Ask Slashdot: Share Your Security Review Tales 198
New submitter TreZ writes: If you write software, you are most likely subject to a "security review" at some point. A large portion of this is common sense like don't put plain text credentials into github, don't write your own encryption algorithms, etc. Once you get past that there is a "subjective" nature to these reviews.
What is the worst "you can't do" or "you must do" that you've been subjected to in a security review? A fictitious example would be: you must authenticate all clients with a client certificate, plus basic auth, plus MFA token. Tell your story here, omitting incriminating details.
What is the worst "you can't do" or "you must do" that you've been subjected to in a security review? A fictitious example would be: you must authenticate all clients with a client certificate, plus basic auth, plus MFA token. Tell your story here, omitting incriminating details.
Fooled ya! (Score:5, Funny)
If you write software, you are most likely subject to a "security review" at some point
Wrong! My code has never been subjected to any such stupid security review.
Disclaimer: Opinions expressed here are mine, not my employer Equifax.
Disclaimer to disclaimer: Nah! I'm not really working for Equifax
Re:Fooled ya! (Score:4, Funny)
We all know you're not working at Equifax. But do they pay well?
Re: (Score:1)
We all know you're not working at Equifax. But do they pay well?
Much better than my previous band.
Re: (Score:2)
We all know you're not working at Equifax. But do they pay well?
No, but my credit report looks fantastic! Now...
Re: (Score:2)
Not as well as the guy I sold the data... I mean, my new employer.
Re: (Score:3)
Nice one! What musical instrument do you play?
Re: (Score:3)
Nice one! What musical instrument do you play?
Working at Equifax he must play a very, very small violin.
Re: (Score:2)
Considering how long it took and how much is still surfacing, my money is on "not the whistle".
Re: (Score:2)
Disclaimer to disclaimer to disclaimer: Not anymore.
Anything the client won't pay for (Score:2)
Anything the client didn't pay for. (Threats to suspend a very large support payment count as payment, however.) Likewise, whenever a customer wanted to pay extra for an MFA, SSO or other integration, we were all ears.
Or were you looking for whining?
Buffer Overruns (Score:2)
Working for a semi-well known mesh networking company in Seattle, I was hired for DevOps because, despite 20+ years experience with C/C++, the gasseous CTO didn't believe I was qualified to do development. About a month into the job, I got called into a code review for one of the senior developers, and I quickly caught several buffer overruns on the "rookie mistake" level with strncpy overflowing the allocated space.
Gotta wonder how many of those Mr. Senior Developer committed to the code base.
Management is always totally clueless (Score:1)
Never trust management. They oversimplify and are totally defenseless against hype.
My five cents.
Re:Buffer Overruns (Score:4, Insightful)
You were hired for a lower paying position because they felt you weren't qualified enough for the position you applied and then had you doing it anyway for less pay because your title was still something else.
This is standard practice.
Re: (Score:2)
Re: (Score:2)
I'm impressed by that developer's skill, but not in a good way. That's exactly the kind of brain fart error strncpy is designed to prevent. I presume, then, that this developer never bothered to make sure that the destination string was large enough for the job, and I hope that his next performance review reflected his carelessness.
Re: (Score:2)
...with strncpy overflowing the allocated space.
I'm impressed by that developer's skill, but not in a good way. That's exactly the kind of brain fart error strncpy is designed to prevent. I presume, then, that this developer never bothered to make sure that the destination string was large enough for the job, and I hope that his next performance review reflected his carelessness.
strncpy is defective by design. The carelessness comes from allowing code with it to ever be checked in.
When I want to find bugs strncpy is one of the first things I look at exploiting. Very few understand null terminator is omitted on overflow.
Re: (Score:2)
That's why you _always_ stuff a null-byte at the end of the buffer!
Re: (Score:2)
Unlike other strn- functions, strncpy is not just a bounds-checked strcpy. It write precisely the defined number of characters from the source to the destination, ignoring '\0' terminators. If there is no null terminator in the source within the specified number of characters, none goes into the destination, leading to buffer overflow vunerabilities.
FBI subpoena (Score:5, Funny)
Re:FBI subpoena (Score:4, Funny)
I was a high-ranking official in the state department. The FBI sent me a subpoena for my private email server because I used it to discuss classified government business, so I had my IT guy wipe my private email server before I handed it over to the FBI. Later he was discovered on Reddit and confessed to the FBI, but I made sure they couldn't trace the decision back to me.
