Questions tagged [source-code]
Security relative to source-code edition, protection and management.
238
questions
127
votes
7
answers
70k
views
Is using Git for deploying a bad practice?
I tend to use Git for deploying production code to the web server. That usually means that somewhere a master Git repository is hosted somewhere accessible over ssh, and the production server serves ...
- 1,373
125
votes
8
answers
28k
views
Why is storing passwords in version control a bad idea?
My friend just asked me: "why is it actually that bad to put various passwords directly in program's source code, when we only store it in our private Git server?"
I gave him an answer that ...
- 6,584
93
votes
7
answers
5k
views
How do I know a piece of software only does what the author claims?
Without being a programmer or a computer expert, how can I know if a particular program or any piece of software in general doesn't have hidden unwanted functions compromising privacy and security?
- 999
86
votes
6
answers
20k
views
How am I ever going to be able to "vet" 120,000+ lines of Composer PHP code not written by me? [duplicate]
I depend on PHP CLI for all kinds of personal and (hopefully, soon) professional/mission-critical "business logic". (This could be any other language and the exact same problem would still stand; I'm ...
- 711
86
votes
6
answers
84k
views
How do large companies protect their source code?
I recently read the canonical answer of our ursine overlord to the question on How do certification authorities store their private root keys?
I then just had to ask myself:
How do large companies (e....
- 9,800
76
votes
19
answers
6k
views
What security resources should a white-hat *developer* follow these days? [closed]
What sites, twitter accounts, FOSS software should a white-hat code 'hacker' follow these days?
Do Include:
Late breaking information on new security issues (RSS, Twitter, etc)
A website that tracks ...
69
votes
7
answers
10k
views
Does one need to be a good programmer to perform secure source code analysis?
A person has good knowledge of overall security risks, knows what OWASP Top 10 vulnerabilities are, and has certifications like CEH, CISSP, OSCP, etc. which are more black-box testing. And also he has ...
- 1,507
55
votes
5
answers
5k
views
Should security-critical code be reused or rewritten?
Usually, in programming, reusing code is always a better idea than writing your own implementation of an algorithm. If an implementation has been around for a long time and is still used by lots of ...
- 795
50
votes
3
answers
14k
views
Malicious code somehow hidden with whitespace?
I recently came across a php file on a compromised website that had what appeared (in Sublime Text) to be a huge white-space gap. When I run a diff against the original source file I can clearly see ...
- 625
46
votes
15
answers
12k
views
Should we protect web application source code from being stolen by web hosts through obfuscation?
Is it worth to obfuscate a java web app source code so that the web host cannot make wrong use of the code or even steal your business? If so, how should this be dealt with? How should we obfuscate?
...
- 741
46
votes
8
answers
9k
views
Should I bother teaching buffer overflows any more?
The students are skeptical that turning off non-executable stacks, turning off canaries and turning off ASLR represents a realistic environment. If PaX, DEP, W^X, etc., are effective at stopping ...
- 1,575
45
votes
3
answers
7k
views
How safe are signed git tags? Only as safe as SHA-1 or somehow safer?
How safe are signed git tags? Especially because git uses SHA-1. There is contradictory information around.
So if one verifies a git tag (git tag -v tagname), then checksouts the tag, and checks that ...
- 784
39
votes
5
answers
8k
views
How should source code security be checked?
How to check whether the source code of an open-source project contains no malicious content? For example, in a set of source code files with altogether 30,000 lines, there might be 1-2 lines ...
- 2,257
34
votes
4
answers
12k
views
Which security measures does PyPI and similar third-party software repositories take?
PyPI is a third-party software repository for Python packages. Everybody can upload packages to it (see The Python Package Index (PyPI)).
How does PyPI prevent people from uploading malware?
When I ...
- 3,942
32
votes
4
answers
16k
views
Is $_SERVER[ ] a safe source of data in PHP?
Can I 100% rely on $_SERVER[] to be a safe source of data that I do not need to sanitized like I do $_GET[] and $_POST[]?
- 429
31
votes
0
answers
2k
views
Can you prove that an open source program is running the same code that it claims to be? [duplicate]
So if a group has made open source software, and the source code is available on github, and is bundled with an executable in their main download, can it be proven that the executable is compiled from ...
