Tag Info

Hot answers tagged

66

The important thing is maintenance. Regardless of whether you reused existing code or wrote your own, you will achieve decent security only if there is someone, somewhere, who understands the code and is able to keep it afloat with regards to, say, evolution of compilers and platforms. Having code without bugs is best, but in practice you must rely on the ...


46

Actually most languages are "secure" with regards of buffer overflows. What it takes for a language to be "secure" in that respect is the conjunction of: strict types, systematic array bound checks, and automatic memory management (a "garbage collector"). See this answer for details. A few old languages are not "secure" in that sense, notably C (and C++), ...


44

The Ada language is designed to prevent common programming errors as much as possible and is used in critical systems where a system bug might have catastrophic consequences. A few examples where Ada goes beyond the typical built-in security provided by other modern languages: Integer range type allows specifying an allowed range for an integer. Any value ...


38

Even more so. Security code is tricky. Cryptography code is downright hard, even if you are a trained cryptographer - and impossible to get right, if you are not. If there are so many critical bugs in so many big important software packages and companies - what makes you think* you would be able to do a better job? * Unless of course this is your ...


15

Interesting question! I'd like to answer it more from probability standpoint, than from Best Current Practices standpoint. While Thomas and others provide great answers, I do not think they touch on the core question - which is "is unique (or less used) code more resilient in practice than popular code". Note that I've deliberately not used "more secure ...


12

The simple answer is: don't roll your own security. There are two parts to this. Algorithm and implementation. As for the algorithm, creating your own encryption algorithm is horrendous. Even if you are versed in the field of cryptography, you still aren't in a position to create a new algorithm. Unless you have a team of experts in the field working on ...


11

What happens here is that the foo() function uses a so-called old-style declaration, i.e. as things were done in C before the first normalization (aka "ANSI C" from 1989). In pre-ANSI C, a function bar() which takes two arguments of types int and char * would be defined that way: void bar() int i; char *p; { /* do some stuff */ } and it would ...


10

In many programming languages, initialization of local variables is forced, or the engine will flatly refuse to read uninitialized data. Even in languages where you can read uninitialized variables and thus get a copy of what remained in RAM at that emplacement, you cannot count on it to be "random"; it will have a tendency to contain always the same value, ...


9

You're right that a cookie is a bad idea, but the approach itself is misguided. The problem with these kinds of hard limits is that they make it easy for an attacker to create a DoS condition for the legitimate user, simply by putting in 10 incorrect email addresses. Even if you time-delay the attempts, the attacker can simply send a request every time the ...


7

Most programming languages higher level than C are much more secure when it comes to programming errors like Heartbleed's. Examples that primarily compile to machine code include D, Rust and Ada. It's not interesting to talk about just memory safety, in my opinion. Here is a list of additional programming language features that (I think) make it much harder ...


7

Cache-Control: private Indicates that all or part of the response message is intended for a single user and MUST NOT be cached by a shared cache, such as a proxy server. Looking at OWASP: Testing for Browser Cache Weakness Browsers can store information for purposes of caching and history. Caching is used to improve performance, so that previously ...


6

You're relying on a principle called security through obscurity, which is generally frowned upon. There is a widely-accepted principle called Kerckhoffs's Principle which states: A cryptosystem should be secure even if everything about the system, except the key, is public knowledge. An alternate, and more general, form of the principle is called ...


6

If we want to look for rational reasons not to use scrypt right now, we can find mostly these three: It is unclear whether a "memory-hard" function is what is needed, with the parameter configurations supported by scrypt. Scrypt was initially designed to support local encryption, particularly whole-system encryption. This means that the password must be ...


5

You don't. You use the authentication and authorization modules provided by your framework. My goto web framework is Python's Flask framework. Flask-Login is an excellent module that provides an easy to use API that handles the bulk of the authentication work. Flask-Security is another module that encompasses Flask-Login as well as various other security ...


5

If its just a simple profile picture, you can avoid most security threats by using a trusted 3rd party like Gravatar(which is what security.se uses). Using a linked image as a "Web Bug" are unavoidable with remote images but apparently a lot of people don't care that Gravatar can track them. Storing an attacker-controlled file locally creates other ...