I bet you would have gotten away with it too, if it wasn't for those meddling kids.
Re: (Score:3)
I was a high-ranking official in the state department. The FBI sent me a subpoena for my private email server because I used it to discuss classified government business, so I had my IT guy wipe my private email server before I handed it over to the FBI. Later he was discovered on Reddit and confessed to the FBI, but I made sure they couldn't trace the decision back to me.
Wipe? Like, with a cloth?
Re: (Score:2)
You MUST have anti-virus with current signatures! (Score:5, Interesting)
This happened to a customer of us: They were told by an auditor that they absolute must have anti-virus on all machines, as per policy. Hence they built a tunnel into a completely isolated environment with absolutely no malware-vectors in order to be able to get updated AV signatures to the AV they installed on these machines. The really bad thing was that they did not seem to understand when we explained to them that they now did not have an isolated environment anymore and that the AV vendor as well as anybody successfully attacking the AV vendor could now attack them and export data at their leisure. What they should have done is to get an exception.
Re: (Score:3)
I'm not sure there is such a thing as a completely isolated environment anymore. There are too many air-gap bridging attacks. (See also Stuxnet).
Now, those attacks require far more work than the anti-virus vector. And it's not likely to be used. But it should be expected that something valuable enough (to a nation state) will be breached.
Re: (Score:1)
I'm not sure there is such a thing as a completely isolated environment anymore. There are too many air-gap bridging attacks. (See also Stuxnet).
In practical terms, an isolated environment is one where the only way anything gets into the system is by a human being manually entering it, and the only way anything gets out by what a human being carries away with him either in his head or in his pocket/breifcase/other.
I would count a system that has a keyboard or mouse for input, a video screen, printer, and maybe a "write only" media-writing tool (see below) that is in a room where electronic- or even look-at-the-screen-through-the-window eavesdropping
Re: (Score:2)
This one was. Sorry cannot get into details.
Re: (Score:2)
No one buys anti-virus because it works, they buy it because of marketing.
Re: (Score:3)
You jest, but that's what we did.
Very similar setup, a completely isolated network with no way to bring data in an automated way into it. Data was entered manually only and extracted on CD-Roms. Similar problem, getting any kind of data line in would have required unacceptable security breaches. And similar requirements, i.e. all machines need antivirus software.
So we wrote one. What that software basically did was to routinely check all hashes of all files on the machine (with the exception of the data fil
Re: (Score:2)
Re: (Score:2)
It literally is better than nothing, outside of a truly closed system.
Tell that to my first Windows computer that picked up the relatively benign Lemming virus: http://wiw.org/~meta/vsum/view... [wiw.org]
It had been known for at least 2 years when the virus checker completely missed it, then opened (and hence infected) every COM and EXE file on the computer.
Despite having no payload, the thing was so fragmented afterwards I had to format and reinstall (which is the thing to do anyway, but it made backing up any data bloody difficult)
Virus scanners are like condoms; you suggest everyone
Re: (Score:2)
I buy an antivirus because it half-works. And that half-works is enough to alert me to bigger problems, and usually minimize or stop the spread of any infection on the network.
And you right there are spouting marketing FUD.
Antivirus makes your computer less secure. Do a search for "antivirus vuln."
Re: (Score:2)
Everything is a vulnerability.
Now you're just making up shit because you know you're wrong. A better argument would have been if you built a metric to figure out how much more safe you are with antivirus than without. But you didn't do that, because the answer is less safe.
Re: (Score:2)
Because you are nice, I will teach you a logic lesson here. You have made several arguments by analogy here, but they are wrong: an argument by analogy needs two parts. The first is the analogy, and the second is an explanation that the analogy matches this situation.
I can show you why by giving you my own analogy: an antivirus is like poison: it brings vulnerabilities to your system that weren't there before, some of them very severe
Re: (Score:2)
Actually, they had to put the tunnel in first for that, and, just as a hint, that required drilling an armored and shielded wall. The exception would have been exactly the right thing to do.
Re: (Score:3)
If you allow changing of the hardware, then the term "isolated system" loses all meaning. Feel free to do so, but know that your statements become nonsense if you do this.
No Physical Access (Score:1)
At my office, no one has physical access to their machines. They are all locked in shielded cabinets. We get a keyboard, mouse, and monitor. No access to USB, Network, or any other ports.
