Security relative to source-code edition, protection and management.

learn more… | top users | synonyms

2
votes
0answers
12 views

Are there any type safe languages with deterministic compilers?

This article about BIND9 concludes with the statement: The point I'm trying to make here is that BIND9 should not be exposed to the public. It has code problems that should be unacceptable in ...
2
votes
1answer
32 views

Source code scanning - PCI Requirement - Service Provider

I've been doing a lot of research regarding the requirements for source code scanning but haven't found anything conclusive when it comes to my question below. So I need some guidance from PCI Experts ...
11
votes
7answers
4k views

Secure memcpy for pure C

Buffer overflows are nothing new. And yet they still appear often, especially in native (i.e. not managed) code... Part of the root cause, is usage of "unsafe" functions, including C++ staples ...
3
votes
2answers
103 views

What are the security risks in leaving 'sudo' inside my production code?

I have a script that can only run successfully with root permissions But in development it's really hard to run with root permissions (in my development environment) so I add 'sudo' when ever it's ...
15
votes
3answers
3k views

Example of a backdoor submitted to an open source project?

To clarify immediately, I'm not interested in writing a backdoor. I have no interest in submitting backdoor changelists to projects myself. I'm researching some source modeling techniques, and we're ...
-1
votes
2answers
46 views

Can Tor pre-built binaries be different than if someone builds from source? [closed]

Is there a possibility (and how likely is it) that the pre-built binaries of Tor that most of us use are backdoored or altered in some way, unlike the source code?
0
votes
1answer
45 views

Source code of Firefox Add-ons

How can I be sure that a browser add-on that is released under the GPL is actually really using the source code that was published? I read somewhere that the source code of Chrome add-ons is viewable ...
3
votes
4answers
3k views

What reputable site should I download Putty from?

I recently did a Bing search for Putty and can only guess at which distribution is "trusted", contains no malware, or sleuthing code. If you needed to download Putty for a high security Windows ...
8
votes
2answers
645 views

Security issues with PHP Sandbox

I am working on a PHP sandbox for a Web Application Honeypot. The PHP sandbox will analyze a PHP file that may have been injected as part of an RFI attack. It should run the file in a safe environment ...
23
votes
6answers
4k views

Source code as password

Passwords with a mixture of letters, numbers, and special characters are sometimes hard to remember. Is it secure to instead use a small amount of memorable source code as a 'passphrase'? As an ...
1
vote
0answers
72 views

Vetting new IT development staff [closed]

In the realm of software development what would be the best way to vet prospective employees? We handle potentially sensitive information, and a code base which could be potentially lucrative to ...
2
votes
5answers
437 views

Software Testing vs (Web) Penetration Testing

I would like to ask about the differences between Software Testing and Web Application Penetration Testing. I am aware of usage different tools in both disciplines Software Testing (JIRA/Selenium) ...
2
votes
1answer
78 views

How to set up a multi-developer environment with emphasis on source code security?

One of my clients runs a small software development company (15 employees) with PHP as their sole server side development language. They are having a networked environment with all the computers ...
0
votes
0answers
15 views

I Use Precompiled Open Source Software. Is There a Backdoor? [duplicate]

I'm new to Linux world (3-4 months with Linux). But I did compile some programs from source and had one failed attempt to compile a custom Linux kernel. One thing that I'm wondering about is the ...
0
votes
2answers
316 views

Source code disclosure vulnerability

I am a bit confused about the discussion here about hiding javascript source code. Let's say if I browse to a url like this: http://www.example.com/site/somejs.js and then what I see is something like ...
1
vote
1answer
117 views

What precautions I can take to secure software against user?

I want to build a client that connects to my server and uses server API. You can consider this as a banking application because data security is the most important thing. Since the users or hackers ...
1
vote
0answers
122 views

rootkits subverting the windows kernel source code [closed]

I just purchased the book "rootkits: subverting the windows kernel" by Greg Hoglund and James Butler for a research project at work. However, this book constantly refers to the source code that can be ...
2
votes
2answers
106 views

Expose the source code repository externally or allow VPN access?

