0
votes
0answers
13 views

Storing a WCF endpoint in the registry - worried about security

I am storing my wcf endpoint in the registry, and using that whenever my app starts up to instantiate a wcf derived object. The user can change the endpoint location, to another server, and the ...
6
votes
6answers
631 views

What are the cases where keeping source code secret is justified?

When I worked as a freelancer, I encountered lots of cases where customers were protecting their ideas and source code of their projects (such as web applications) as much as possible, no matter how ...
31
votes
5answers
6k views

How easy is it to hack JavaScript (in a browser)?

My question has to do with JavaScript security. Imagine an authentication system where you're using a JavaScript framework like Backbone or AngularJS, and you need secure endpoints. That's not a ...
13
votes
7answers
859 views

Are all security threats triggered by software bugs?

Most security threats that I've heard of have arisen due to a bug in the software (e.g. all input is not properly sanity checked, stack overflows, etc.). So if we exclude all social hacking, are all ...
10
votes
5answers
373 views

What are unique aspects of a software Lifecycle of an attack/tool on a software vulnerability?

At my local university, there is a small student computing club of about 20 students. The club has several small teams with specific areas of focus, such as mobile development, robotics, game ...
2
votes
1answer
279 views

Why is iOS “jailbreaking” CPU specific?

Recently, iOS 6 was "jailbroken" but only on the Apple A4 CPU. Why is the "jailbreaking" process specific to a CPU? From Wikipedia: ... "iOS jailbreaking is the process of removing the ...
0
votes
2answers
1k views

Resources for C/C++ security (whitehat) hacking [closed]

I'm currently working as a C++ developer in a software security department, but not as a researcher or whitehat hacker. Security is an interest of mine, mainly in the areas where I can exploit code or ...
-1
votes
5answers
209 views

Computer security expert using pre-made tools or own? [closed]

As a digital security consultant when is it 'ok' to use tools someone else made (dumb to reinvent the wheel, right?) and when should I make my own?
5
votes
3answers
278 views

Possible hack aftermath [closed]

After being hacked companies often give numbers and details on how much of their data was compromised e.g "13K user and passwords". After a possible intrusion how do you know what the hacker did in ...
7
votes
3answers
1k views

What is the best way to learn how to develop secure applications?

I would like to get into computer security in my career. What are the best ways to learn how to program securely? It seems to me that, besides textbooks and taking classes in the subject, perhaps ...
3
votes
4answers
356 views

Are there laws to protect us from hackers who disclose vulnerabilities prior to alerting the vendor?

Take the example of the recent ASP.NET (and Java Server Faces) vulnerability disclosure at a Hacker conference in Brazil. It's my understanding that the poet tool was demonstrated before Microsoft ...