No network connection by any means to the Internet, and no cell phones are allowed in the building, period.
Place is pretty tight.
Re: (Score:2)
That's actually really cool.
Re: (Score:2)
you mean, no way for users to break the machine???
Must be a sysadmin's wet dream!
Re: (Score:1)
We get a keyboard, mouse, and monitor.
BWUHAHAHAHA says the disgruntled soon-to-be-ex-employee who happens to have a photographic memory.
Re: (Score:2)
Are you using Zero Clients? (i.e. Teradici PCoIP protocol, probably via VMware Horizon)? Because that stuff actually is pretty cool.
Re: (Score:2)
At my office, no one has physical access to their machines. They are all locked in shielded cabinets. We get a keyboard, mouse, and monitor. No access to USB, Network, or any other ports.
No network connection by any means to the Internet, and no cell phones are allowed in the building, period.
Place is pretty tight.
Don’t worry, next year, you’ll finally make it out of kindergarten.
Re: (Score:2)
Yeah, but do the cables run through pressurized conduit with pressure monitors on each one that signals a security alert if the pressure drops? If not, then you may as well be housing your servers on a rock in Central Park. </sarcasm>
Make sure 4096 bits is 4096 bits (Score:1)
I worked for a startup as a contractor, and they were readying a security product to hit the market. It used public and private keys. Instead of generating and using a 4096 bit key (for securing files), it used sixty-four, 64-bit RSA keys. The reason for this is that the CEO wanted the ability to decode stuff in case a customer locked themselves out.
Re: (Score:2)
How did that CEO die, and was it horribly?
Re: (Score:2)
He didn't die. He got a bonus and a photo shoot after he cashed out and left the company to die. He then went on to marry a super model and spends his time promoting his ghost written book about how to get rich and never take responsiblity for anything you do wrong.
Re: (Score:1)
Re: (Score:3)
Worst and Best (Score:2)
I use to work for a company, about a year ago, where no one had even the most basic concept of data security. During my time there I implemented MFA on all Servers, programmed in Data Encryption, Data Validation, Client Verification, DB Security and other such improvements. Well, I was showing the three other existing employees how the software worked and how the new infrastructure worked, they didn't like that it was now "hard" to log into the servers and that they would now have to use password a
Re:Worst and Best (Score:4, Interesting)
I use to work for a company, about a year ago, where no one had even the most basic concept of data security. During my time there I implemented MFA on all Servers, programmed in Data Encryption, Data Validation, Client Verification, DB Security and other such improvements. Well, I was showing the three other existing employees how the software worked and how the new infrastructure worked, they didn't like that it was now "hard" to log into the servers and that they would now have to use password and keys to access Data. They told me to revert to how it was before, as they knew better then I did, so I quit. They reverted all my changes and claim it's now more secure and better!
The software product they're developing, without a developer (they still don't have one), is an iSCSI based Desktop Protection System, but it's so riddled with holes and such a massive lack of security that they're committing fraud by selling what they have as a security solution.
Best:
The best security I've ever seen and been involved with developing had multilayer client authentication, certificate binding, transaction queue verification. It had a routine that went through the software and tweaked it's ports and accesses. Every piece of data was run through an AES-192-GCM based function that signed all the transactions and messages. The infrastructure this software was running on was just as impressive, ever server had at least 3FA+ turned on for logging in, active port based monitoring, which used MongoDB Clusters to validate logins, clients and pretty much everything you could imagine.
Re: (Score:2)
Pfft. We all know the best scenario you described was just you dropping ecstasy one night a couple weeks before you quit. Maybe peyote.
Re: (Score:2)
Funny incident, not really security review (Score:4, Interesting)
Some nosyparker busybody customer did a "strings" on our product and found the string and ratted out to our CTO. Nothing serious happened, just a slap on the wrist. But another colleague told me the same customer found the full "man from nantucket" in his test strings for the stringutil library he wrote. And another said that customer also found the "Fuck! Got null pointer again!" in his code.
We think he was looking for some kind of debug switches and env settings that will disable license check.
