101 reputation
bio website
location Richmond, VA
age 38
visits member for 3 years
seen Dec 13 at 9:04

OK, i have to rant for a second. Why is it that of the thousands of posts of PHP/MySQL advice on SO, about 99.5% are still using mysql_query -- and about half of those could be the poster child for SQL injection?

It's really not that hard, y'all...

$db = new PDO(...);
$stmt = $db->prepare('
    SELECT some_stuff
    FROM some_table
    WHERE some_field = ?
$stmt->execute(array('some value'));

while ($row = $stmt->fetch())

I don't want to have to start calling people out on it, but seriously, prepared statements aren't just safer, they're freaking easier. Learn them or quit calling yourself a PHP programmer.

comment What makes it difficult to have a hardware antivirus
@tepples: Good luck doing that with a PC, though. You already see people intentionally breaking the security of their iPhones, because security and restrictions are basically one and the same.
comment Is there ever a good reason _not_ to use TLS/SSL?
@LieRyan: "...usually does so out of actual concerns that they have" and the modern mentality of "TLS/SSL everywhere" kinda clash. Either there are actual/specific concerns (which means not doing it is justifiable in other cases), or using TLS/SSL is just "what you should do" these days (and actual concerns easily get drowned out by all the chanting about best practices).
comment How to know if firmware is stealing my information?
AV and firewalls probably wouldn't help either, if the compromise is in the firmware. The OS depends on the system to tell it what's going on, and the firmware can make the system lie. Particularly if the hardware was designed to allow that type of behavior. And network activity at that level would bypass pretty much any firewall rules at the OS level or above.
comment Pionee Red: Is this a Phishing attack? What should we do?
Define "went a little further". If you logged in, you might have gotten compromised. That's not a google login page. (Google would be using SSL and a google.com domain, for starters.)
comment Adding 65K buffer to protect from buffer overflows?
Note, too, that if the canary is dead, the only safe option is to abort the program. You don't know what else has been modified at that point.
awarded  Commentator
comment Why does an anti-forgery token need so many bits?
@Gili: 128 bits is not much at all. It's 32 hex digits. The size of an MD5 hash, or of a GUID...and your language of choice makes it trivial to generate at least one of those. And frankly, expiring a token after 5 minutes will annoy pretty much everybody who posts a form but doesn't type all that fast. :P
comment What's to stop someone from 3D print cloning a key?
This. Most locks are hackable. The main thing they do is add enough difficulty to keep honest people and half-hearted criminals out. Someone determined to get in will find/use the weak link in your security, which might not be the lock at all. It might be the door itself, an open window, the fact that the security staff is a bit too "helpful" sometimes...etc.
comment Why would you not permit Q or Z in passwords?
If different keyboard layouts were the issue, passwords would only be able to have digits (and possibly the punctuation marks from Shift+digit). Dvorak and QWERTY only match on the digit keys and the letters A and M. AZERTY doesn't even match on the letters.
comment Can I determine a private key given the encrypted data and corresponding cleartext?
Consider: I could make up my own B, and encrypt it with my target's public key to get A. (Key word being public -- these keys are supposed to be sharable with the world.) Were that enough info on its own to recover a private key, public key crypto would be worthless.
comment Can “cat-ing” a file be a potential security risk?
For reference, PuTTY by default will respond to a Control-E with the string "PuTTY" (but you can make it say something else if you want). Which isn't really a security issue unless someone's listening in on your connection or injecting stuff...in which case, if that's your machine, you already have much bigger problems than someone knowing you use PuTTY.
comment Are there “secure” languages?
Turing completeness basically means a language can emulate any other computer (=> program => compiler => language feature) in existence. It doesn't mean a feature you're emulating can ever be as powerful, or as exploitable, as if it were native to the language. Java being a prime example -- you could emulate pointers using an array and int "pointers", but you'd still have to intentionally write code to allow a buffer to overflow. And it wouldn't affect anything outside the array.
comment Why should I care if a site uses encryption or not if I'm not exchanging any sensitive data?
@RobertPetz: "Entirely possible" overstates a bit. That's what SSL certificates are for. You'd never get a certificate for bbc.com signed by a reputable CA, and the disreputable ones won't get you any better acceptance than self-signing (which will flag the site in every browser i know of). And the signatures aren't exactly trivial to forge.
comment Is Java relevant to Information Security?
@Anh: If you know one language, or are trying to only learn one language, you're naturally going to tend to look at every problem from that language's POV, and possibly try to shove it into that language's little box. If you're solely learning Java, for example, the concept of a buffer overrun might be too abstract to even make sense to you. You need to know something about at least a couple of different languages, including C and/or an assembly language, so you can step back and look at things from a more language-agnostic, more computer-centric POV.
comment How can someone go off-web, and anonymise themselves after a life online?
They're definitely allowed to build a database of what items you buy...what do you think "loyalty cards" are really for? The stores aren't just eager to save you money...they're collecting info about you.
awarded  Supporter
awarded  Autobiographer