Reputation
416
Top tag
Next privilege 500 Rep.
Access review queues
Badges
3 6
Newest
 Yearling
Impact
~7k people reached

  • 0 posts edited
  • 0 helpful flags
  • 95 votes cast
Mar
23
comment Normal usage vs. denial-of-service? How many requests are needed to talk about a denial of service?
@PhilLello Your proof: at a former job, users could run reports that resulted in what we called "brownouts": One running report would result in the DB server queuing all queries that needed those same tables until the report was finished (which would take 3-5 minutes if we were lucky). Other aspects of the site, including database-backed content that didn't need the tables as this report, would continue to be highly responsive. The term "brownout" was coined by a manager who didn't want to admit the reality: A single (totally legitimate) request would result in a DoS.
Apr
8
awarded  Yearling
Apr
8
awarded  Nice Answer
Jan
23
awarded  Enlightened
Jan
23
awarded  Nice Answer
Dec
11
comment What real world benefits does PGP have over sending email with SSL/TLS such as with HTTPS?
@RobIII Sure, and I didn't/don't contest that (well, other than that the simple fact of communicating via encrypted channels is not incriminating...), I was just pointing out that "what you've been talking about" is only available if you make it available, i.e. put it outside the encrypted medium yourself. That you talk to Alice is of course available, and I never argued that; what you said to her, however, is not -- not unless you (or her) screw up.
Dec
11
comment What real world benefits does PGP have over sending email with SSL/TLS such as with HTTPS?
@jww They only get to see what you've been talking about if you put "Our secret plan to topple the Taliban" in the Subject line. If you instead put "Grandma's top-secret muffin recipe" there, then no, they don't know that you're actually talking about Grandma's top-secret chicken pot pie recipe!
Dec
5
awarded  Commentator
Dec
5
comment Is data-remanence a concern in RAM?
@Celeritas It works for me. I guess if you can't see it, you'll just have to trust me that it totally validates everything I've said, and also proves incontrovertibly that apples are the far superior fruit! Or I can just copy/paste the link here without formatting in the hopes that this will work for you: codeproject.com/Articles/670373/…
Dec
5
comment Is data-remanence a concern in RAM?
@Celeritas In many cases that's how it is done, yes (e.g. when you compile a program with debug options), but that's not always the case, especially in the example of modders hacking on a game not designed for modding. It does (barring a bug/flaw in the OS) require elevated privileges, however. Here's one example; without modifying notepad.exe, it shows how to do it with simple code. And, again, it's dependent upon permissions in the OS, but root/admin could do this for any process.
Dec
5
comment Is data-remanence a concern in RAM?
It's the "sufficient privileges" bit that's important, hence why I stressed in my answer not running untrusted programs with elevated privileges.
Dec
5
comment Is data-remanence a concern in RAM?
@Celeritas Sometimes there can be a bug, yes. There are, however, ways around the segfault; it's been a long time since I've coded at that low a level, and I no longer remember the specifics, but a process with sufficient privileges can read memory allocated to other processes without provoking a segfault. This is how, for example, many debuggers work, as well as a key tool in modding games that are not generally moddable involves doing the same thing -- basically grabbing dumps of the game's RAM so would-be modders can hack it.
Dec
4
answered Is data-remanence a concern in RAM?
Oct
7
awarded  Autobiographer
Sep
30
answered Is it true that certificates requested with a specific CSR can only be used on the machine where the CSR was generated?
Apr
13
awarded  Yearling
Jun
24
comment moving from MD5 to SHA-512
See, for example, the answer to this question: security.stackexchange.com/questions/4687/…
Jun
24
comment moving from MD5 to SHA-512
@Justin You could also just leave the "upgrade" code in place -- 3 years later (when my web app finally came down), the code to add salts to passwords that didn't have them was still there. There's actually a case to be made that more involved authentication procedures -- which take longer to complete -- improve security by naturally limiting the number of brute force attempts in a given period of time; this is why you'll see suggestions to hash passwords repeatedly instead of just once (although that's primarily to hinder off-line attacks if someone gets your database).
Jun
24
awarded  Teacher
Jun
24
comment PCI restrictions on using using (hashed) credit card number to identify a repeat customer?
PCI permits the storage and use of the first 5 digits (which identify the type of card) and last 4 digits of a credit card number. This is almost always enough to uniquely identify a transaction and, through that, the customer who made said transaction; it is not enough information, however, to use the card number. I know of at least one software product that does exactly this, however NDA prohibits me from saying what product or even what market said product is in.