Re: (Score:2)
A long time ago, I needed to develop something on an FPGA from Xilinx. Told them we needed the sofware to work by then-and-then (weeks in advance) and weeks past said date we still didn't have anything. So after some angry phone calls they agreed to send us a licence for the software on a Unix server for the time until our PC dongle would arrive. They planned a day overlap between our dongle arriving and the end of the unix-workstation-licence. With a week additional delay in the dongle I suddenly had not
Nasty incident at an automation software hut (Score:5, Interesting)
Re: (Score:2)
Now get this, on the SOX audit? They passed! They got dinged for the hack but they still passed even before I was done cleaning up. That's when I realized that CISSP/SOX/GLBA/PCI security and *actual* IT security aren't always aligned.
an audit is nothing more then just checking off a few boxes. are you doing this, are you doing that. yes? then everything is fine. how you actually do it doesn't matter.
Credit Card Information (Score:2)
Years ago, I was making a website for a company that shall remain nameless. They wanted an online ordering system built. No problem. I can do that. Then, they told me they wanted the order information to not be saved into a database, but e-mailed to them. I pushed back as much as I could, but finally had to build it for them. (It's complicated as to why I couldn't just say "I refuse" and walk away. Trust me, had it been up to me, I would have.)
A few years later, they came to me saying they had a complaint f
Re: (Score:2)
So ... you got paid twice?
False Positives (Score:3)
False Positives during automated audit tools is my own personal hell. PCI Compliance demands these audits be ran every quarter. And every quarter, our Windows 2012r2 server which is only used for a couple of people to work remotely fails the audit. Which test does it fail? The audit claims it is vulnerable to a Windows NT4 terminal services exploit. The exploits have long been patched by Microsoft, plus the effected cyphers have also long been disabled. Yet every single goddamn quarter, we fail the audit, and it is usually a month long battle with one-way messaging to the audit company to let them know their still a bunch of morons. And guess what? The quarter just started this week!
Re: (Score:2)
False Positives during automated audit tools is my own personal hell. PCI Compliance demands these audits be ran every quarter. And every quarter, our Windows 2012r2 server which is only used for a couple of people to work remotely fails the audit. Which test does it fail? The audit claims it is vulnerable to a Windows NT4 terminal services exploit. The exploits have long been patched by Microsoft, plus the effected cyphers have also long been disabled. Yet every single goddamn quarter, we fail the audit, and it is usually a month long battle with one-way messaging to the audit company to let them know their still a bunch of morons. And guess what? The quarter just started this week!
I look at people who post things like this and I'm thinking to myself is there only one company on the planet selling automated audit services?
Which is worse? A company raking in $$$ for being extraordinarily lazy and getting away with failing to address even known obvious shortcomings... or paying "a bunch of morons"?
Re: (Score:2)
A tool is only as good as the people using it and an automated tool is only as good as its configuration is valid. The GPs problem is one of faulty configuration, and he's not the one who could (or should) change it.
Re: (Score:2)
Invite your CISO to a meeting. Tell him about this problem, explain to him that the exploitable ciphers are not used by your company (bring proof!) and that the automated test needs to be remodeled to fit your case.
It's likely that your CISO doesn't even know about it, and he's the only one that can sensibly end this madness.
Re: (Score:2)
Auditing is done by an outside company that is associated with the payment processor. Every single quarter I remind them that their testing suite is broken, and exact details as to why and how. They've yet to do anything about it. Not much else can be done at this point. If I had the choice to switch payment providers to one with sensible testing, I would, but that's not my call sadly.
Re: (Score:2)
You cannot but the CISO can or at the very least he can put it on the table the next time the C-Levels meet and discuss why the audit failed. This will also probably not result in you switching payment providers, but at the very least it will move the problem out of your hands.
What is it you'd say you do here? (Score:2)
My app is essentially a scripting service internally to make it easier to connect various functions together. We don't generate data, we only take data from inputs or pull from encrypted databases (if it's sensitive data) and we only store working data for as long as the script runs. We're a web service so we use SSL for all communications and any temp storage is stored in an encrypted state t
The Binder of Doom (Score:5, Interesting)
In 1999 I was hired by a Midwestern telco -- in the interests of not getting sued I won't say which: I'll just say their market cap used to be in the billions and now you could buy them with the lint in your pocket -- to do security remediation on their billing system. I spent weeks poring over architectural diagrams, going through source code, examining protocols. After a while I realized I had some really scary information, so I asked my manager for a safe.
"Just put it all in a binder," she said. "We trust you to keep an eye on it."
