dr jimbob

11,649 reputation

1556

bio	website
	location	Brooklyn, NY
	age	31
visits	member for	2 years
	seen	9 hours ago
stats	profile views	274

Good Morning how are you, I'm dr jimbob
I'm interested in things.
I'm not a real dr,
But I am a real jim bob.

Have a PhD in Experimental High-Energy Physics, but left academia in mid-2010 to program professionally.

Mostly program/script in python, django, and jquery these days doing mostly web apps.

Also have experience programming in C, C++, java, haskell, php, and (bash) shell more in the past.

Linux as primary OS since 1999, ubuntu user since 2005 (Hoary).

	11,649 reputation	bio	website		visits	member for	2 years
1556 badges		location	Brooklyn, NY		seen	9 hours ago

summary answers questions tags badges favorites bounties reputation activity

334 Comments

suggestions reviews revisions comments badges posts accepts all

May 10	comment	Is showing your IP address in the URL a bad practice? @Xander - Agree that you have less flexibility by exposing an IP address. However, if you have a domain name its trivial to find the underlying IP address (`dig www.example.com`). The DNS record often has a TTL of a 10000+ seconds during which time you can attack a specific IP. Load balancing will help, but again if you are using a load balancer you wouldn't be pointing people to a specific IP.
May 9	comment	Is showing your IP address in the URL a bad practice? But browsers/routers/OSes usually cache DNS queries for hours; so there's effectively no difference. Also, unless you were using DNS round-robin/load balancing, its not like you could actively prevent an attack. That said, I avoid linking via IP addresses when possible as (1) IP addresses are typically harder to remember, (2) if you have (or ever want) more than one server running at the same IP browsers need to specify a domain name (to put in the `Host:` header of the HTTP request) and (3) if your server moves/changes IP addresses, you can keep the same domain name at the new IP.
May 9	comment	What is the difference between SSL vs SSH? Which is more secure? SSH's binary packet protocol is encrypt-and-MAC where for every plaintext message (m) it sends the ciphertext E(m)++MAC(m) (concatenate encrypted message with MAC), versus SSL which does E(m++MAC(m)). However, SSH is much more than just its binary packet protocol (key management, remote shell client/server, does file transfer, etc), while SSL (now called TLS) is just the transport layer protocol that is used in other protocols that add in the necessary functionality (e.g., HTTPS, FTPS, IMAPS etc.). Also see comparison of EtM, E&M, MtE at: crypto.stackexchange.com/questions/202
May 6	comment	Is it okay to reveal database's table names? @Krystian - I agree. Use good names in your application for your own sanity, but there's no reason to expose the name of a table to a client in a web application. It is ok to use the same word (e.g., your table is naturally called 'comments' and your URL and website also naturally has the same word in it). But you are vulnerable to SQL injection if you take a client-side variable (even if its set by your code) that has a table name that eventually makes it to an SQL command as a string for a table name (unless your server side input sanitation is perfect--but this is easy to screw up).
Apr 25	comment	How to determine hashes/second in password cryptanalysis openwall.info/wiki/john/benchmarks E.g., use the `--test` flag.
Apr 23	comment	Writing a script to tell which users are currently typing? lsof as in list open files? Something like: `pids=$(pidof python); lsof -p ${pids/ /,}` maybe?
Apr 22	comment	LT codes with Homomorphic hashing This is probably should be moved to crypto.stackexchange.com as it doesn't really focus on security side of things. (Still a good question; and finding the most appropriate SE is sometimes difficult as subjects like hashing span several SEs).
Apr 22	comment	LT codes with Homomorphic hashing @makerofthings7 ⊕ is one customary way of writing xor (exclusive or).
Apr 17	comment	What are the risk implications of not verifying referer header on login form? CSRF tokens are the only way to go. HTTP headers including Referer are trivial to spoof, and may be dropped by browsers for privacy reasons.
Apr 3	comment	Trying to make a Django-based site use HTTPS-only, not sure if it's secure? @Kave - Thanks. You need to set an environmental variable with a key of `HTTPS` to `on`. So if you call uwsgi from the command line via first example on django uwsgi page, you'd need to add the flag `--env HTTPS=on`. Or if you had an `uwsgi.ini` file you'd add the line: `env = HTTPS=on`. (The configuration is exactly identical to what you do for setting the environmental variable DJANGO_SETTINGS_MODULE. Just replace `DJANGO_SETTINGS_MODULE` with `HTTPS` and its value with `on`).
