meta user
network profile
| bio | website | linkedin.com/in/avidouglen |
|---|---|---|
| location | Israel | |
| age | 38 | |
| visits | member for | 2 years, 7 months |
| seen | May 12 at 9:20 | |
| stats | profile views | 44 |
Security expert and experienced Windows programmer
|
Jan 31 |
awarded | Yearling |
|
Oct 15 |
comment |
What are unique aspects of a software Lifecycle of an attack/tool on a software vulnerability? Exactly. There is of course the other aspect, which you mentioned, regarding maintainance - if it is not intended to have a long lifetime, that's a lot different from something that is still a product to be reused, versioned, tested, etc. Of course weaponized exploits (e.g. stuxnet) would be different from both, crimeware different yet, and so on. |
|
Oct 15 |
comment |
What are unique aspects of a software Lifecycle of an attack/tool on a software vulnerability? @DavidKaczynski but my point is that it is inherently different - or rather, developing one type is different from another type. See e.g. Terry's answer as an example, and compare those further to viruses, and again to zero-days, and again to Stuxnet, and... Some would be properly engineered, some are thrown out overnight, depends on the different context and requirements. |
|
Oct 15 |
comment |
What are unique aspects of a software Lifecycle of an attack/tool on a software vulnerability? @DavidKaczynski you could also consider asking this on IT Security, to get the viewpoint of those actually designing the various types of software. And there are big differences, depending on the security requirements... |
|
Aug 24 |
comment |
Should a stack trace be in the error message presented to the user? @MarkBooth my bad, I do know that meme... Joking aside, my point was that that is the reason for defence in depth - one part of which is not revealing the stack trace just in case (with a high probability) that you have other security flaws to be found. |
|
Aug 23 |
comment |
Should a stack trace be in the error message presented to the user? e.g the sec.se question linked to by @oleksi - security.stackexchange.com/questions/4471/…. |
|
Aug 23 |
comment |
Should a stack trace be in the error message presented to the user? I agree very much about the weighing, but I disagree about its application. It harms security more than you think, and I also think that your way (having done this myself, too, until I talked to some of the users.....) is worse for usability. Think of it in task-oriented terms - as @Jon's answer said, his way gets the user's job done much better. The user doesnt need to care about the stack (unless your users are the developers...) But, my expertise is in security - and the risks are real. |
|
Aug 23 |
comment |
Should a stack trace be in the error message presented to the user? @user1598390 so build a log viewing mechanism. A simple web page, input the incident id, and the helpdesk can see the entire relevant log. Of course limit access to this feature, and so forth... |
|
Aug 23 |
comment |
Should a stack trace be in the error message presented to the user? @MarkBooth statistically speaking, you probably are doing it wrong. No, scratch that - statistical certainty that you are getting some of it wrong. Do you really want to let the attackers find your security bugs before you do? |
|
Aug 23 |
comment |
Should a stack trace be in the error message presented to the user? And btw, a security audit does not necessarily need access to the source code, they probably did a black-box penetration test, simulating what a malicious user would do - try to attack the application as a user. Though I agree that access to the source code could have enabled a much more effective form of audit. :-) |
|
Aug 23 |
comment |
Should a stack trace be in the error message presented to the user? Wow. Just... wow. " Unfortunately there has been some kind of "Security audit"" - Seriously? What kind of attitude is that? The security audits are for your benefit - to make your systems better, to find the problems before the bad guys do. You should really consider trying to work with them, not against them. Also, you could try to get more information on the security PoV over at IT Security. |
|
Aug 23 |
comment |
How to explain that sample size does not influence project length @ScottWhitlock no, because there are inherently two parts: building + traffic. The requirements may change the building slightly, but the linearly-affected traffic part is the much smaller of the two. |
|
Aug 23 |
comment |
How to explain that sample size does not influence project length As @MarkJ said, this analogy doesnt quite work. Because the purpose of the project isnt "building a road", it's "getting 1000 car to the other end" (or 1000000). I believe I gave another car analogy that works a bit better. |
|
Aug 23 |
answered | How to explain that sample size does not influence project length |
|
Jun 8 |
awarded | Caucus |
|
Feb 22 |
awarded | Civic Duty |
|
Oct 22 |
awarded | Yearling |
|
Jul 25 |
comment |
The difference between best practices and common sense? Oh, and if you're not familiar with the best practices, you don't have common sense, either. |
|
Jul 25 |
comment |
The difference between best practices and common sense? Cognitive bias... again. And that's why you need to be an acknowledged expert, before you rely on your common sense... |
|
Jul 25 |
answered | The difference between best practices and common sense? |