The Binder of Doom was a nondescript black binder about three inches thick. It had no cover page and no markings: I didn't want anyone to realize the secrets that were in it. I carried it around with me everywhere. I slept with it in bed with me. That's how terrified I was these secrets would come out.
Then the Binder of Doom got worse. Having completed my survey, I now devised attacks on the system. I found ways enterprising individuals could fleece the company out of truly mind-boggling sums, and how difficult it would be to detect these attacks with the then-current security infrastructure. By the end of six months the Binder of Doom was stuffed to bursting and I was giving serious thought to filing for a concealed-carry permit. I wondered if the sheriff's department would understand if I told them I was routinely carrying around a binder with a *conservative* worth to a criminal syndicate of $100 million.
I went back to my manager. I told her I was done. It was time to remediate the risks. "Oh, excellent," she told me, "because we just ran out of money for the remediation."
Uh. What?
"Management has decided the main risk is in unsecured communications links, so just ensure we're using PGP on everything and we'll call it good."
I asked if she wanted the Binder of Doom.
"No, you hold onto it for a while."
So I became increasingly disgruntled, bitter, and sarcastic. I told everyone I worked with that I'd been retasked to "secure" our network using PGP -- and even old-school PGP 2.6, not GnuPG (which had just reached 1.0), either -- and oh God this is awful and if this company lasts another year it'll be a miracle and...
I was shortly thereafter cashiered for having a toxic attitude towards work. I walked into the parking lot, got into my car, and tossed the Binder of Doom into the passenger seat. As I drove away I realized something was horribly wrong, but didn't realize what until I was pulling out of the lot:
I HAD THE BINDER OF DOOM IN MY PASSENGER SEAT.
I returned to the office and tried to walk inside, but was met by an HR rep at the door who told me if I didn't leave they'd call the police and file a trespass charge. I held up the Binder of Doom to the HR rep. "Do you want this back?" I asked.
"No," she told me clearly. "Keep it. We just want you to leave."
I turned around, gobsmacked, and left the company holding detailed plans for how to embezzle $100 million or more... which the company had just thoughtfully delivered into the hands of a disgruntled former employee.
(And if you're wondering what I did with the Binder of Doom, it sat on my bookshelf for a few days tempting me before I threw it into an incinerator and threw the ashes into a strong wind.)
Re: (Score:2)
If anyone stole any significant amount of money from that telco, you would be the prime suspect. Assuming they can know when significant sums of money was stolen...
Re: (Score:2)
It's good that there are still people that are willing to do the right thing, and not fall for the temptation to embezzle those hundreds of millions nudge nudge wink wink ;-)
Scan Platform & Source, then do Fuzzing (Score:2)
Most folks, including many so-called "experts", lack both the knowledge and ability to do anything close to a "real" security check. So the best route is to rely on "canned" testing that has been created and is maintained by a reputable group.
First, scan the platform (with the application installed) for known vulnerabilities, including updates, configuration (CVRs, STIGs), rootkits and antivirus.
Second, scan the source code with all available static analysis tools. Start with lint, then do as many more as
Re: (Score:2)
Hey! I sell that knowledge! Would you kindly shut up? :)
Should have had security review (Score:3)
I worked at a place where we had a lot of disk (~2TB) with data that were accessible to the public. We also had a web site in place where users could upload new data, which would then be vetted by staff and then published to the public. This was all okay.
The bad part starts when we hired a new guy who, among other duties, wound up redoing the upload interface. So he redesigns and implements the system. I wasn't part of that process, and I wasn't paying any attention to how he was doing it. Later on, he quit, and his codebase was passed to me to maintain. That's when I started looking at the code and discovered that he had implemented a server-side API for uploading data that required no credentials whatsoever--he had set up a password authentication on the web front-end, but the API itself was open to the world. Oh, and the new API also stored uploaded data directly in the publicly accessible disk space. Any rando on the Internet who discovered this API would be able to upload hundreds of GB of whatever porn and warez they wanted, and just pass the URLs out freely. This code had been running in production for months.
Luckily, apparently nobody noticed. I audited the file system and its contents were exactly the files we expected to be there, and with the correct hashes. But it all made me wish we had a better review process, if this was the kind of coder they were going to hire.
