144
votes
Why is storing passwords in version control a bad idea?
The way I see it, not storing passwords in Git (or other version control) is a convention. I suppose one could decide not to enforce it with various results, but here's why this is generally frowned ...
- 6,584
140
votes
How am I ever going to be able to "vet" 120,000+ lines of Composer PHP code not written by me?
You can't vet individual lines of code. You'll just die trying to do that.
At some point, you have to trust someone else. In 1984, Ken Thompson, one of the co-inventors of much of Unix, wrote a short ...
- 31.6k
95
votes
Why is storing passwords in version control a bad idea?
First, the non-security reason:
Password Change Workflow
Passwords change independently of a software application code. If a DBA changes a database password, does it make sense for developers to ...
- 961
86
votes
Access to the codebase in big companies
In any sanely managed company, a developer usually gets full access to the sourcecode of any project they work on.
The reason is that the benefits of releasing parts of the code on a strict need-to-...
- 49.5k
62
votes
Accepted
Malicious code somehow hidden with whitespace?
The code is exploiting a flaw in Sublime to prevent text from being displayed.
This is what part of the code looks like in Notepad++. It is obviously looking for post['username'] and post['password'].
...
- 1,099
46
votes
How am I ever going to be able to "vet" 120,000+ lines of Composer PHP code not written by me?
My "Composer" directory tree currently is at over 120,000 lines of code. And that's for the minimal number of crucial PHP libraries that I need.
Your mistake is in trying to vet third-party code as ...
- 541
26
votes
How am I ever going to be able to "vet" 120,000+ lines of Composer PHP code not written by me?
Welcome to the new paradigm of coding: you're using libraries on top of libraries. You're hardly alone, but you also need to understand that anytime you bring in code you didn't write, you bring in ...
- 3,798
25
votes
Why is storing passwords in version control a bad idea?
It's always important to keep in mind that suggestions do have to be tailored to fit your use-case. Security safeguards taken by, say, the NSA to protect all the zero-days they keep around for a ...
- 31.5k
22
votes
Is using Git for deploying a bad practice?
I'm going to disagree with popular opinion here. Git is for version control, it is not for deployment/CI.
The methods people are advocating here are fine for small projects, but generally speaking, ...
- 329
21
votes
Accepted
How should source code security be checked?
There are automated and manual approaches.
For automated, you could start with lgtm - a free static code analyser for open source projects and then move to more complex SAST solutions.
For manual - ...
- 692
19
votes
How should source code security be checked?
You either do it yourself or trust someone else
As with most things in life, you must either do it yourself or trust someone else with it. Here trusting covers both having no malicious intent and ...
- 19k
13
votes
Which security measures does PyPI and similar third-party software repositories take?
There are two threat models here:
Malicious developer uploading malicious packages
Malicious attacker uploading malicious packages that belongs to legitimate developers
PyPI does not make any ...
- 31.6k
13
votes
Why is storing passwords in version control a bad idea?
Keeping secrets (passwords, certificates, keys) separate from source code makes it possible to manage source and secrets according to different policies. Like, all engineers can read the source code, ...
- 131
13
votes
Malicious code somehow hidden with whitespace?
This is a very old story:
https://trojansource.codes/
https://en.wikipedia.org/wiki/Trojan_Source
https://lwn.net/Articles/874951/
https://www.bleepingcomputer.com/news/security/invisible-characters-...
- 3,445
12
votes
Why is storing passwords in version control a bad idea?
This convention, like many other security "best practices" is a handy way of making sure that things don't go wrong because of bad habits or routine.
If you always remember that your sensitive ...
- 10.7k
11
votes
Accepted
Pen Tester's Programming Style
There's a big distinction between pen testers who write a bit of code, and developers of security tools.
During a pen test, you may need to write some custom code. For example, if you find server-...
- 34.6k
9
votes
How can I enumerate all the saved RSA keys in the Microsoft CSP?
Same answer as @ian but as a Powershell script. In this example reading the machine keys.
$containerPath = "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys"
Get-ChildItem $containerPath | ForEach-...
- 191
8
votes
Accepted
How is compiling a program from source more secure?
It's harder to hide a backdoor in source code than in a binary. Someone could easily add a bunch of code before compiling a binary, but leave the extra code unpublished. If you build it yourself, then ...
- 4,052
8
votes
Accepted
Ken Thompson's compiler hack
No, because the source you can see doesn't necessarily match up with the binary you're using. The specific attack described in that paper involves multiple compiler source versions: there is a ...
- 27.4k
7
votes
Are there any free static analysis tools for C# / .NET code
Roslyn Security Guard is now available and is free. https://dotnet-security-guard.github.io/
Update: This project is no longer maintained and has been forked here and improved here: https://github....
- 495
6
votes
Accepted
How to Check Open Source Code for Vulnerabilities?
It largely depends on what it is you are trying to find bugs for. And I can tell you now that there will never be a one size fits all approach to this. Finding bugs in something like OpenSSL will be ...
- 170
6
votes
Why is storing passwords in version control a bad idea?
Other answers are great, but consider also the problem of backups. You have much more flexibility on where, how, and for how long you store your code repository backups if they don't contain sensitive ...
- 4,052
6
votes
Ken Thompson's compiler hack
can't we just go through the compiler's source code and check for any backdoor, what was the article's point?
The whole point of the article is that can't do that because the backdoor is not in the ...
- 1,270
5
votes
What reputable site should I download Putty from?
As of May 2017 (!), the official PuTTY website is available over HTTPS.
https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html
Combined with the HTTPS download links added a little while ...
- 151
4
votes
How can I enumerate all the saved RSA keys in the Microsoft CSP?
PowerShell solution based entirely on Derek W's answer.
$TypeDefinition=@'
using System;
using System.Text;
using System.Collections.Generic;
namespace KeyContainerFinder {
using System....
4
votes
Are private git repositories safe?
Technically, the vendors "Github, GitLab, Bitbucket etc." have access to all your source in "Your Repo" because it's "Their server" and "Their SaaS".
Their Server:
The vendor most likely has ...
- 149
4
votes
Is there a way to verify a binary against the sources?
The concept of reproducible builds seems to offer a solution for this problem. At least a theoretical one.
It means that every run of a build (or compilation) process should return the identical ...
- 391
4
votes
Accepted
Job applicants submit code, how do companies securely test it?
To a large degree, this is a problem that solves itself. To understand why, we first must understand the goals of a test like this. More specifically, running the code is not high on the list of ...
- 35.9k
4
votes
WannaCry Source Code
Is the WannaCry source code public?
No. It is not.
That is why malware researchers have been laboring to reverse engineer the ransomware functionality using tools such as debuggers and disassemblers....
- 1,366
Only top scored, non community-wiki answers of a minimum length are eligible