To allow third party consultants, offshore developers and contractors working on the code, we can expose our Git repository externally. Or we can grant VPN access to the external parties and limit ...
4
votes
2answers
745 views

Is there any way to use Nuget securely?

Visual Studio now includes a Package Manager that downloads and updates software packages from the internet. The common name for this is "Nuget" The problem I have is that anyone can pretend to be ...
11
votes
8answers
28k views

Programming language for network security

I am working as a tester now. I am planning to move to the domain of security such as a CEH or CISSP. But many say that to be a great hacker you need to know at least one programming language well. I ...
1
vote
2answers
117 views

Which security measures does PyPI and similar third-party software repositories take?

PyPI is a third-party software repository for Python packages. Everybody can upload packages to it (see The Python Package Index (PyPI)). How does PyPI prevent people from uploading malware? When I ...
2
votes
2answers
95 views

Can we verify that an app store ships the same code I have been shown?

When thinking about which messaging solution to use on my new "smart"phone I reflexively tended towards open source products, figuring that I could trust these more to actually provide the security ...
7
votes
5answers
10k views

Hiding JavaScript source code

In a web-app should one strive to hide as much of the code as possible, for example from view source? In particular I was wondering should JavaScript be hidden, especially ones used for Ajax? I was ...
35
votes
4answers
10k views

Is using Git for deploying a bad practice?

I tend to use Git for deploying production code to the web server. That usually means that somewhere a master Git repository is hosted somewhere accessible over ssh, and the production server serves ...
0
votes
1answer
241 views

Are private git repositories safe?

I've heard from several people that private repository servers like BitBucket are not really safe. I've heard rumours about code being stolen and used by people even out of private repositories. Is ...
53
votes
5answers
4k views

Should security-critical code be reused or rewritten?

Usually, in programming, reusing code is always a better idea than writing your own implementation of an algorithm. If an implementation has been around for a long time and is still used by lots of ...
10
votes
4answers
934 views

Source code security

We have about 20 developers working in a heterogeneous environment, mostly using company laptops or desktops. We run Windows 7 on desktops/laptops and a mixture of Linux distros (Ubuntu/CentOS). ...
7
votes
1answer
3k views

Average number of exploitable bugs per thousand lines of code?

Over the years I've heard various estimates for the average number of exploitable bugs per thousand lines of code, a common figure being one exploitable bug per thousand lines of code. A Google search ...
6
votes
5answers
7k views

Obfuscating JavaScript code

Some Flash developers are afraid of JavaScript. Their point of view: Stealing JS source code is effortless, one would just 'view source' and copy it. Yes, you can decompile Flash bytecode, however it ...
1
vote
1answer
154 views

Code deployment in PCI CDE

The PCI DSS v3 standard states the following: Network Segmentation To be considered out of scope for PCI DSS, a system component must be properly isolated (segmented) from the CDE, such that ...
14
votes
2answers
856 views

How safe are signed git tags? Only as safe as SHA-1 or somehow safer?

How safe are signed git tags? Especially because git uses SHA-1. There is contradictory information around. So if one verifies a git tag (git tag -v tagname), then checksouts the tag, and checks that ...
13
votes
6answers
9k views

Disable insecure/dangerous PHP functions

Typically my job description limits me to code-review of web applications. More recently I've been asked to assist with some server-side PHP optimization where, although I am familiar with it, I lack ...
1
vote
2answers
396 views

What are main differences between Source Code Analysis vs Static Application Security Testing(SAST)?

Do these 2 terminologies refer to the same thing? https://www.owasp.org/index.php/Source_Code_Analysis_Tools http://en.wikipedia.org/wiki/List_of_tools_for_static_code_analysis#.NET Some of the ...
3
votes
2answers
3k views

Is there any decompiled source code for the “Flame”/“Skywiper” malware?