I work for a pretty big bank.. (Score:2)
I work for a pretty big bank with thousands and thousands of servers. I doubt 10% would pass a PCI audit, but since there are so many incompetent and non technical people between the assessor and those that know what they are doing.
I've heard the manager of Sys admins say "I've never been told any of our servers fall under PCI" this specifically in reference to systems that comb over CC use in search of fraud......
Shared system accounts running processes with full sudo access using a password forced using
Software reviews? Pikers! (Score:2)
Standing security guard on an operation involving [can neither confirm nor deny] during an inspection. One of the inspectors was standing outside the security area next to some pipes that ran along the bulkhead. He put his hand on them and slowly started inching it along them towards the plane defined by the ropes that marked the security area. When his hand was just short of breaking the plane, I took my nightstick out and laid the tip on the pipe just touching his fingertips. He took his hand back, mad
Yeah, No (Score:2)
Some years earlier, though, I had a job doing B2 security auditing at Data General. For those of you who don't remember Data General, they had their own line of high end workstations and their own variant of UNIX. Their thing was making secure versions of UNIX and they wanted a B2 cert for it. So I got to read a good chunk of the original AT&T C standard library, which they'd licensed. W
I was gifted 40'000 credit card numbers (Score:3)
Through a client referral, I was introduced to a company that was in sudden need of a new web host. Their current Australian host was shutting down, and they had two weeks (by the time I was referred) to move their small Canadian site elsewhere.
When I say "small Canadian site", I mean the site was a small, promotional, site, with little more than five pages and a signup form.
Little did I know...
This was ultimately the consumer-brand of a large telecom provider -- a very large, national, telecom provider. This "small" site, was a mass-market allowing consumers to sign-up, and to also pay their monthly long-distance bill. This was circa 2010.
We shook hands, I said: "sure, I can move your site in the two weeks, just give me the credentials to it, and I'll figure it out."
Wow was that a mistake. Anyone heard of CakePHP?. I had to figure it out pretty fast.
It was late one evening, when I discovered the page that allowed customers to pay their bill online -- something no one had told me was a part of this tiny site. There was no https/ssl to even hint at it. And then I saw the MySQL insert statement, and the variable "card_number". And I was scared.
I said, to myself, "no, it can't be!" There must be some part of the platform wrapping the database call that must mask-out the card number. Or this must not be the actual card number. Or maybe it's not used anymore. Or something.
Then I logged into the phpMyAdmin, with the credentials given to me.
So, this is when you need to understand something. I'm a small independent web developer. At the time, I was teeny tiny. I had no written contract. The e-mailed and in-person job discussions said nothing of sensitive information of any kind. No money would be transferred until the job was done. So at this point, there is effectively zero legal agreement between us.
I looked at the table, I saw over forty-thousand records, each with real, live, credit card numbers. . .and expiry dates, and card holder names, and purchase amounts, and confirmation/approval codes.
I was stunned.
Obviously, being the non-criminal that I was at the time, I told them. I told them that I was appalled. I told them that it can't stay this way. I told them that I was going to charge them a few hundred dollars to encrypt the field, and the very least -- I was too young to know that I should have been charging way more.
They said they didn't care, I should just leave it as-is.
That was over a decade ago. Ever since then, I've learned that there are very few clients who will pay five cents towards security, backup, or encryption of any kind. In my entire 25-year career (so far), I've met only two clients who'll invest in that kind of safety.
So I no longer bother even suggesting that security or backup is a good idea. My legal contracts ensure that I'm not legally liable for the consequences of doing anything that they've explicitly told me to do, and that's good enough for me, I guess.
So to all those youngin's not yet jaded for failed efforts to be good, enjoy having the hero-skills to save people; but if your career is anything like mine, you'll quickly learn that those skills carry a perfectly zero-dollar value.
In the days of Equifax, riddle me this: where's the law that says you can't store millions of archived data all in one place, forever, online? Some of these 40'000 records hadn't been charged in over a year -- clearly old/former customers. And aside from those from the current day, all of them were old records that were no longer needed at all. Equifax had e-mails from ten years ago. How about a very simple law saying that things get taken offline eventually? Your ten-year-old e-mail can be accessible from that machine in the corner of the office, or through a request for the tape backup, and that's good enough 99% of the time.
But hey, where's the law that says one model of gun is illegal.
Thanks for the freedom.
Re: (Score:1)
There's nothing more uncommon about common sense.
Apparently, acceptable grammar is quite rare as well.
