164 reputation
9
bio website mikestechspot.blogspot.com
location Detroit, MI
age 28
visits member for 1 year, 3 months
seen 18 hours ago

Too Many Interests to list, SE accounts speak for themselves. Christian, Programmer, IT Professional, Embedded enthusiast, chess player, the list goes on.


Interested in all things Embedded?

Stack Exchange Q&A site proposal: Embedded Programming and Design


Everyone could use a little nutritional knowledge...

Stack Exchange Q&A site proposal: Nutrition


Apr
16
comment Are there “secure” languages?
@DavidYoung I've proposed an edit to this question, the most well defined term for this to date is a Buffer Over-Read.
Apr
16
revised Are there “secure” languages?
Corrected the actual name of the coding overlook and resulting exploit, with citation.
Apr
16
suggested suggested edit on Are there “secure” languages?
Apr
16
comment Are there “secure” languages?
@DavidYoung I'm going to have to pose that question on one of these sites to see if there is a name for it. That wouldn't have prevented it, sadly, because the only way to know how much was supposed to be returned is relying upon the data from the user. Without checking the presented length with the actual length, you have, in this case, Heartbleed.
Apr
15
comment Are there “secure” languages?
@KnightOfNi is right, it's always functionality first, not to branch too far off topic. A program is written to solve a particular problem, in OpenSSL's case, that problem is the implementation of a security protocol. How secure that implementation is, is an extremely close second to its primary function.
Apr
14
comment Are there “secure” languages?
Also, rereading your question, this was not the result of buffer overflow, while they are close, I don't know if there is a term for this.
Apr
14
comment Are there “secure” languages?
@Brilliand I did read his answer. To clarify I mean any language that allows the developer to access dynamic memory (allocate, copy, etc), which is what that function does. Simply put, the vulnerability is not a buffer overflow, neither due to array bounds checking. This is because the function that sends the heartbeat uses memcpy() and takes a pointer to the supposed 'payload' sent from the client, which in reality can contain anything, as we've seen.
Apr
14
comment Are there “secure” languages?
Well, I don't have experience w/ Ada, however I don't believe any programming language would have prevented heartbleed, and am prepared to defend that statement.
Apr
14
comment Are there “secure” languages?
Would you accept any variant of Pig Latin as a valid answer?
Jan
20
comment Is it possible to prevent a physical attack on full disk encryption?
@Gurzo that'd be my thought.
May
17
answered How to avoid scripts with hardcoded password?
May
11
comment How can I punish a hacker?
How do you know you have his real IP Address?
Apr
26
awarded  Scholar
Apr
26
accepted Does there exist software that will scan a filesystem for possible files containing PHI?
Apr
26
awarded  Commentator
Apr
26
awarded  Student
Apr
26
comment Does there exist software that will scan a filesystem for possible files containing PHI?
You make a good point, the software would only be reliable in a certain range, and it would be far cheaper to write the software in house. Even if such software only found names and/or possible SSNs, that would help.
Apr
26
asked Does there exist software that will scan a filesystem for possible files containing PHI?
Apr
23
awarded  Critic
Apr
20
comment how secure is passwordcard.org?
+1, it really isn't that difficult to remember a handful of passwords and some logical variations. In all fairness though, if most systems had the same password requirements it would be easier use the same complex password for each system, which could be a downfall. Maybe that's a good reason why certain systems only allow certain special chars, drives me nuts.