dr jimbob

11,739 reputation

1556

bio	website
	location	Brooklyn, NY
	age	31
visits	member for	2 years
	seen	12 mins ago
stats	profile views	275

Good Morning how are you, I'm dr jimbob
I'm interested in things.
I'm not a real dr,
But I am a real jim bob.

Have a PhD in Experimental High-Energy Physics, but left academia in mid-2010 to program professionally.

Mostly program/script in python, django, and jquery these days doing mostly web apps.

Also have experience programming in C, C++, java, haskell, php, and (bash) shell more in the past.

Linux as primary OS since 1999, ubuntu user since 2005 (Hoary).

	11,739 reputation	bio	website		visits	member for	2 years
1556 badges		location	Brooklyn, NY		seen	12 mins ago

summary answers questions tags badges favorites bounties reputation activity

861 Actions

suggestions reviews revisions comments badges posts accepts all

Mar 7	answered	At what point does something count as 'security through obscurity'?
Mar 7	revised	How risky is it not to install ssl? added 191 characters in body
Mar 7	answered	How risky is it not to install ssl?
Mar 5	answered	Passwords Being Sent in Clear Text Due to Users' Mistake in Typing it in the Username Field
Mar 5	comment	Passwords Being Sent in Clear Text Due to Users' Mistake in Typing it in the Username Field This makes no sense. The problem is that the user accidentally typed in password in the username field. It doesn't matter if its an HTTP POST or an AJAX XMLHttpRequest. If the password was in the username field, you don't want it sent over the network (unencrypted). Also, its generally a bad idea to process non-existent usernames differently than an incorrect password as it allows attackers to find a valid accounts. (Especially bad if you don't require CAPTCHA or similar allowing attackers to easily collect usernames).
Mar 2	comment	Is it possible to steal money directly from the systems of a big bank? As an aside: floating point numbers should never be used to represent money. Money in real life is broken down into decimals (in base 10) that can't be represented exactly in base 2. This introduces rounding errors appear into your calculations that you don't want to deal with. You should do exact math using say a Decimal object or using integers (representing pennies) to remove this uncertainty.
Feb 28	comment	Testing for HTTP TRACE method If they aren't using HTTPS, you can replace your step 1 (`openssl s_client -connect example.com:443`) with `telnet example.com 80`.
Feb 27	comment	How to predict C rand()? @SmitJohnth - What polynomial means, is that if you use gcc with glibc <stdlib.h> will have one implementation of `rand()`. If you use say MS Visual Studio with the MS C Run-time library, the rand() function may be implemented completely differently. See: en.wikipedia.org/wiki/C_standard_library#Implementations
Feb 27	revised	How to predict C rand()? deleted 76 characters in body
Feb 26	awarded	ssl
Feb 25	comment	How do i protect my self from “Form grabbing” attack? @SmartyTwiti = updated answer significantly.
Feb 25	revised	How do i protect my self from “Form grabbing” attack? added 2342 characters in body
Feb 25	answered	Why do we not trust an SSL certificate that expired recently?
Feb 24	answered	How do i protect my self from “Form grabbing” attack?
Feb 24	awarded	Custodian
Feb 24	reviewed	Close Best practices for firewall hardware
Feb 23	comment	How is “<scrscriptipt>” or “selselectect” used to avoid filtering? @HagenvonEitzen - For HTML sanitation there is a good solution of just escaping `<>&'"` to their HTML escaped versions e.g., `<` that the browser specifically should not invoke, and just because you saw `<scr<script>>` doesn't necessarily imply an attack -- it could be a generic discussion like what we are having where someone forgot to escape. Granted, I agree with your approach to sanitation if you are sure its an attack of some sort. E.g., if a POST variable came from a pull down form and there's an unexpected value -- that could mean someone's attacking/probing you.
Feb 22	comment	Can I determine which algorithm was used if I know the matching hash of a given input? Well not completely incorrectly; he just dropped the bytes that that aren't printable ASCII (roughly half of them). `base64.decodestring('Tut0nlFFZ9sLVhPE5x81lQ==')` gives me 'N\xebt\x9eQEg\xdb\x0bV\x13\xc4\xe7\x1f5\x95' or '4e eb 74 9e 51 45 67 db 0b 56 13 c4 e7 1f 35 95` as bytes (in hex).
Feb 22	awarded	Nice Answer
Feb 22	comment	How is “<scrscriptipt>” or “selselectect” used to avoid filtering? @CodesInChaos - Agree. I'm not advocating someone builds their own HTML sanitizer. Its saner to just use a safe lightweight markup language (where symbols like `<` are automatically escaped to `<` and whitelisted safe HTML elements are inserted) or well-tested HTML purifier, and have said this more than once. However, this is a clear example of bypassing non-recursive filtering (see example 5 ).