- 411
29
votes
5
answers
13k
views
When can I commit a Private Key to source control?
That is to say, in what cases does it make sense to commit an unencrypted keypair to internal source control like SVN or Git?
Related question that discusses an encrypted private key: Is it bad ...
- 668
27
votes
2
answers
4k
views
Identifying the author(s) of a piece of malware
When a new piece of malware appears, people can try to determine where it comes from, and who its authors could be.
How do security experts attempt to identify the authors of a new publicly disclosed ...
- 445
26
votes
4
answers
9k
views
Example of a backdoor submitted to an open source project?
To clarify immediately, I'm not interested in writing a backdoor. I have no interest in submitting backdoor changelists to projects myself.
I'm researching some source modeling techniques, and we're ...
- 361
25
votes
2
answers
7k
views
Access to the codebase in big companies [duplicate]
I am wondering how big companies manage access to their codebase from their developers. In order to make their code safe do they allow their developers to have access to entire codebase or to only ...
- 665
25
votes
7
answers
7k
views
Source code as password
Passwords with a mixture of letters, numbers, and special characters are sometimes hard to remember. Is it secure to instead use a small amount of memorable source code as a 'passphrase'?
As an ...
- 755
25
votes
6
answers
28k
views
What reputable site should I download Putty from?
I recently did a Bing search for Putty and can only guess at which distribution is "trusted", contains no malware, or sleuthing code.
If you needed to download Putty for a high security Windows ...
- 51k
23
votes
2
answers
4k
views
Rails - protection against code injection and XSS
I've started using Ruby on Rails, and I was wondering if there were any security gotchas to watch out for with Rails, particularly regarding code injection and XSS?
I know Rails tries to prevent ...
- 1,204
22
votes
6
answers
26k
views
How can I enumerate all the saved RSA keys in the Microsoft CSP?
I have an application that is creating several keys and storing them in various stores (in this case the Machine store).
How can I enumerate all the keys on a given Windows system?
...
- 51k
22
votes
2
answers
6k
views
Is there a way to verify a binary against the sources?
It seems like there is no practical way to verify the full integrity path of precompiled and packaged software? I can check the downloaded package itself by hashes, but I have no verification if the ...
- 391
22
votes
4
answers
7k
views
Malwares source repositories. Where? [closed]
As the best way to learn is to read the code, do you know where I can find malware/virus/whatever source code to read?
- 2,020
18
votes
4
answers
1k
views
Does compiling from sources "kinda" protects from buffer overflow attacks?
While discussing buffers overflows, somebody told me that compiling your own binary for an application (with specific compilation flags) instead of using the "mainstream binary" makes it more ...
- 283
17
votes
5
answers
16k
views
Obfuscating JavaScript code
Some Flash developers are afraid of JavaScript. Their point of view:
Stealing JS source code is effortless, one would just 'view source' and copy it. Yes, you can decompile Flash bytecode, however it ...
- 273
17
votes
2
answers
25k
views
Are private git repositories safe?
I've heard from several people that private repository servers like BitBucket are not really safe. I've heard rumours about code being stolen and used by people even out of private repositories.
Is ...
- 273
17
votes
7
answers
18k
views
Disable insecure/dangerous PHP functions
Typically my job description limits me to code-review of web applications. More recently I've been asked to assist with some server-side PHP optimization where, although I am familiar with it, I lack ...
- 2,006
17
votes
5
answers
39k
views
How can one secure a password/key in source code [duplicate]
If there is a need for source code to have a password in it, how
should this be secured? This is purely an example, but say there is an
app that is using an API, and you don't want to expose your ...
- 273
16
votes
4
answers
13k
views
What's the standard way to encrypt a file with a public key in Java?
I'm writing a client app in Java that sends encrypted data back to the server. All clients have my RSA public key. Is there a standard way to encrypt a given file with it to send it back to the server?...
16
votes
3
answers
3k
views
ASP.NET MVC Security Check List
I am planning to start a new web site on ASP.NET MVC 2 (3).
Does anybody have a full (if possible) check list of actions or approaches I should go through to avoid most security issues?
