New answers tagged appsec
1
Try "Memory Errors: The Past, the Present, and the Future?" It's an academic paper, but very readable and referencing all of the events and technical details.
http://www.isg.rhul.ac.uk/sullivan/pubs/raid-2012.pdf
4
It is impossible for the server to determine where a cookie originated from, and if an application is designed properly the origin of a cookie should not be a concern. Based on the Same Origin Policy for cookies:
www.foo.bar.example.com may set a cookie to be sent to
*.bar.example.com or *.example.com, but not to *.something.else.example.com or *.com
...
3
The cookies sent by User-Agents with each HTTP request only contain name-value pairs, and as such it's not possible to determine their origin from a single HTTP request to a server.
The only way of detecting different cookies (I can think of) is passing the user through various redirects at various subdomains and paths, and checking (and recording) what ...
6
This is not terribly different than what OAuth is designed to do, if we were to tweak the workflow.
If you were to implement this using OAuth, your application would include an OAuth provider, and the third party would sign up to be an OAuth client.
The user, who is the resource owner, when redirected to the third-party site would simply authorize ...
0
Run the compiled software in a virtual machine, show the output, and then restore the virtual machine at the previous snapshot after each execution.
something like:
compile the executable on the server
copy it on the VM via network
activate a command on the VM that will run the compiled executable in , say, 5 seconds
exec a command on the server that will ...
2
"runas" will protect you from only a portion of the threats.
There are a few ways you could handle this. You need to lock down the firewall to prevent outgoing connections that you do not intend. Logging and auditing need to be turned on (and reviewed!!) to catch tampering.
If the server is a VM, you could have it revert to a saved snapshot every hour, ...
1
All security efforts are an investment. Each produce a different return on your investment. I often tell people to put effort into the security practices that give the most return in terms of bugs found, attacks prevented, etc. The best use of time on an open source project would be reviews for common vulnerabilities (e.g OWASP Top 10), configuration issues, ...
Top 50 recent answers are included
