32,883 reputation
1379150
bio website linkedin.com/in/avidouglen
location Israel
age 40
visits member for 4 years, 4 months
seen 5 hours ago

Security expert and experienced Windows programmer


Apr
23
revised Secure memcpy for pure C
removed crosspost
Apr
23
accepted Secure memcpy for pure C
Apr
23
comment Secure memcpy for pure C
Two practical points: cross-compilation is not an issue here, I don't need a common denominator (if I did, I'd probably consider Java... ;) ). Second, as you mention at the end of your last comment, most programmers are not great programmers, and that's exactly why I'm looking for this. I would also point out, this wouldnt help for BAD programmers, they can flub anything up... it's for the basically GOOD (but not supergreat) programmers, who will do the right thing when it's pointed out to them - it's for them that memcpy_s (or similar) would help immensely.
Apr
23
comment Secure memcpy for pure C
@Ninefingers, I understand from your comments that there are some anti-MS sentiment. However, I really don't care a whit about that, one way or another. It has no bearing on the question, which was "any more secure replacements for memcpy" (which has been proven time and again as probabilistically dangerous, that is, likely to be used in an unsafe manner). As an example, I mentioned the well-known bandaid that MS implemented (which btw, was not their "invention").
Apr
23
comment Secure memcpy for pure C
@Graham, I know, that's what I was referring to with my "Plenty o' rope" comment :D
Apr
22
revised Howto seed the PRNG in OpenSSL properly?
edited tags
Apr
22
comment Password Hashing add salt + pepper or is salt enough?
If I understand correctly, and this was discussed in the q I linked to, a pepper can "...help mitigate certain compromise scenarios (eg, database backups going missing) by having a piece of the puzzle stored elsewhere" (@RoryMccune). Also can differentiate your hashes from someone elses - IF a big enough rainbow table is ever constructed...
Apr
22
revised What do you do to protect data on a Macbook in the event of theft/loss of the device?
edited tags
Apr
22
revised Are all security requirements expected to be testable?
edited tags
Apr
22
answered Are all security requirements expected to be testable?
Apr
22
comment Are all security requirements expected to be testable?
Heh, this reminds me of that Dilbert cartoon, where he meets the random troll: "Nine. Nine. Nine. Nine." Dilbert: "How can you tell that its really random?" Troll: "That's the problem with random, you can never be sure."
Apr
22
revised Are all security requirements expected to be testable?
edited tags
Apr
22
revised Brute force vs other methods of recovering passwords from shadow file
edited tags
Apr
22
revised Password Hashing add salt + pepper or is salt enough?
edited tags
Apr
22
comment Password Hashing add salt + pepper or is salt enough?
Related but not quite the same as security.stackexchange.com/questions/211/password-hashing
Apr
22
comment Do you detect/react to DNS tunnelling?
@Graham, ah see, that's still the protocol - you're blocking XMPP, not a specific Jabber application. As I understand it, they're referring to the application layer, a.k.a layer 7 in OSI model... That's not really the same thing...
Apr
22
comment Topics for SecureCoding course in C
Thanks, but as I noted above this one set is part of a larger series, all the general principles and best practices are taught in other parts. This one single session is specifically about C language-specific issues and implementations.
Apr
22
comment Do you detect/react to DNS tunnelling?
@Graham, that's still examining the protocol, unless a certain application has a distinct signature it can't really say anything about the endpoint application.
Apr
21
comment Do you detect/react to DNS tunnelling?
Really? How do they detect what application is handling the network connection at the endpoint?
Apr
21
comment Secure memcpy for pure C
I also want to raise 2 more points wrt memcpy_s: though it is not part of C99, it is part of ISO/IEC TR 24731. More importantly, memcpy_s (or anything similar) is just another "decent tool" that helps with "awareness of good practice" and enables me (the security auditor) to better validate the "poor code". I know it's not on the platform I'm using, that is why I am asking, since there is no reason to compile it cross-platform.