When searching for the source for Stuxnet, its relatively easy to come by in one form or another. Although I'm actually curious if anyone has done any work to comment the source and perhaps clean up ...
31
votes
0answers
2k views

Can you prove that an open source program is running the same code that it claims to be? [duplicate]

So if a group has made open source software, and the source code is available on github, and is bundled with an executable in their main download, can it be proven that the executable is compiled from ...
3
votes
3answers
2k views

how an iframe can cause xsrf?

I know how a form tag is prone to CSRF which does not use any token (or any other challenge-response mechanism) but I was wondering how an iFrame can be used to cause XSRF attack and what would be the ...
0
votes
1answer
71 views

How can I prove to users of the software that the binaries I post match source code that's been inspected and verified by a third party? [duplicate]

If I have software that's like TrueCrypt where security is very important, but unlike TrueCrypt because mine won't mysteriously go offline for seemingly no reason at all, how can I prove that my ...
1
vote
2answers
145 views

Open Source OS - code you see vs code you get

In this question I will use the example of Linux OS, but I am also interested in general situation. Linux OS distributions are famous for being open source and thus rather secure. But how can you be ...
13
votes
3answers
851 views

What are the security implications of 'open-source' vs. 'source-available'?

In light of the current fiasco surrounding TrueCrypt, I have received considerable criticism from current clients and peers in the IT industry for my continued support of the open-source model. Such ...
1
vote
2answers
715 views

Tampering req.getParameter() Vs req.getAttribute() [closed]

Is following code vulnerable? If yes, how it can be exploited? <% Boolean redirectToSomeSite = (Boolean)request.getAttribute("redirectToSomeSite"); String someSiteUrl = ...
1
vote
2answers
287 views

Static code analysis strategies [closed]

Imagine: We have been given the source code of several software programs, some open source, others proprietary. What's the best strategy to analyze the source code in each case? For example: We know ...
2
votes
3answers
263 views

What is the security flaw in the following code?

I am reading OWASP Testing Guide v3. The following passage: Example 1: Magic Parameters Imagine a simple web application that accepts a name-value pair of “magic” and then the value. For ...
8
votes
5answers
3k views

How can one secure a password/key in source code [duplicate]

If there is a need for source code to have a password in it, how should this be secured? This is purely an example, but say there is an app that is using an API, and you don't want to expose ...
1
vote
0answers
29 views

Tracking checkins from generic users

Im trying to implement a better system to monitor checkins to our repository. We have some generic users everyone can use, I have recently disallowed them from checking in as those users however there ...
0
votes
2answers
81 views

Displaying a video through the web whilst hiding the location

I felt this fit more here than SO, if not, please vote to migrate. We've been approached by a company who would like to use our platform to host their videos. The issue is that right now, we use the ...
19
votes
4answers
4k views

Malwares source repositories. Where?

As the best way to learn is to read the code, do you know where I can find malware/virus/whatever source code to read?
2
votes
0answers
2k views

AngularJS Static Analysis Tools [closed]

I am setting up a software security initiative at a small software company. Part of this is selecting a static analysis tool for early and automated detection of security vulnerabilities. Many ...
9
votes
3answers
8k views

How can I enumerate all the saved RSA keys in the Microsoft CSP?

I have an application that is creating several keys and storing them in various stores (in this case the Machine store). How can I enumerate all the keys on a given Windows system? ...
4
votes
2answers
283 views

If Apache is configured to parse PHP can users see PHP source code?

If Apache is configured to parse PHP and not allow to index files, are there other ways users can see PHP source code, either with or without intention?
3
votes
1answer
2k views

Hiding backdoors in Open Source code in other languages than C and C++?

I am referring to The Underhanded C Contest and Hiding Backdoors in plain sight. They demonstrate, that you can with some cleverness, write Open Source code, publish the code and hide a backdoor in ...