Re: (Score:2)
Re: (Score:2)
The security review was nothing like I expected. (Score:5, Funny)
Some software I was involved with developing had to undergo a security review. Little did I realize how unprepared for this event I was!
It started off relatively benignly. I was sitting in one of the conference rooms, waiting for the external security consultant to come in. He arrived a minute or two after I had arrived.
"Hello.", he started off. "I'm Steve and today we'll be performing a security review of the software you and your team have developed." He opened his laptop and started loading up the source code we'd provided to him earlier. He didn't even bother with any sort of friendly small talk.
"So I see you chose C++." he said after a minute or so of looking at the code.
"Yes, C++14.", I confirmed.
"Unacceptable.", he stated without hesitation.
I was slightly taken aback. "Pardon?", I asked.
"C++ is unacceptable.", he stated.
"We're using modern C++ techniques, including smart pointers and RAII. We also run our code through several static and dynamic analysis tools.", I explained.
"C++ is unacceptable.", he repeated.
We sat in silence for a couple of minutes as he continued to scroll through the code.
"Why didn't you use Rust?", he finally asked.
"Rust?", I replied. "We started this project before Rust 1.0 had been released. Plus our team is more familiar with C++."
"C++ is unacceptable.", he repeated once again.
He was starting to get agitated. "Why the fuck didn't you use Rust?!" he asked once more.
"I just explained why.", I responded.
"Don't you give a fuck about guaranteed memory safety? Don't you give a fuck about threads without data races?", he asked loudly.
"Well, yes, I do care about such things. But we can achieve those by using modern C++ sensibly."
As expected, he replied "C++ is unacceptable. C++ is fucking unacceptable."
I wasn't really sure what to do at this point. Clearly he didn't think C++ was an acceptable language to use.
My pondering was cut short. He abruptly started screaming, "WHY THE FUCK DIDN'T YOU USE RUST?! DON'T YOU GIVE A FUCK ABOUT ZERO-COST ABSTRACTIONS?!"
"C++ usually has zero-cost abstractions.", I pointed out.
This sent him over the edge. His face started getting a very deep red color, and I could see he was getting extraordinarily angry. "C++ IS UNACCEPTABLE! C++ IS UNACCEPTABLE! YOU HAVE TO USE RUST! RUST IS THE ONLY PROGRAMMING LANGUAGE THAT RUNS BLAZINGLY FAST, PREVENTS SEGFAULTS, AND GUARANTEES THREAD SAFETY!"
At this point I was starting to fear for my safety. I had read comments from Rust fanatics online, at places like Hacker News and Stack Overflow. But I had never expected these Rust advocates to be as egregiously agitated as this security consultant was.
Noticing that the door to the conference room was slightly open, and thankful that I was sitting closer to the door than the consultant was, I made a dash for freedom. I slipped through the door, and immediately started running toward my manager's office.
All the way I could hear the consultant screaming, "C++ IS UNACCEPTABLE! YOU NEED TO USE RUST BECAUSE IT HAS TRAIT-BASED GENERICS AND PATTERN MATCHING!"
I quickly explained the situation to my manager, who was wondering what all of the yelling was about. He quickly dialed the office building's security team, but they must have been alerted beforehand by somebody else, because the consultant's yelling abruptly stopped mid-way through a rant about the importance of move semantics.
To be perfectly honest, I have no idea what happened in the end. I assume the security consultant was promptly removed from the building. As for the security review of our software, I haven't heard about having to do any additional ones. Perhaps management realized that there were better uses for our time than listening to some lunatic berate us for using C++ instead of Rust.
Seriously? Re:The security review was nothing... (Score:1)
You are telling me that the staff member who was running the meeting or the senior staff member in the room didn't intervene as soon as he started acting unprofessionally?
Being anti-RUST or whatever I can see. Being closed-minded to the point of being useless as a consultant I can see. But an invited outsider who gets unprofessional in a meeting should be reminded to be professional and/or removed before things get out of hand.
Re: (Score:2)
Re: (Score:2)
Wow, someone is still taking this seriously???
It's a pretty accurate depiction of an encounter with a typical Rust flake if you ask me.
Re: (Score:2)
"Whooooooooooooooooosh" times ten to the 300th power.
That went so far over your head, it's probably in low-Earth orbit.
