Tag Info

New answers tagged

1

Security is not necessarily improved simply if the code compiles to slightly different instructions. Security is: Algorithm Implementation Auditing Maintenance If you are not writing better, more secure algorithms -- which may take years of research -- and are not having your code audited, and patching accordingly, then simply a slightly different ...


0

Download same version from top-10 results for "putty homepage" returned by your favorite search engine, and compare them. If they are not all completely the same, abort the installation. Otherwise, install it (from any of downloaded bitwise-identical copies, of course). If you need more security, interpolate results from different search engines and ...


15

Interesting question! I'd like to answer it more from probability standpoint, than from Best Current Practices standpoint. While Thomas and others provide great answers, I do not think they touch on the core question - which is "is unique (or less used) code more resilient in practice than popular code". Note that I've deliberately not used "more secure ...


12

The simple answer is: don't roll your own security. There are two parts to this. Algorithm and implementation. As for the algorithm, creating your own encryption algorithm is horrendous. Even if you are versed in the field of cryptography, you still aren't in a position to create a new algorithm. Unless you have a team of experts in the field working on ...


38

Even more so. Security code is tricky. Cryptography code is downright hard, even if you are a trained cryptographer - and impossible to get right, if you are not. If there are so many critical bugs in so many big important software packages and companies - what makes you think* you would be able to do a better job? * Unless of course this is your ...


66

The important thing is maintenance. Regardless of whether you reused existing code or wrote your own, you will achieve decent security only if there is someone, somewhere, who understands the code and is able to keep it afloat with regards to, say, evolution of compilers and platforms. Having code without bugs is best, but in practice you must rely on the ...


0

I would say a lot depends on if the users are remote, or are on the local machine. I would disable the feature if you do not need it. Local user / attacker: If the users are local, an attacker can find out most (but not all) of this information fairly easily, although this report would certainly make it easier for the attacker. Even locally, there are a ...



Top 50 recent answers are included