The tag has no wiki summary.

learn more… | top users | synonyms

39
votes
13answers
5k views

How safe is it to compile a piece of source code from a random stranger? [closed]

Suppose I'm reviewing code that job applicants send to prove their skills. Clearly I don't want to run executables they send. Not so clearly I'd rather not run the result of compilation of their code ...
-2
votes
1answer
78 views

Is software inherently buggy and hence, vulnerable? [duplicate]

Could no amount of formal analysis, type/rule checking prevent it's exploitation? How about a fully verified kernel such as SEL4 ?
0
votes
0answers
35 views

Advice on which approach to follow for sandboxing the input in an intentional “vulnerable” web app (sandbox in python) [duplicate]

my question is about which is the best approach/practice on building a "sandbox mechanism" in Python in a web application. The app will provide intentional vulnerable scenarios, and the user has to ...
-1
votes
1answer
107 views

Buffer-overflow vulnerabilities that a static code analyser won't pick up [closed]

I'll use FlawFinder in this example. FlawFinder is a static code "analyser" tool that examines C/C++ source files and outputs warnings/hits if a vulnerability was identified. The way it does this is ...
2
votes
1answer
208 views

How to check for vulnerabilities in web application [closed]

I have developed a web application using zend framework, mysql, and other client side technologies like javascript, jquery ajax, kendo grid, and so on. I have completed development and have done ...
6
votes
0answers
86 views

What To Do If I've Found a Vulnerability In a Possible Future Employers Site? [duplicate]

I've been self employed for a long time now and have recently decided that PHP development within a company is the route I'd like to go down. I had an initial interview/meeting yesterday with a ...
1
vote
2answers
707 views

What is the story behind Java Vulnerabilities?

I always appreciated the Java language. It is known as a very secure platform and many banks use it in their web applications. I wanted to build a project for my school and I discussed the options ...
21
votes
9answers
2k views

Why is it so difficult to make C less prone to buffer overflows?

I'm doing a course in college, where one of the labs is to perform buffer overflow exploits on code they give us. This ranges from simple exploits like changing the return address for a function on a ...
5
votes
3answers
262 views

Examining source code for maliciousness and security vulnerabilities

What are some techniques in determining if a particular piece of source code is malicious or vulnerable to malicious attack? I am currently using cppcheck and I am waiting on an install of Rational ...
5
votes
3answers
2k views

What are the security risks/vulnerabilities every C programmer must be aware of?

There are many security risks coming from having close contact to the hardware as opposed to using well-tested and proved APIs from high level programming languages. It is much easier to cause a ...
4
votes
4answers
319 views

Small projects using the cathedral model: does open-source lower security?

We know of Linus' law: With enough eyeballs all bugs are shallow In general, people seem to say that open-source software is more secure because of that very thing, but... There are many small ...
36
votes
14answers
4k views

What to do if you find a vulnerability in a competitor's site?

While working on a project for my company, I needed to build functionality that allows users to import/export data to/from our competitor's site. While doing this, I discovered a very serious security ...
5
votes
5answers
935 views

Is it safe to display information about old passwords on login failure?

When I changed my Facebook password yesterday, by mistake I entered the old one and got this: Am I missing something here or this is a big potencial risk for users. In my opinion this is a problem ...