466 reputation
410
bio website linkedin.com/in/avidouglen
location Israel
age 39
visits member for 4 years, 1 month
seen Aug 10 at 21:22

Security expert and experienced Windows programmer


Jun
17
awarded  Pundit
May
6
comment Why does TDD work?
@gnat sure, let's take you as an example - do you believe that basing your design on some testing requirements is a good design, and that it works?
May
6
awarded  Editor
May
6
revised Why does TDD work?
deleted 49 characters in body
Oct
15
answered Overcoming slow problem solving due to increased knowledge of what might go wrong
Sep
19
awarded  Talkative
Sep
17
comment Is a large increase in velocity realistic in a Scrum environment?
Odds are that removing the manager's overhead (forced meetings, filling out forms, etc) would probably give you that 5-10%, easily. But how to convince him?
Aug
21
comment How to assure users that website and passwords are secure
Right, "in relation to what" I meant for what requirements, security profile, risks, etc. Still not a personal judgement, but perhaps what you meant by "personal" is what I mean by "context". "Secure" is a hard science metric, not a soft wishy-washy "feeling". But yeah, like you say, don't tell me it's "secure", tell me what you did to make it so.
Aug
21
comment How to assure users that website and passwords are secure
No, "This is secure" is not a "personal" or subjective statement, it is not like "it is pretty", to me. It is actually a semantically empty statement, without specifying "in relation to what" or "secure from what attacks" or "at what level in which context". If your entire statement consists of "this is secure", it is out of date before you finish typing it, and it is highly probable that you are not aware of it. I do agree though on the last part, it is all about details.
Aug
21
answered How to assure users that website and passwords are secure
Jan
31
awarded  Yearling
Oct
15
comment What are unique aspects of a software Lifecycle of an attack/tool on a software vulnerability?
Exactly. There is of course the other aspect, which you mentioned, regarding maintainance - if it is not intended to have a long lifetime, that's a lot different from something that is still a product to be reused, versioned, tested, etc. Of course weaponized exploits (e.g. stuxnet) would be different from both, crimeware different yet, and so on.
Oct
15
comment What are unique aspects of a software Lifecycle of an attack/tool on a software vulnerability?
@DavidKaczynski but my point is that it is inherently different - or rather, developing one type is different from another type. See e.g. Terry's answer as an example, and compare those further to viruses, and again to zero-days, and again to Stuxnet, and... Some would be properly engineered, some are thrown out overnight, depends on the different context and requirements.
Oct
15
comment What are unique aspects of a software Lifecycle of an attack/tool on a software vulnerability?
@DavidKaczynski you could also consider asking this on Information Security, to get the viewpoint of those actually designing the various types of software. And there are big differences, depending on the security requirements...
Aug
24
comment Should a stack trace be in the error message presented to the user?
@MarkBooth my bad, I do know that meme... Joking aside, my point was that that is the reason for defence in depth - one part of which is not revealing the stack trace just in case (with a high probability) that you have other security flaws to be found.
Aug
23
comment Should a stack trace be in the error message presented to the user?
e.g the sec.se question linked to by @oleksi - security.stackexchange.com/questions/4471/….
Aug
23
comment Should a stack trace be in the error message presented to the user?
I agree very much about the weighing, but I disagree about its application. It harms security more than you think, and I also think that your way (having done this myself, too, until I talked to some of the users.....) is worse for usability. Think of it in task-oriented terms - as @Jon's answer said, his way gets the user's job done much better. The user doesnt need to care about the stack (unless your users are the developers...) But, my expertise is in security - and the risks are real.
Aug
23
comment Should a stack trace be in the error message presented to the user?
@user1598390 so build a log viewing mechanism. A simple web page, input the incident id, and the helpdesk can see the entire relevant log. Of course limit access to this feature, and so forth...
Aug
23
comment Should a stack trace be in the error message presented to the user?
@MarkBooth statistically speaking, you probably are doing it wrong. No, scratch that - statistical certainty that you are getting some of it wrong. Do you really want to let the attackers find your security bugs before you do?
Aug
23
comment Should a stack trace be in the error message presented to the user?
And btw, a security audit does not necessarily need access to the source code, they probably did a black-box penetration test, simulating what a malicious user would do - try to attack the application as a user. Though I agree that access to the source code could have enabled a much more effective form of audit. :-)