4 ms·
There is nothing to protect there, the idea that some data is inherently dangerous is nonsense.
by zAy0LfpBZLC8mAC 7y ago
There is nothing to protect there, the idea that some data is inherently dangerous is nonsense.
- keymone 7y agoRCE due to buffer overflows, google it.
- megous 7y agoYou don't need to change the data to make it less dangerous. Just fix the program processing it. It's the program that's dangerous, not the data.
- strictnein 7y agoBecause you have full control over all programs in an enterprise?
- zAy0LfpBZLC8mAC 7y agoAnd what about buffer overflows makes particular data inherently(!) dangerous? As in, what would be an example of data where it is impossible to make it non-dangerous by fixing the buffer overflow that it exploits?
- keymone 7y agonot interested in debating semantics. data is turned from input streams of bytes into coherent structures in your system. the process of turning data into coherent structures is input sanitization. sanitization or validation or conformation - you can argue how to call it and where to use it, but if you don't - your internal bugs will be exploitable externally, good luck.
- zAy0LfpBZLC8mAC 7y ago> the process of turning data into coherent structures is input sanitization. No, that is parsing. > sanitization or validation or conformation - you can argue how to call it and where to use it Sanitization is "change to make acceptable", validation is "check for conformance and reject what is non-conforming". The first one is practiced by tons of developers and it's a terrible idea, the latter is what you should do. But also, the latter is never about "dangerous" input, it's only about meaningless input.