Re: (Score:2)
BOFH would have asked him to plug in the waffle iron.
Re:The security review was nothing like I expected (Score:5, Funny)
Like rust?
Re: (Score:2)
Like rust?
If I had mod points, they'd be yours.
Re: (Score:3)
Common Sense? A set of assumptions, usually false acquired before age 18.
Re: (Score:3)
"Common sense" is just a term that means "agrees with what I already think."
Re: (Score:1)
Re: (Score:2)
We have an external company that does penetration testing, which definitely find stuff we don't catch in code reviews.
Re: (Score:2)
Since I sit on the other end (the receiving end of these jokes here), i.e. doing penetration tests, code reviews and general consultation in the area of IT security, I might be able to answer this.
Usually we get called when someone either wants to or (more often) is legally or contractually obligated to perform security reviews of their code, their processes or their remotely accessible infrastructure, e.g. webservers. Then we throw everything (or not, depending on what they want) we have in our arsenal of
Re: "security review"? (Score:4, Insightful)
I have been a developer since about 1990 and I have been occasionally re-purposed to perform security reviews
The first time was in 2000, we were a data center that was part of a fairly new fiber company.
We were in a partnership with a large document management company and some open source organization.
The website that we were hosting kept crashing and the PM responsible for it had lost the admin password.
It ran on Oracle and I was able to use some default passwords and os level functionality in Oracle to grep the file system and identify the system passwords.
Unsurprisingly, I found that they were using commonly known passwords that were present throughout their training materials
When I asked if they could change the default passwords to new values, and rotate them regularly, the response was "No, we think that will break everything"
This resulted in two things, I because the Unix security guru, and I got them kicked out of our datacenter.
Similarly, one day our SAN admin noticed that DVD images were being stored on our SAN. We traced it back to another start-up that had been using TELNET to log into their box as root. Apparently this traffic had been sniffed out and our systems had been compromised. This resulted in a clean-room rebuild of all active systems and me being tasked with writing security policies to publish to our customers, follow them and be welcome, don't follow them and buh-bye...
You may notice that this is all being done in a completely reactive manner since at that time, apparently, nobody in the fucking planet had a clue about how to build and admin a secure system.
Since that time I have fought the "make a system where you can change the default passwords", "Keep your systems patched up the currently available level", "why the fuck are you passing strings to your database without scrubbing them", and "sure, that is what you think your firewall is doing, but it is not really doing that" battles over and over and over.
They say that security starts at the code level, and you can really fuck yourself over by taking a poor approach, but most security problems are just plain piss-poor admin skills. IMHO
Re: (Score:2)
These aren't "oh, I'm a sys admin and need to log into this machine!" passwords, these are automated process passwords. They can be long and crazy difficult because you will never type them.
My last job had a terrible time of this, people were always adding random jobs that did things using an admin password ( Instead of a proper account), then wondering why it exploded when we changed the admin password bi monthly.
Re: (Score:2)
Why are you even using passwords when public key authentication is a thing?
Re: (Score:2)
You are totally delusional Chris.
Please explain to me why the submission you made in 1 account appears in all following accounts:
https://slashdot.org/~IAteFatC... [slashdot.org]
https://slashdot.org/~IHateFat... [slashdot.org]
https://slashdot.org/~ILoveFat... [slashdot.org]
https://slashdot.org/~cdreimer [slashdot.org]
The unique submission link is:
https://slashdot.org/submissio... [slashdot.org]
Re: (Score:2)
Doesn't work if your CISO knows his shit. Ours would drag your ass out of your current project and give you the "fix that! NOW!" lecture. Not necessarily with more words but with more decibel.
Re: (Score:2)
Why?
I mean, yes, I can, but why would I? More, why would I trust a routine I wrote more than one that has, by its very nature, survived countless security reviews from countless security researchers and specialists?
Your routine is as secure as you are. Commonly used ones are as secure as the security community can make them.
Re: (Score:2)
Process management fail.
Second question should be "If Yes, are you using the company standard X building block OR is your job to redesign the standard X building block?"
Re: (Score:2)
But then nobody gets the free meeting Panera takeout lunch...
Re: (Score:2)
Wow. Just wow.
Who did these bullshit requirements come from?
Re: (Score:2)
The CIO's "policy is two factor authentication -- all APIs require a username and password"
I guess that's the IT version of "we have both kinds of music - country AND western".