Tag Info

Hot answers tagged

45

Actually most languages are "secure" with regards of buffer overflows. What it takes for a language to be "secure" in that respect is the conjunction of: strict types, systematic array bound checks, and automatic memory management (a "garbage collector"). See this answer for details. A few old languages are not "secure" in that sense, notably C (and C++), ...


44

The Ada language is designed to prevent common programming errors as much as possible and is used in critical systems where a system bug might have catastrophic consequences. A few examples where Ada goes beyond the typical built-in security provided by other modern languages: Integer range type allows specifying an allowed range for an integer. Any value ...


11

What happens here is that the foo() function uses a so-called old-style declaration, i.e. as things were done in C before the first normalization (aka "ANSI C" from 1989). In pre-ANSI C, a function bar() which takes two arguments of types int and char * would be defined that way: void bar() int i; char *p; { /* do some stuff */ } and it would ...


10

In many programming languages, initialization of local variables is forced, or the engine will flatly refuse to read uninitialized data. Even in languages where you can read uninitialized variables and thus get a copy of what remained in RAM at that emplacement, you cannot count on it to be "random"; it will have a tendency to contain always the same value, ...


9

You're right that a cookie is a bad idea, but the approach itself is misguided. The problem with these kinds of hard limits is that they make it easy for an attacker to create a DoS condition for the legitimate user, simply by putting in 10 incorrect email addresses. Even if you time-delay the attempts, the attacker can simply send a request every time the ...


7

Cache-Control: private Indicates that all or part of the response message is intended for a single user and MUST NOT be cached by a shared cache, such as a proxy server. Looking at OWASP: Testing for Browser Cache Weakness Browsers can store information for purposes of caching and history. Caching is used to improve performance, so that previously ...


6

You're relying on a principle called security through obscurity, which is generally frowned upon. There is a widely-accepted principle called Kerckhoffs's Principle which states: A cryptosystem should be secure even if everything about the system, except the key, is public knowledge. An alternate, and more general, form of the principle is called ...


6

Most programming languages higher level than C are much more secure when it comes to programming errors like Heartbleed's. Examples that primarily compile to machine code include D, Rust and Ada. It's not interesting to talk about just memory safety, in my opinion. Here is a list of additional programming language features that (I think) make it much harder ...


5

You don't. You use the authentication and authorization modules provided by your framework. My goto web framework is Python's Flask framework. Flask-Login is an excellent module that provides an easy to use API that handles the bulk of the authentication work. Flask-Security is another module that encompasses Flask-Login as well as various other security ...


5

If its just a simple profile picture, you can avoid most security threats by using a trusted 3rd party like Gravatar(which is what security.se uses). Using a linked image as a "Web Bug" are unavoidable with remote images but apparently a lot of people don't care that Gravatar can track them. Storing an attacker-controlled file locally creates other ...


5

Anything that restricts the set of possible passwords makes it more vulnerable to a brute force attack. The only reason to forbid some passwords is if the restriction to the password space is compensated by the high propensity of users to pick passwords that can be easily guessed. Let's say you would like passwords with at least 38 bits of entropy (that's ...


5

Unless you already have experience in the field, then yes, this is too complex for a small web agency. PHP can be used securely, but you have to know what you are doing. As part of a small web agency, I worked on a high security system to manage a bill payment service with many similar requirements to an online banking system. The project never reached ...


5

All current (meaning still updated) programming languages are designed to have as few inherent security flaws as possible, but at the end of the day it's (almost always) the programmer who is responsible for security flaws, not the language he's using. EDIT: As @DCKing pointed out, not all languages are equal, and I'm not saying it's a good idea to pick one ...


4

The main reason why safe mode should be removed is because its doesn't work. Over the years people have found many ways of bypassing PHP's safe mode. But the lack of enforceability is only one reason reason why Zend chose to remove "safe mode". This is a quote taken from the PHP 6 minutes discussion: As safe_mode is a name that gives the wrong signals ...


4

The OWASP top ten is an important list to get under control, but it is necessarily a little vague and make be difficult to translate the generalized best-practices into coding suggestions. A good rule to keep in mind is always assume your input is malicious, no matter where it comes from, as it can be difficult to imagine just how malicious input can be ...


