meta user
network profile
| bio | website | tcpiplab.com |
|---|---|---|
| location | Southern California | |
| age | ||
| visits | member for | 10 months |
| seen | Mar 29 at 18:37 | |
| stats | profile views | 9 |
IT Security, web development, Perl, Mac, etc.
|
Sep 21 |
comment |
How can I avoid putting the database password in a perl script? Thanks gowenfawr. Excellent point about the added complexity. I've always believed that security controls are less effective as system complexity increases. |
|
Sep 21 |
comment |
How can I avoid putting the database password in a perl script? This sounds like a good idea: "this is a general recommendation: don't have executable programs owned by the user that runs them", but I'm not clear on why it is a good idea. What attacks does this prevent? |
|
Sep 21 |
accepted | How can I avoid putting the database password in a perl script? |
|
Sep 21 |
awarded | Autobiographer |
|
Sep 21 |
comment |
How can I avoid putting the database password in a perl script? By the way, I can't find a URL pointing to any general, authoritative reference on the web for Time Based Access Control. Cisco routers still support it, and it used to be used in large dial-in modem pools for corporate and government systems. But I think it is generally a phenomenon of 20th century mainframe security systems. I think that the concept back then was something like, "Legitimate users would never dial in to the mainframe outside of normal business hours". But I don't think I've ever seen it used for controlling intra-system file access. |
|
Sep 21 |
comment |
How can I avoid putting the database password in a perl script? This sounds OK, but I don't see how it is any different than just storing the password in a text file separate from the main script, and having the script read the password that way. In your method, the owner of both scripts is the same or at least has the same level of permissions on the two files, right? |
|
Sep 21 |
answered | How can I avoid putting the database password in a perl script? |
|
Sep 20 |
comment |
How can I avoid putting the database password in a perl script? Great answer. Thank you. One bit of good news is that there is no webserver involved in any of this. I like the idea of a combination of your first two methods: config file + encrypting the password. They are more specific versions of some fuzzy ideas I was thinking about. |
|
Sep 20 |
asked | How can I avoid putting the database password in a perl script? |
|
Sep 20 |
awarded | Critic |
|
Sep 3 |
answered | What can I do to make sure my computer isn't infected with FinSpy? |
|
Aug 29 |
awarded | Benefactor |
|
Aug 29 |
awarded | Scholar |
|
Aug 29 |
accepted | How useful or beneficial is participating in CTF contests for my security career? |
|
Aug 22 |
awarded | Promoter |
|
Aug 22 |
comment |
How useful or beneficial is participating in CTF contests for my security career? Oh ya, for clarity I should add that I'm referring specifically to live CTF contests, not the website-only CTF sites where you log in and hack at your leisure. I'm thinking about the type of CTF contests they have at DefCon, DerbyCon, etc. --Thanks. |
|
Aug 20 |
answered | Best way to handle identity theft incident? |
|
Aug 20 |
answered | Fostering an environment where honesty and disclosure are valued |
|
Aug 20 |
asked | How useful or beneficial is participating in CTF contests for my security career? |
|
Aug 20 |
awarded | Editor |