Mar 29	comment	Security measures for a WiFi access point? I agree with you on your main point of wifi security (use WPA2 with a strong password), but added some important clarifying points that I summarized as: Use WPA2 with a strong passphrase, disable WPS on your router (and change your SSID to not be something super common). If you want you can use MAC address filtering or disable SSID broadcast, though any patient eavesdropper can easily bypass either protection.
Mar 28	comment	Why on earth would anyone use the 'top secret' option of IPv4? Just because a feature is documented in a RFC doesn't mean its used. People designing this protocol back in 1981 likely imagined using this in a world very different than our modern world. Imagine a world with no GPG, SSL, or VPNs and where networks frequently use hubs (repeating packets to all ports) versus smart switches. You can imagine that flags like this could be useful in some way to be used by hardware to route traffic responsibly based on its level. Not aware that this has ever been used; but kind of like the obscure HTTP request methods (e.g., HTTP TRACE?).
Mar 27	comment	Was WPS fixed (wifi)? @SmitJohnth - Never claimed you didn't understand it, but this is a forum for people who may not be familiar with WPS (Wifi Protected Setup) so some context is helpful. The reason some tool (e.g., reaver) isn't working on newer routers is likely not a new protocol that brute-forcing the entire 10^7/10^8 (e.g., CERT isn't aware of it; wifi alliance hasn't announced new WPS protocol), but instead exponential/permanent timeouts after too many bad attempts preventing WPS brute-forcing.
Mar 11	comment	Simple solution to XSS @CedricMartin - Never called it obscurity, called it Rolling Your Own--its something new you came out with that hasn't been field tested. If you (1) intend to use only as defense-in-depth (also HTML escaping `<>&'"`), (2) never need user input in places this method breaks (in javascript, between `<title>` tags, inside HTML tags like the href part of a link), and (3) do not mind the extra overhead (server-side template processing/client-side DOM rendering/more network traffic), then this is likely ok. However, I really don't see any extra defense or positives it gives over HTML escaping.
Mar 10	comment	Simple solution to XSS @CedricMartin - Calling it silly was a bit harsh -- it is a clever novel way that likely solves the problem. But being clever and novel is an anti-pattern for security called "rolling your own". When well-vetted common methods exist, you should stick to them. Your method is less flexible than existing methods (e.g., couldn't be used to encode a URL into a link), couldn't be used inside javascript, and less efficient on the browser. Again, just because the people in this thread can't easily find a vulnerability in an abstract idea, any specific implementation may have one.
Mar 10	comment	Simple solution to XSS +1 - Good point with HTML encoding not being panacea. Granted if had earlier in the page in a script: `var msg = "hi');alert(/xss/)//'"` and then `<a href="" onclick="alert(msg)">click</a>`, the HTML encoding would have saved you.
Mar 10	comment	DOM Based XSS attacks: what is the most dangerous example? @Akam - Yes, if the malicious content is already in the DOM sent in the response, they don't call it DOM-based XSS. DOM-based XSS relies on the DOM getting modified, inserting attacker controlled unsafe content after it was initially sent without proper safeguards.
Mar 5	comment	Passwords Being Sent in Clear Text Due to Users' Mistake in Typing it in the Username Field This makes no sense. The problem is that the user accidentally typed in password in the username field. It doesn't matter if its an HTTP POST or an AJAX XMLHttpRequest. If the password was in the username field, you don't want it sent over the network (unencrypted). Also, its generally a bad idea to process non-existent usernames differently than an incorrect password as it allows attackers to find a valid accounts. (Especially bad if you don't require CAPTCHA or similar allowing attackers to easily collect usernames).
Mar 2	comment	Is it possible to steal money directly from the systems of a big bank? As an aside: floating point numbers should never be used to represent money. Money in real life is broken down into decimals (in base 10) that can't be represented exactly in base 2. This introduces rounding errors appear into your calculations that you don't want to deal with. You should do exact math using say a Decimal object or using integers (representing pennies) to remove this uncertainty.
Feb 28	comment	Testing for HTTP TRACE method If they aren't using HTTPS, you can replace your step 1 (`openssl s_client -connect example.com:443`) with `telnet example.com 80`.