446 reputation
410
bio website linkedin.com/in/avidouglen
location Israel
age 39
visits member for 3 years, 9 months
seen Jun 20 at 12:49

Security expert and experienced Windows programmer


May
6
comment Why does TDD work?
@gnat sure, let's take you as an example - do you believe that basing your design on some testing requirements is a good design, and that it works?
Sep
17
comment Is a large increase in velocity realistic in a Scrum environment?
Odds are that removing the manager's overhead (forced meetings, filling out forms, etc) would probably give you that 5-10%, easily. But how to convince him?
Aug
21
comment How to assure users that website and passwords are secure
Right, "in relation to what" I meant for what requirements, security profile, risks, etc. Still not a personal judgement, but perhaps what you meant by "personal" is what I mean by "context". "Secure" is a hard science metric, not a soft wishy-washy "feeling". But yeah, like you say, don't tell me it's "secure", tell me what you did to make it so.
Aug
21
comment How to assure users that website and passwords are secure
No, "This is secure" is not a "personal" or subjective statement, it is not like "it is pretty", to me. It is actually a semantically empty statement, without specifying "in relation to what" or "secure from what attacks" or "at what level in which context". If your entire statement consists of "this is secure", it is out of date before you finish typing it, and it is highly probable that you are not aware of it. I do agree though on the last part, it is all about details.
Oct
15
comment What are unique aspects of a software Lifecycle of an attack/tool on a software vulnerability?
Exactly. There is of course the other aspect, which you mentioned, regarding maintainance - if it is not intended to have a long lifetime, that's a lot different from something that is still a product to be reused, versioned, tested, etc. Of course weaponized exploits (e.g. stuxnet) would be different from both, crimeware different yet, and so on.
Oct
15
comment What are unique aspects of a software Lifecycle of an attack/tool on a software vulnerability?
@DavidKaczynski but my point is that it is inherently different - or rather, developing one type is different from another type. See e.g. Terry's answer as an example, and compare those further to viruses, and again to zero-days, and again to Stuxnet, and... Some would be properly engineered, some are thrown out overnight, depends on the different context and requirements.
Oct
15
comment What are unique aspects of a software Lifecycle of an attack/tool on a software vulnerability?
@DavidKaczynski you could also consider asking this on Information Security, to get the viewpoint of those actually designing the various types of software. And there are big differences, depending on the security requirements...
Aug
24
comment Should a stack trace be in the error message presented to the user?
@MarkBooth my bad, I do know that meme... Joking aside, my point was that that is the reason for defence in depth - one part of which is not revealing the stack trace just in case (with a high probability) that you have other security flaws to be found.
Aug
23
comment Should a stack trace be in the error message presented to the user?
e.g the sec.se question linked to by @oleksi - security.stackexchange.com/questions/4471/….
Aug
23
comment Should a stack trace be in the error message presented to the user?
I agree very much about the weighing, but I disagree about its application. It harms security more than you think, and I also think that your way (having done this myself, too, until I talked to some of the users.....) is worse for usability. Think of it in task-oriented terms - as @Jon's answer said, his way gets the user's job done much better. The user doesnt need to care about the stack (unless your users are the developers...) But, my expertise is in security - and the risks are real.
Aug
23
comment Should a stack trace be in the error message presented to the user?
@user1598390 so build a log viewing mechanism. A simple web page, input the incident id, and the helpdesk can see the entire relevant log. Of course limit access to this feature, and so forth...
Aug
23
comment Should a stack trace be in the error message presented to the user?
@MarkBooth statistically speaking, you probably are doing it wrong. No, scratch that - statistical certainty that you are getting some of it wrong. Do you really want to let the attackers find your security bugs before you do?
Aug
23
comment Should a stack trace be in the error message presented to the user?
And btw, a security audit does not necessarily need access to the source code, they probably did a black-box penetration test, simulating what a malicious user would do - try to attack the application as a user. Though I agree that access to the source code could have enabled a much more effective form of audit. :-)
Aug
23
comment Should a stack trace be in the error message presented to the user?
Wow. Just... wow. "Unfortunately there has been some kind of "Security audit"" - Seriously? What kind of attitude is that? The security audits are for your benefit - to make your systems better, to find the problems before the bad guys do. You should really consider trying to work with them, not against them. Also, you could try to get more information on the security PoV over at Information Security.
Aug
23
comment How to explain that sample size does not influence project length
@ScottWhitlock no, because there are inherently two parts: building + traffic. The requirements may change the building slightly, but the linearly-affected traffic part is the much smaller of the two.
Aug
23
comment How to explain that sample size does not influence project length
As @MarkJ said, this analogy doesnt quite work. Because the purpose of the project isnt "building a road", it's "getting 1000 car to the other end" (or 1000000). I believe I gave another car analogy that works a bit better.
Jul
25
comment The difference between best practices and common sense?
Oh, and if you're not familiar with the best practices, you don't have common sense, either.
Jul
25
comment The difference between best practices and common sense?
Cognitive bias... again. And that's why you need to be an acknowledged expert, before you rely on your common sense...
Jun
14
comment Dealing with a developer continuously ignoring edge cases in his work
@ironcode you are correct(ish), in Microsoft for example there is a whole different set of roles (with a parallel career plan) for SDET - Software Development Engineer in Test. I said "-ish", because some of them are really good, not necesarily inexperienced or less competent.
May
11
comment Why is Google blocking users from accessing their local file system in Chromium?
If you want, you can try this over at security.stackexchange.com