166 reputation
9
bio website mikestechspot.blogspot.com
location Detroit, MI
age 29
visits member for 1 year, 7 months
seen Jul 24 at 14:06

Too Many Interests to list, SE accounts speak for themselves. Christian, Programmer, IT Professional, Embedded enthusiast, chess player, the list goes on.


Interested in all things Embedded?

Stack Exchange Q&A site proposal: Embedded Systems Programming and Design


Jun
27
comment How can I watch porn, safely, and not get a virus? (and not infect corporate data also)
youtube.com/watch?v=QSKBoO5hBHk
Jun
27
comment Are popular porn sites more likely to be infected with malware?
a 'friend', riiiight.
May
29
revised Are there any reasonable TrueCrypt forks?
Removed speculation; It's still hearsay at this point.
May
29
suggested suggested edit on Are there any reasonable TrueCrypt forks?
May
12
comment Why do I hear about so many Java insecurities? Are other languages more secure?
Only beefs I have with this answer is that 1) Heartbleed was not the result of a buffer overflow attack. 2) You also cannot say that a language coupled with a virtual machine is 'better' than another language by itself, for obvious reasons. Other than that, good note about the real holes being in that sandbox, a programming language is no more 'safe' or 'unsafe' than a human language, it all boils down to a compiler or interpreter, and most important: The person using the language.
Apr
16
comment Are there “secure” languages?
@DavidYoung I've proposed an edit to this question, the most well defined term for this to date is a Buffer Over-Read.
Apr
16
revised Are there “secure” languages?
Corrected the actual name of the coding overlook and resulting exploit, with citation.
Apr
16
suggested suggested edit on Are there “secure” languages?
Apr
16
comment Are there “secure” languages?
@DavidYoung I'm going to have to pose that question on one of these sites to see if there is a name for it. That wouldn't have prevented it, sadly, because the only way to know how much was supposed to be returned is relying upon the data from the user. Without checking the presented length with the actual length, you have, in this case, Heartbleed.
Apr
15
comment Are there “secure” languages?
@KnightOfNi is right, it's always functionality first, not to branch too far off topic. A program is written to solve a particular problem, in OpenSSL's case, that problem is the implementation of a security protocol. How secure that implementation is, is an extremely close second to its primary function.
Apr
14
comment Are there “secure” languages?
Also, rereading your question, this was not the result of buffer overflow, while they are close, I don't know if there is a term for this.
Apr
14
comment Are there “secure” languages?
@Brilliand I did read his answer. To clarify I mean any language that allows the developer to access dynamic memory (allocate, copy, etc), which is what that function does. Simply put, the vulnerability is not a buffer overflow, neither due to array bounds checking. This is because the function that sends the heartbeat uses memcpy() and takes a pointer to the supposed 'payload' sent from the client, which in reality can contain anything, as we've seen.
Apr
14
comment Are there “secure” languages?
Well, I don't have experience w/ Ada, however I don't believe any programming language would have prevented heartbleed, and am prepared to defend that statement.
Apr
14
comment Are there “secure” languages?
Would you accept any variant of Pig Latin as a valid answer?
Jan
20
comment Is it possible to prevent a physical attack on full disk encryption?
@Gurzo that'd be my thought.
May
17
answered How to avoid scripts with hardcoded password?
May
11
comment How can I punish a hacker?
How do you know you have his real IP Address?
Apr
26
awarded  Scholar
Apr
26
accepted Does there exist software that will scan a filesystem for possible files containing PHI?
Apr
26
awarded  Commentator