32,908 reputation
1379150
bio website linkedin.com/in/avidouglen
location Israel
age 40
visits member for 4 years, 4 months
seen 8 mins ago

Security expert and experienced Windows programmer


Apr
21
comment Secure memcpy for pure C
I also want to raise 2 more points wrt memcpy_s: though it is not part of C99, it is part of ISO/IEC TR 24731. More importantly, memcpy_s (or anything similar) is just another "decent tool" that helps with "awareness of good practice" and enables me (the security auditor) to better validate the "poor code". I know it's not on the platform I'm using, that is why I am asking, since there is no reason to compile it cross-platform.
Apr
21
comment Secure memcpy for pure C
The C++ comment wrt std:string is apt, however that is unfortunately not the case here...
Apr
21
comment Secure memcpy for pure C
Overall, generally good advice... But specifically wrt the question, there are a few good points here: ... makes it a little harder to make mistakes, yes, that's kind of the point... and that's what I (and the other security pros) are trying to achieve. No silver bullet. Just trying to enforce and validate STR31/35...
Apr
21
reviewed Reject What are the good use cases for disk encryption?
Apr
21
comment Secure memcpy for pure C
@Rook it was closed on SO for the reason I mentioned. strcpy for static text is different from user input, but debating whether or not to use "safe functions" isn't argumentative, it's part of the answer... so where is the argumentative? Please tell me and I will change it.
Apr
21
comment Where can I find some “real time” discussion forums for security issues?
@WZeberaFFS and @Iszi have a point - what benefit does "real time" get you that a quick, specific answer from this site doesn't? That said, this question as it stands now isnt really on topic for this site. If you wanted to discuss shortcomings of the site - then we can move this to meta.security.stackexchange.com. Otherwise we'd probably close this... or you can ask in the chatroom :)
Apr
21
revised Recommended policy on password complexity
edited tags
Apr
21
answered Where can I find some “real time” discussion forums for security issues?
Apr
21
comment Secure memcpy for pure C
'course, that's one of the benefits of working in C, and low-level memory in general - no constraint. Plenty o' rope...
Apr
21
comment Secure memcpy for pure C
+1 for the first half (although that doesnt really help me - unless there's a port to Linux?), and another +1 for the 2nd half - I agree completely. I always hated the union form - it just doesnt sit well with me. But of course, tell this to any veteran C programmer, and he'll jump down your throat with both hands around your windpipe: "you just don't understand C philosophy, thats the correct way to do things here, and the only unsafe thing is because you don't know what you're doing."
Apr
21
comment Secure memcpy for pure C
@Rook really? I reread it, a day later, and I'm still struggling to find anything remotely argumentative (except at the buffer overflows) or rhetoric - except for suggesting that Microsoft may have done something non-evil... Can you please point it out? (The fellows at the SO question were to busy shouting anti-MS slogans to give any information...)
Apr
21
comment Code Review Strategies
@p_upadhyay I absolutely agree with @Rory's comment. However, in situations where that is not possible, or you're pulled in only at that late stage - then yes, I would agree with your comment that this has some design review built in. But that is "by design" - if you don't understand the architecture and design of the system, your code review will not be effective, nor as efficient. So yes, you definitely need to base your CR on your DR...
Apr
21
comment Do you detect/react to DNS tunnelling?
That terminology always bugged me... they dont limit a port to an application, but they may limit it to a specific protocol. Might not be a huge difference for DNS (though there might be), but e.g. HTTP - is that really considered a single application?
Apr
21
revised Secure memcpy for pure C
rolled back to a previous revision
Apr
20
comment Can anyone provide references for implementing web application self password reset mechanisms properly?
That's not necessarily a 2 factor solution, but it is out-of-band.
Apr
20
comment Secure memcpy for pure C
@Rook, sorry to enlighten you, but @Thomas is a well recognized cryptographer.
Apr
20
comment What indicators did OWASP use to end up with OWASP Top 10?
Re SANS, I don't know how they define their ratings, but quoting: "It leverages experiences in the development of the SANS Top 20 attack vectors and MITRE's Common Weakness Enumeration (CWE) .... This year's Top 25 entries are prioritized using inputs from over 20 different organizations, who evaluated each weakness based on prevalence and importance"
Apr
20
comment What indicators did OWASP use to end up with OWASP Top 10?
As per OWASP, this is a result of their shift towards proper risk management, and not just "enumerating badness". I think it's definitely a step in the right direction, even though I'm not 100% with their rating methodology.
Apr
20
answered Code Review Strategies
Apr
20
comment Is there a way for a consumer to report PCI non compliance?
Not that this will help, but PCI does require you to handle security reports... But of course, if they're not compliant, they probably dont have that either...