4 ms·

Do you have any idea how much software is run behind a firewall? If someone is even able to run my software that means they have full access to a shell and com

Do you have any idea how much software is run behind a firewall? If someone is even able to run my software that means they have full access to a shell and compilers for multiple programming languages. As such, there are much easier ways to run malicious code than to exploit a buffer overflow in my C or C++... So really, your argument only applies to public facing servers or web browsers. Unless you're writing one of those, I think your argument is weak.

MaulingMonkey 10y ago
> So really, your argument only applies to public facing servers or web browsers. Or, you know, literally anything touching a file format that might be downloaded. PDFs, word documents, images, zip files, movies, music, sounds, icons that show up in your file explorer, user profiles, any sort of web client (email, games, chat, wget, package managers, ...) lots of poison apples out there. This kind of nonsense is why the best advice to handling USB drives you find on the ground is to toss them in a fire barrel - everyone thinks they're "behind a firewall" and that they're totally protected! They have all the protection of a wet tissue in a hurricane. Oh, but I'm just writing a terminal! I don't touch file formats! It's safe to auto-execute commands in response to pasted newlines! ...and then you've helped enable the spread of malware through clipboard hijacking Javascript. Oops. Firewalls are not a panacea. Firewalls are a roadbump. > Unless you're writing one of those, I think your argument is weak. I think your security is borderline nonexistent. I think I cannot trust you with C. I think someone is probably in your systems if you're in charge of the security side of IT, of anywhere of significance, unless you delegated enough responsibility to make you a figurehead. I mean no offense by this. A lot of reasonably talented and smart programmers make the same mistake as you, and go write a bunch of exploitable vulnerabilities in C as a result. It's not like you're one of those madmen disabling ASLR, NX, stack cookies, or some of the many other mitigation techniques being used to try and clean up after this tragedy of our times. ...right?
- NoIdeaAtAll 10y ago
  > I think I cannot trust you with C. You really don't get it, but your arrogance is overwhelming. I don't care who you trust. > I mean no offense by this. Yes you do.
  - MaulingMonkey 10y ago
    > You really don't get it Then point out what I'm missing.
    - NoIdeaAtAll 10y ago
      Look, you're just another arrogant novice who runs around telling people how to be safe so you can convince yourself that you're safe. Maybe you'll grow out of that, or maybe you'll stay obnoxious forever. I doubt you want an actual answer, and I'm pretty certain you don't deserve one. However, giving you the benefit of the doubt - There tens of thousands of programmers out there (myself included) who write software to analyze data. We don't make "apps" for users, and we don't download random PDFs or MP3s for input. Your view is so limited, you can't even imagine software that isn't a product or a tool for advertising, but trust me - a lot of software is written in other environments, and malicious users or malicious data is not a real concern. Anyways, don't bother to reply. I'm sure you won't admit you're wrong, and I'm not interested in continuing this discussion.
      - MaulingMonkey 10y ago
        > However, giving you the benefit of the doubt I appreciate that. > There tens of thousands of programmers out there (myself included) who write software to analyze data. We don't make "apps" for users, and we don't download random PDFs or MP3s for input. Your view is so limited, you can't even imagine software that isn't a product or a tool for advertising, but trust me - a lot of software is written in other environments, and malicious users or malicious data is not a real concern. Ahh. It's funny - you think I can't think of all the software where security isn't an issue, and I think you can't think of all the software where security is an issue. I'm aware that there is software where, rightly, security isn't a huge concern. It exists. Some software for crunching data internally counts! And some software is written where the front door is wide open anyways. But the scope for software where security isn't a concern sure as shit isn't "everything but public facing servers or web browsers", as I took you to imply. It's also not "everything but products and advertising tools". Point of sales systems, industrial control software, internal financial software, routers, telecom infrastructure... all kinds of wonderful "internal", bespoke systems, that most definitely need to care about security and protection against malicious users, or malicious employees. Industries where mandatory vacations are a security policy against fraud, where your software will be generating audit logs, where defense in depth matters against external threats even if you could trust your employees. Which are just chock full of C programs. Sigh. > I'm not interested in continuing this discussion. Fair enough. Thank you for taking the time you did. > Look, you're just another arrogant novice who runs around telling people how to be safe Yeah, probably. Not so arrogant as to be certain I can think of every reason my software might actually need to care about security, or to try and write security critical C in good conscious, though. > so you can convince yourself that you're safe. I'd never succeed at that. Safer, maybe, but never safe. > Maybe you'll grow out of that, or maybe you'll stay obnoxious forever. For the sake of progress and a safer future, let's hope for the latter.