- 1,292
15
votes
8
answers
19k
views
Secure memcpy for pure C
Buffer overflows are nothing new. And yet they still appear often, especially in native (i.e. not managed) code...
Part of the root cause, is usage of "unsafe" functions, including C++ staples ...
AviD♦
- 73.5k
14
votes
9
answers
63k
views
Programming language for network security
I am working as a tester now. I am planning to move to the domain of security such as a CEH or CISSP. But many say that to be a great hacker you need to know at least one programming language well. I ...
- 386
14
votes
6
answers
5k
views
Code Analysis: Binary vs Source
While conducting a software security assessment, if you have access to the source code of a compiled application (say C++), would you ever do any analysis upon the compiled version, either with any ...
- 1,627
14
votes
4
answers
4k
views
How dangerous is it to store password in plain text on sites like GitHub?
I have a few private repositories set up on GitHub for some of the projects I am working on for my company. These applications connect to databases and I have database authentication credentials ...
- 243
14
votes
3
answers
2k
views
What are the security implications of 'open-source' vs. 'source-available'?
In light of the current fiasco surrounding TrueCrypt, I have received considerable criticism from current clients and peers in the IT industry for my continued support of the open-source model. Such ...
- 1,324
13
votes
4
answers
2k
views
Source code security
We have about 20 developers working in a heterogeneous environment, mostly using company laptops or desktops. We run Windows 7 on desktops/laptops and a mixture of Linux distros (Ubuntu/CentOS).
...
- 253
13
votes
4
answers
1k
views
What does defense in depth entail for a web app?
I'm assuming it means different layers of security from app-level security to server hardening to personnel training, but what are each of those layers and what are some good resources for each level ...
- 3,252
12
votes
4
answers
19k
views
What programming language is Stuxnet written in?
I was listening to a story about Stuxnet and was curious if anyone knew what language it was written in?
Is the source code for Stuxnet available anywhere?
- 8,185
11
votes
5
answers
2k
views
Does naming sensitive things discreetly provide protection?
I had a job where a manager said he liked naming servers after places because if they were named descriptively e.g. "passwords database server" they become obvious targets. I sort of generalized this ...
- 10.2k
11
votes
2
answers
594
views
security implications of NULL dereference
Suppose we have code like this:
struct somedata {
int a;
int b;
};
struct somedata *data;
/* ... */
data = malloc(sizeof(struct somedata));
data->a = something;
Now, as you can see, NULL ...
- 1,921
11
votes
2
answers
765
views
What is considered the simplest (or lightest) secure development lifecycle?
Microsoft has there simplified SDL:
"The Security Development Lifecycle (SDL) is a security assurance process that is focused on software development."
"The process outlined in this paper sets ...
- 13.8k
11
votes
2
answers
2k
views
Security issues with PHP Sandbox
I am working on a PHP sandbox for a Web Application Honeypot. The PHP sandbox will analyze a PHP file that may have been injected as part of an RFI attack. It should run the file in a safe environment ...
- 223
10
votes
5
answers
29k
views
Hiding JavaScript source code
In a web-app should one strive to hide as much of the code as possible, for example from view source? In particular I was wondering should JavaScript be hidden, especially ones used for Ajax? I was ...
- 10.2k
10
votes
4
answers
7k
views
How to protect ftp account information in the source code of a program
I wrote a game which stores high score information on an ftp server.
In the the source code I need to write out the ftp link with the account name and password in it.
For example:
url = new URL("ftp:...
- 283
10
votes
2
answers
8k
views
Average number of exploitable bugs per thousand lines of code?
Over the years I've heard various estimates for the average number of exploitable bugs per thousand lines of code, a common figure being one exploitable bug per thousand lines of code. A Google search ...
- 5,562
9
votes
4
answers
5k
views
What Checkstyle or Findbugs rules detect common vulnerabilities?
Looking for experience with both built in and custom checks.
I do not need references to commercial source code analysers.
- 863
9
votes
7
answers
1k
views
Proving running code on a website is unchanged
Can it be proved to the user that the running code behind a website with security related code is the same as published?
I'm currently looking at a few new project ideas and one involves secure ...
- 212