The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
0answers
210 views

Ordinary Windows desktop bash bug [duplicate]

I'm still trying to make sense of the new bash vulnerability (shellshock). I can't tell from what I've read if having a bash script work in a Command Window makes my Windows box vulnerable or not. I ...
0
votes
0answers
37 views

Possible cross site scripting vulnerability caused by url_with_protocol

I used pullreview to review my project. It came back with a security concern ( Possible cross site scripting vulnerability) on this line: link_to portfolio.website, ...
3
votes
1answer
350 views

Ruby resources for Penetration testing/testers and ethical hackers

I'm wondering if there is a place where I can find up-to-date information regarding ethical hacking with Ruby. I do find lot of Python information, which is OK, but I have 4 years of experience coding ...
1
vote
1answer
599 views

Checking if current user exists before executing code

In one of my controllers I have this method: def method_name if current_user @model = Model.find(params[:id]) if @model.destroy flash.alert = 'Model deleted successfully' ...
0
votes
1answer
132 views

I get the feeling that Microsoft and Mac use two different forms of AES

I have an AES string being produced with this class, the AesCryptoServiceProvider Class provided by Microsoft. And I need to decode this encryption with Ruby's SSL::Cipher class . The problem is ...
3
votes
2answers
2k views

Why would you need a salt for AES-CBS when IV is already randomly generated and stored with the encrypted data?

I was looking at this code and came across these comments which says encrypting without a salt is insecure. Why would it be insecure when you are already using a random IV for each value? I think the ...
2
votes
1answer
67 views

How does CVE-2013-4287 make Rubygems any more vulnerable?

I've recently heard about CVE-2013-4287, which can cause denial of service due to CPU consumption. But earlier this year, I attended Hacking with Gems which showed all kinds of weird and wonderful ...
3
votes
1answer
184 views

Does Apple maintain the security of the built-in Ruby?

Does Apple maintain the security of the Ruby implementation that comes by default in OS X? I recently heard about CVE-2013-4073, but when I ran "Software Update..." on my OS X Lion box, it didn't ...
9
votes
3answers
234 views

What simple security considerations can I / should I make for a read-only API?

Right now I'm setting up an API, to be consumed on the client-side to set up a directory site. I'm wondering what extra steps I need to take just to prevent people from gaining write access to the ...
4
votes
2answers
295 views

What risks are involved with installing gems from rubygems.org? Are alternatives safer?

Normally, when installing a Ruby gem, I'd ask my system admin to do sudo gem install gemname However, there was recently a security breach with the source of gems, http://rubygems.org , and I'm ...
7
votes
2answers
1k views

What unique risks does MVC model binding bring to a website? What additional vigilance is needed?

From what I understand, "model binding" is where a website based on ASP.NET MVC or Ruby on Rails (there are others...) takes parameters in HTTP's GET statement and passes them as variables to code ...
0
votes
2answers
4k views

Why does OpenSSL not include AES-256-GCM? [closed]

I'm trying to implement AES-256-GCM in Ruby. Ruby's OpenSSL wrapper library and aead library both clearly seem to believe that OpenSSL itself supports this. However, neither 0.9.8r (which I had ...
0
votes
1answer
150 views

How do I prevent my Rails application from attack? [closed]

My website is being nuked by new signups and new posts some of which don't even have user.id associated with. How do I solve this? What code should I add to the user#new page and/or post#new page. ...
4
votes
2answers
328 views

Can anybody recommend any gems for checking security vulnerabilities?

I want to check one of my RoR projects for security vulnerabilities. So can anybody recommend any gems for my needs?
4
votes
2answers
606 views

Could the bcrypt-ruby binding be vulnerable?

While developing a Ruby on Rails application using a commonly used authentication library named devise, I noticed from the prefix $2a$ of the produced password hashes in the application database that ...