101 reputation
3
bio website 127.0.0.1
location Richmond, VA
age 38
visits member for 2 years, 10 months
seen Oct 2 at 7:17

OK, i have to rant for a second. Why is it that of the thousands of posts of PHP/MySQL advice on SO, about 99.5% are still using mysql_query -- and about half of those could be the poster child for SQL injection?

It's really not that hard, y'all...

$db = new PDO(...);
$stmt = $db->prepare('
    SELECT some_stuff
    FROM some_table
    WHERE some_field = ?
');
$stmt->execute(array('some value'));

while ($row = $stmt->fetch())
{
     ...
}

I don't want to have to start calling people out on it, but seriously, prepared statements aren't just safer, they're freaking easier. Learn them or quit calling yourself a PHP programmer.


Aug
8
comment Is there ever a good reason _not_ to use TLS/SSL?
@LieRyan: "...usually does so out of actual concerns that they have" and the modern mentality of "TLS/SSL everywhere" kinda clash. Either there are actual/specific concerns (which means not doing it is justifiable in other cases), or using TLS/SSL is just "what you should do" these days (and actual concerns easily get drowned out by all the chanting about best practices).
Jun
23
comment How to know if firmware is stealing my information?
AV and firewalls probably wouldn't help either, if the compromise is in the firmware. The OS depends on the system to tell it what's going on, and the firmware can make the system lie. Particularly if the hardware was designed to allow that type of behavior. And network activity at that level would bypass pretty much any firewall rules at the OS level or above.
Jun
22
comment Pionee Red: Is this a Phishing attack? What should we do?
Define "went a little further". If you logged in, you might have gotten compromised. That's not a google login page. (Google would be using SSL and a google.com domain, for starters.)
Jun
22
comment Adding 65K buffer to protect from buffer overflows?
Note, too, that if the canary is dead, the only safe option is to abort the program. You don't know what else has been modified at that point.
Jun
3
awarded  Commentator
Jun
3
comment Why does an anti-forgery token need so many bits?
@Gili: 128 bits is not much at all. It's 32 hex digits. The size of an MD5 hash, or of a GUID...and your language of choice makes it trivial to generate at least one of those. And frankly, expiring a token after 5 minutes will annoy pretty much everybody who posts a form but doesn't type all that fast. :P
May
22
comment What's to stop someone from 3D print cloning a key?
This. Most locks are hackable. The main thing they do is add enough difficulty to keep honest people and half-hearted criminals out. Someone determined to get in will find/use the weak link in your security, which might not be the lock at all. It might be the door itself, an open window, the fact that the security staff is a bit too "helpful" sometimes...etc.
May
14
comment Why would you not permit Q or Z in passwords?
If different keyboard layouts were the issue, passwords would only be able to have digits (and possibly the punctuation marks from Shift+digit). Dvorak and QWERTY only match on the digit keys and the letters A and M. AZERTY doesn't even match on the letters.
Apr
28
comment Can I determine a private key given the encrypted data and corresponding cleartext?
Consider: I could make up my own B, and encrypt it with my target's public key to get A. (Key word being public -- these keys are supposed to be sharable with the world.) Were that enough info on its own to recover a private key, public key crypto would be worthless.
Apr
24
comment Can “cat-ing” a file be a potential security risk?
For reference, PuTTY by default will respond to a Control-E with the string "PuTTY" (but you can make it say something else if you want). Which isn't really a security issue unless someone's listening in on your connection or injecting stuff...in which case, if that's your machine, you already have much bigger problems than someone knowing you use PuTTY.
Apr
15
comment Are there “secure” languages?
Turing completeness basically means a language can emulate any other computer (=> program => compiler => language feature) in existence. It doesn't mean a feature you're emulating can ever be as powerful, or as exploitable, as if it were native to the language. Java being a prime example -- you could emulate pointers using an array and int "pointers", but you'd still have to intentionally write code to allow a buffer to overflow. And it wouldn't affect anything outside the array.
Mar
24
comment Why should I care if a site uses encryption or not if I'm not exchanging any sensitive data?
@RobertPetz: "Entirely possible" overstates a bit. That's what SSL certificates are for. You'd never get a certificate for bbc.com signed by a reputable CA, and the disreputable ones won't get you any better acceptance than self-signing (which will flag the site in every browser i know of). And the signatures aren't exactly trivial to forge.
Jan
20
comment Is Java relevant to Information Security?
@Anh: If you know one language, or are trying to only learn one language, you're naturally going to tend to look at every problem from that language's POV, and possibly try to shove it into that language's little box. If you're solely learning Java, for example, the concept of a buffer overrun might be too abstract to even make sense to you. You need to know something about at least a couple of different languages, including C and/or an assembly language, so you can step back and look at things from a more language-agnostic, more computer-centric POV.
Dec
19
comment How can someone go off-web, and anonymise themselves after a life online?
They're definitely allowed to build a database of what items you buy...what do you think "loyalty cards" are really for? The stores aren't just eager to save you money...they're collecting info about you.
Dec
7
awarded  Supporter
Dec
7
awarded  Autobiographer