4

In C, the function prototype foo(); declares a function which takes an unspecified number of parameters. This differs from many other languages (including C++) in which such a prototype would indicate a function that takes no parameters. The two potential problems listed on the page you link to are given as Ambiguous Interface and Information Outflow. ...


4

This is not secure. You have only 2 rounds of SHA-512, which is not computationally complex. Your salt is also a variable length (between 0 and getrandmax() bytes), which means storage will be unreasonably large (an average of 16 kilobytes of storage for each password?!). Please do not attempt to create your own password storage system. Use one of the ...


4

In the general spirit of what you're asking, I think the E language (the "secure distributed pure-object platform and p2p scripting language") is pretty interesting, in that it is attempting to securely offer features/computation models not generally available.


4

Say all the metrics you listed in your question report zero. Does that mean your software is secure? Does finding 0 bugs mean there are no bugs? The reason you're having a hard time finding software-only metrics is because software doesn't exist in a vacuum. Here's a question that's just as difficult: How much is a piece of software worth? There ...


3

The topmost dangerous mistake in C programming is using C. This is an unpopular assertion, but decades of experience back me up. C is a nice programming language in that it allows you to express operations in an "abstract machine" (that's how the C standard puts it) which will get translated efficiently into machine code (the translation tools runs fast and ...


3

As mentioned elsewhere on this site (see this and this, your "secret" can be discovered in web server logs and many other means. Using this as a means of access control is known as "security through obscurity", and can be easily discovered. However some less secure sites will use a variation of this theme and use it to protect a session after a user logs ...


3

Does it really forbid every letter you use in your username? You are right that this is bad as it reduces the pool of potential passwords by quite a considerable amount. Please name and shame so I can stay as far away from this application as possible. A more common scheme is not allowing passwords containing your username, first name or some other piece of ...


3

You're basically asking, if your object creation through parameterized URL query can be exploited in such a way to load it with an XSS code. The short answer is not unless you plan on using this newly created object for anything. The long answer of course depends on what you plan on doing with this newly created object, will you be sanitizing its properties ...


3

Personally, I found OpenSAMM to be a good resource, but only after you have something setup. It is a maturity model, which is basically a tool used to determine how well you do something. In other words, it has a focus on metrics and reporting. Don't get me wrong, I think there is a lot of good information in that document, but more of a phase 2. I have ...


3

If recognizable data patterns in the plaintext do somehow weaken your symmetric encryption, then your symmetric encryption is pure junk and should not be used at all. Do not make your data format inconvenient and complex just to cope with the (assumed) shortcomings of the encryption algorithm; instead, use an algorithm which does things properly. It is ...


3

There is no such thing as a secure language. If a language provides enough security for your problem depends a lot on the problem you are trying to solve. Like if you are writing a web application the security of most languages used in this context (e.g. Java, PHP, JavaScript... add your favorite) is enough to prevent things like buffer overflows, but even ...


3

Firstly, you do not actually write programs in programming languages. You write instructions for the compiler which describe what kind of program you want, and the compiler produces a program, in its own peculiar way, which will hopefully (if your compiler is well-designed) do the same thing that your source code describes. All programs, when they are ...


3

Andy Ozment has proposed an interesting security metric for software in his paper Bug auctions: Vulnerability markets reconsidered (WEIS 2004). Roughly speaking, his idea is that a software vendor sets a prize for the next vulnerability to be found. The prize starts from a fixed amount (e.g. 100$) and grows every day (e.g. 10$/day). When a vulnerability ...


3

There are multiple terminology variants around there, so there won't be an absolute answer. I'd say that "secure design pattern" is an expression which will be used by people who believe that developers are some kind of ape who can achieve Security if made sufficiently obedient to strict formal rules. While "coding guidelines" would be employed by more ...


2

This is too broad to answer fully, but I'd start with everything on the OWASP Top Ten. Then I'd go on and review the entire OWASP web site, and move on to the SANS institute's top 25 After you've read those and have a baseline understanding of all the web application threats and vulnerabilities, THEN start Googling "Secure PHP Coding". This was the first ...



Only top voted, non community-wiki answers of a minimum length are eligible