21,443 reputation
33699
bio website
location Brooklyn, NY
age 33
visits member for 3 years, 6 months
seen yesterday
Good Morning how are you, I'm dr jimbob
I'm interested in things.
I'm not a real dr,
But I am a real jim bob.

Have a PhD in Experimental High-Energy Physics, but left academia in mid-2010 to program professionally.

Mostly program/script in python, django, and jquery these days doing mostly web apps.

Also have experience programming in C, C++, java, haskell, php, and (bash) shell more in the past.

Linux as primary OS since 1999, ubuntu user since 2005 (Hoary).


Dec
18
answered Is my developer's home-brew password security right or wrong, and why?
Dec
11
comment How do I prevent this type of SQL injection attack?
@Polynomial - I recommended bound parameters and in practice never encountered the situation where the pre-planned execution plan create a bottleneck that had to be fixed. Yes, my regex wouldn't let you search for J.J., Green-Ellis, O'Neill or Erdős and coupled with bad SQL strings could fail (SELECT * from mytable where name={user_input}; with no quotes around '{user_input}'). But a simple let's replace ' with \' may fail for complicated reasons (e.g., unicode characters got mapped to ' or you didn't map ` to \`) or they found some way to bypass your input sanitation.
Dec
11
comment How do I prevent this type of SQL injection attack?
Bound parameters aka parameterized query is the optimal solution. Its risky to trust any input sanitation you wrote yourself, as that's rolling your own security which is a bad idea and a clever attacker may be able to get through. Also bound parameters generally run faster, unless some queries benefit greatly from a different execution plan that a smart DB can figure out without bound parameters [[1]](use-the-index-luke.com/sql/where-clause/bind-parameters). If thats the case, make sure your input sanitation just whitelists safe input; e.g., filters out chars not in [A-Za-z0-9 ].
Nov
26
comment How do you explain the necessity of “nuke it from orbit” to management and users?
@MartinSchröder - I agree that pdfs (like *.doc) are dangerous as they aren't simple plaintext, but will often auto-execute embedded scripts. I disagree with images which will generally be safe when viewed through mature viewers. In principle, image viewers could be susceptible to buffer-overflow attacks, but only if poorly written (e.g., unsafe language with unsafe libraries never doing bounds checking). I'll browse the web and view whatever images are presented with no danger of viruses (unlike pdf/doc).
Nov
26
awarded  Nice Question
Nov
19
revised How do you explain the necessity of “nuke it from orbit” to management and users?
added 4 characters in body
Nov
19
comment How do you explain the necessity of “nuke it from orbit” to management and users?
@ktothez It's better to not transfer user data; e.g., rely on a safe backup from before infection. However, if necessary I'd do something like my answer convert MS Office docs to plaintext docs/CSV files on the infected machine, boot into a linux live cd on the infected computer, mount the infected hard drive with -noexec, and then selectively copy the limited number of plain-text documents from the infected machine to another computer. However, be suspicious of your files being maliciously altered--e.g., config files, passwords, data, etc.
Nov
19
answered How do you explain the necessity of “nuke it from orbit” to management and users?
Nov
17
revised Petraeus scandal - what would have been a better way to communicate electronically
added 544 characters in body
Nov
17
answered Petraeus scandal - what would have been a better way to communicate electronically
Nov
15
awarded  Popular Question
Nov
14
revised Can https be used instead of sftp for secure file transfers?
deleted 355 characters in body
Nov
14
revised Can https be used instead of sftp for secure file transfers?
added 55 characters in body
Nov
14
answered Can https be used instead of sftp for secure file transfers?
Oct
30
answered Is autocomplete=“off” compatible with all modern browsers?
Oct
11
comment E-mail read receipt through XSS
@HeatfanJohn - Yes. They can get access have a bit more info then in the default webserver logs; cookies that your browser has associated with their domain. I don't see this as a problem; e.g., if you have previously visited example.com in the same browser and they set cookies, and you later open an html email from example.com with images set to load, then they can see the cookies they have previously set for you (that were only modified by example.com). Though I should have mentioned that they can see http-referer header which for a webmail client indicates what webmail you use.
Oct
11
comment E-mail read receipt through XSS
@asudhak - Well that's a different question. Every modern (released in past ~5 years) email client/web mail site I've ever seen, sensibly disables javascript from running in an HTML email (and as a quick test both thunderbird and gmail block your example even when images are loaded). See: javascript.about.com/od/reference/a/jsemail.htm or stackoverflow.com/questions/1088016/html-email-with-javascript .
Oct
11
awarded  Nice Answer
Oct
10
revised E-mail read receipt through XSS
added 541 characters in body
Oct
10
answered E-mail read receipt through XSS