5

Anything that restricts the set of possible passwords makes it more vulnerable to a brute force attack. The only reason to forbid some passwords is if the restriction to the password space is compensated by the high propensity of users to pick passwords that can be easily guessed. Let's say you would like passwords with at least 38 bits of entropy (that's ...


5

Unless you already have experience in the field, then yes, this is too complex for a small web agency. PHP can be used securely, but you have to know what you are doing. As part of a small web agency, I worked on a high security system to manage a bill payment service with many similar requirements to an online banking system. The project never reached ...


5

All current (meaning still updated) programming languages are designed to have as few inherent security flaws as possible, but at the end of the day it's (almost always) the programmer who is responsible for security flaws, not the language he's using. EDIT: As @DCKing pointed out, not all languages are equal, and I'm not saying it's a good idea to pick one ...


4

The main reason why safe mode should be removed is because its doesn't work. Over the years people have found many ways of bypassing PHP's safe mode. But the lack of enforceability is only one reason reason why Zend chose to remove "safe mode". This is a quote taken from the PHP 6 minutes discussion: As safe_mode is a name that gives the wrong signals ...


4

The OWASP top ten is an important list to get under control, but it is necessarily a little vague and make be difficult to translate the generalized best-practices into coding suggestions. A good rule to keep in mind is always assume your input is malicious, no matter where it comes from, as it can be difficult to imagine just how malicious input can be ...


4

In C, the function prototype foo(); declares a function which takes an unspecified number of parameters. This differs from many other languages (including C++) in which such a prototype would indicate a function that takes no parameters. The two potential problems listed on the page you link to are given as Ambiguous Interface and Information Outflow. ...


4

This is not secure. You have only 2 rounds of SHA-512, which is not computationally complex. Your salt is also a variable length (between 0 and getrandmax() bytes), which means storage will be unreasonably large (an average of 16 kilobytes of storage for each password?!). Please do not attempt to create your own password storage system. Use one of the ...


4

In the general spirit of what you're asking, I think the E language (the "secure distributed pure-object platform and p2p scripting language") is pretty interesting, in that it is attempting to securely offer features/computation models not generally available.


4

Say all the metrics you listed in your question report zero. Does that mean your software is secure? Does finding 0 bugs mean there are no bugs? The reason you're having a hard time finding software-only metrics is because software doesn't exist in a vacuum. Here's a question that's just as difficult: How much is a piece of software worth? There ...


4

There are multiple terminology variants around there, so there won't be an absolute answer. I'd say that "secure design pattern" is an expression which will be used by people who believe that developers are some kind of ape who can achieve Security if made sufficiently obedient to strict formal rules. While "coding guidelines" would be employed by more ...


3

The topmost dangerous mistake in C programming is using C. This is an unpopular assertion, but decades of experience back me up. C is a nice programming language in that it allows you to express operations in an "abstract machine" (that's how the C standard puts it) which will get translated efficiently into machine code (the translation tools runs fast and ...


3

As mentioned elsewhere on this site (see this and this, your "secret" can be discovered in web server logs and many other means. Using this as a means of access control is known as "security through obscurity", and can be easily discovered. However some less secure sites will use a variation of this theme and use it to protect a session after a user logs ...


3

Does it really forbid every letter you use in your username? You are right that this is bad as it reduces the pool of potential passwords by quite a considerable amount. Please name and shame so I can stay as far away from this application as possible. A more common scheme is not allowing passwords containing your username, first name or some other piece of ...


3

You're basically asking, if your object creation through parameterized URL query can be exploited in such a way to load it with an XSS code. The short answer is not unless you plan on using this newly created object for anything. The long answer of course depends on what you plan on doing with this newly created object, will you be sanitizing its properties ...


3

Personally, I found OpenSAMM to be a good resource, but only after you have something setup. It is a maturity model, which is basically a tool used to determine how well you do something. In other words, it has a focus on metrics and reporting. Don't get me wrong, I think there is a lot of good information in that document, but more of a phase 2. I have ...



Only top voted, non community-wiki answers of a minimum length are eligible