918 reputation
616
bio website php100.wordpress.com
location San Jose, CA
age 40
visits member for 3 years, 11 months
seen Aug 28 at 20:49
Programmer (Unix, Windows, C, C++, PHP, etc.)

Feb
4
comment OWASP escaping recommendation - why /?
Thanks for the link to minimal rules. They make much more sense, actually.
Feb
4
comment OWASP escaping recommendation - why /?
No, it's not analogous, because / has meaning in that context, while in original context it does not, and that was the point of the question!
Feb
4
comment OWASP escaping recommendation - why /?
@FalconMomot in general, it is, but adding random characters to escape list just doesn't make sense. Why won't they then suggest to add letter Z to the list? Just to be cautious, maybe it's dangerous too. It just looks completely random, sorry.
Feb
4
comment OWASP escaping recommendation - why /?
This recommendation is specifically for content outside elements, not for attributes. For attributes they recommend completely different handling, see the next item after the one I have linked.
Feb
4
comment OWASP escaping recommendation - why /?
Well, then they should suggest escaping pretty much any non-alphanum character, since most of them have significance in some context. They don't do it. They correctly identify the characters that may be significant in HTML, but then add / which is not. Also, you can not inject <br/> since < and > are encoded, so you could inject only &lt;br/&gt; - what's wrong with that?
Jan
20
comment Reasonable way to store encrypted passwords in a webapp's database, Linux
I've asked similar question a while ago: security.stackexchange.com/questions/1335/…
Jan
20
comment Reasonable way to store encrypted passwords in a webapp's database, Linux
mysql supports working over SSL.
Sep
17
comment Best way to sanitize user input in PHP
One note - htmlspecialchars() is useful only in specific HTML context - such as outside tags. E.g. if you do <img src=$var> then applying htmlspecialchars() to $var won't help you, but urlencode() might. And code may also end up inside CSS or JS where different rules apply.
Jun
13
comment Is it legal to find bugs on a website and report them to the website's owner?
BTW, I've seen instances where companies answered "we don't know what you're talking about, we're super-secure" and then quietly fixed the problem. So you may hope the good deed is still done, just you're not getting any credit for it :)
Jun
10
comment What are the implications of NSA surveillance on the average internet user?
There's actually more than two stories. E.g. story about IRS considering every mailbox public information not requiring a warrant: aclu.org/blog/technology-and-liberty-national-security/…
Jul
7
comment Are there vunerabilities with this authentication mechanism?
@curiousguy I think many protocols that ignore invalid data and do not cancel communication when getting some invalid data would not be susceptible o this particular problem.
Jul
6
comment Are there vunerabilities with this authentication mechanism?
Checking if request token was authorized doesn't help, because attacker could after observing step 2 disrupt communication with the client (e.g. by some kind of network attack slowing down client's network) and issue his own response with the timestamp first. If you allow only one response with this timestamp, you then allow very easy DOS attack on the protocol - I can prevent any client from logging in as long as I can send response faster than they do. If you allow many responses with the same timestamp, I can bruteforce it.
May
9
comment Hiding version - valuable or just security by obscurity?
you can, never saw that done in practice though.
May
9
comment Hiding version - valuable or just security by obscurity?
but if you have a set of exploits, why wouldn't you just launch all of them? It'll take you probably 5-10 seconds for all (99% of exploits take one request to execute), why rely on version and limit your potential list? Are there any data that point attackers really rely on versions in the field? I regularly have ancient exploits tried on my servers, but this of course is anecdotal.
May
8
comment Hiding version - valuable or just security by obscurity?
As I said, one of the reasons to expose it may be so you could have automated tools to inventory your systems and alert you about old versions being left behind. So there are reasons :) What I'm asking is why everybody places this on the vulnerabilities lists together with real issues (like XSS, XSRF, etc.) as if it by itself could have any influence on your security.
May
8
comment Hiding version - valuable or just security by obscurity?
You can easily recognize app powered by Wordpress without needing any "powered by" - Wordpress has very specific structure of URLs, probably indexed by Google: wp-content, wp-includes, wp-login, etc.
Mar
20
comment Why is it difficult to catch “Anonymous” or “Lulzsec” (groups)?
I think that greatly depends on the sentences that the ones that were recently caught get. It's one thing to wreak havoc knowing that nobody will ever get to you, another knowing the end of the road is 15 years in federal prison...
Mar
14
comment Why would someone trust DuckDuckGo or other providers with a similar privacy policy?
@HughAllen consider also that there were cases of US government taking over .com domains of entities outside US which violated US laws. So having .com site and committing a felony in the US is usually not a very smart move for an entity whose business is entirely web-based.
Jan
17
comment Can one get infected through visiting a site with a PHP script on it and if yes, how?
@TomLeek sorry, I don't see how that makes sense - you can run bare SQL in any language that supports direct DB query (which is all of them that support connecting to DB). Security practices are well-known and are the same for PHP as for any other language. There's no such thing as "PHP record" because each software is written in a different way by different people. It's like saying electricity is bad because all computers that were hacked used electricity. It's just FUD stemming from repeating third-party misinformation without bothering to check the actual facts.
Jan
17
comment Can one get infected through visiting a site with a PHP script on it and if yes, how?
The fact that the server code may be written in PHP has absolutely nothing to do with it being cautiously or incautiously written, which of course does not prevent one from baselessly bashing PHP.