was just as likely that I would have been making a racially insensitive comment. But it happened to be the one time I was saying something nice.
I wanted to know how can I get info on what sites are owned by certain company.I need it for bug bounty programs. For example how can I find what sites are owned by paypal company, like what sites have paypal in it's web address etc...
Thanks
actually makes PHP sound like a good thing, somehow.
Then I realized the dirty secret: Udemy, the site that built that infographic, actually appears in the row of "Sites built using it" under PHP. So, they want to make themselves look good. :-)
I was also interested in the datapoint that most companies are looking for good programmers in PHP.
Good programmers don't use PHP, that's why they're so hard to find!