MaulingMonkey 10y ago

> So really, your argument only applies to public facing servers or web browsers. Or, you know, literally anything touching a file format that might be downloaded. PDFs, word documents, images, zip files, movies, music, sounds, icons that show up in your file explorer, user profiles, any sort of web client (email, games, chat, wget, package managers, ...) lots of poison apples out there. This kind of nonsense is why the best advice to handling USB drives you find on the ground is to toss them in a fire barrel - everyone thinks they're "behind a firewall" and that they're totally protected! They have all the protection of a wet tissue in a hurricane. Oh, but I'm just writing a terminal! I don't touch file formats! It's safe to auto-execute commands in response to pasted newlines! ...and then you've helped enable the spread of malware through clipboard hijacking Javascript. Oops. Firewalls are not a panacea. Firewalls are a roadbump. > Unless you're writing one of those, I think your argument is weak. I think your security is borderline nonexistent. I think I cannot trust you with C. I think someone is probably in your systems if you're in charge of the security side of IT, of anywhere of significance, unless you delegated enough responsibility to make you a figurehead. I mean no offense by this. A lot of reasonably talented and smart programmers make the same mistake as you, and go write a bunch of exploitable vulnerabilities in C as a result. It's not like you're one of those madmen disabling ASLR, NX, stack cookies, or some of the many other mitigation techniques being used to try and clean up after this tragedy of our times. ...right?

NoIdeaAtAll 10y ago
> I think I cannot trust you with C. You really don't get it, but your arrogance is overwhelming. I don't care who you trust. > I mean no offense by this. Yes you do.
- MaulingMonkey 10y ago
  > You really don't get it Then point out what I'm missing.
  - NoIdeaAtAll 10y ago
    Look, you're just another arrogant novice who runs around telling people how to be safe so you can convince yourself that you're safe. Maybe you'll grow out of that, or maybe you'll stay obnoxious forever. I doubt you want an actual answer, and I'm pretty certain you don't deserve one. However, giving you the benefit of the doubt - There tens of thousands of programmers out there (myself included) who write software to analyze data. We don't make "apps" for users, and we don't download random PDFs or MP3s for input. Your view is so limited, you can't even imagine software that isn't a product or a tool for advertising, but trust me - a lot of software is written in other environments, and malicious users or malicious data is not a real concern. Anyways, don't bother to reply. I'm sure you won't admit you're wrong, and I'm not interested in continuing this discussion.
    - MaulingMonkey 10y ago
      > However, giving you the benefit of the doubt I appreciate that. > There tens of thousands of programmers out there (myself included) who write software to analyze data. We don't make "apps" for users, and we don't download random PDFs or MP3s for input. Your view is so limited, you can't even imagine software that isn't a product or a tool for advertising, but trust me - a lot of software is written in other environments, and malicious users or malicious data is not a real concern. Ahh. It's funny - you think I can't think of all the software where security isn't an issue, and I think you can't think of all the software where security is an issue. I'm aware that there is software where, rightly, security isn't a huge concern. It exists. Some software for crunching data internally counts! And some software is written where the front door is wide open anyways. But the scope for software where security isn't a concern sure as shit isn't "everything but public facing servers or web browsers", as I took you to imply. It's also not "everything but products and advertising tools". Point of sales systems, industrial control software, internal financial software, routers, telecom infrastructure... all kinds of wonderful "internal", bespoke systems, that most definitely need to care about security and protection against malicious users, or malicious employees. Industries where mandatory vacations are a security policy against fraud, where your software will be generating audit logs, where defense in depth matters against external threats even if you could trust your employees. Which are just chock full of C programs. Sigh. > I'm not interested in continuing this discussion. Fair enough. Thank you for taking the time you did. > Look, you're just another arrogant novice who runs around telling people how to be safe Yeah, probably. Not so arrogant as to be certain I can think of every reason my software might actually need to care about security, or to try and write security critical C in good conscious, though. > so you can convince yourself that you're safe. I'd never succeed at that. Safer, maybe, but never safe. > Maybe you'll grow out of that, or maybe you'll stay obnoxious forever. For the sake of progress and a safer future, let's hope for the latter.