6 ms·

You either have way more grit at arguing than most people or you haven't worked at a large and cumbersome organization. I know most people at those kinds of or

by Delk 6y ago

You either have way more grit at arguing than most people or you haven't worked at a large and cumbersome organization. I know most people at those kinds of organizations just don't have the grit to fight every one of those battles all over again, and choose to do the things they can affect with reasonable effort instead. I'm not saying that grit would be a bad thing to have. I appreciate the people who do it. But you really can't know what kinds of situations the parent commenter was in, and sometimes you can't really expect everyone to want to fight it.

waheoo 6y ago
I agree with your sentiment in general, but this is telling a dumbass where to go. Its not a hard argument to win. Md5 here is fine, its not a security check.
- kbenson 6y ago
  Sometimes the point isn't technical, but social. So MD5 isn't used for security purposes right now. At some point someone will want some hashing function, and they'll probably look at what the code already uses. The last thing you want is someone a bit clueless goi g "it was good enough there, it's good enough here" and using MD5 where they shouldn't. Removing it from a codebase helps with that problem. The problem here is that people assume they know every possible reason why the auditor might ask for something, when they don't. If the auditor is asking for it, and it costs almost nothing to do, maybe just do it instead of wasting everyone's time by acting like you know the totality on the subject, and everyone will probably go home happier at the end of the day.
  - andreareina 6y ago
    Isn't that what code review is for? To me that sounds like arguing against string formatting because someone could think it's ok for SQL queries. An auditor's job doesn't end at saying what things should be changed, it should include why as well (granted, we don't know the full content of the auditor's report here, maybe they did say why).
    - kadoban 6y ago
      Code reviews are good checks. Making it more difficult for dumb ideas to show up in a code review and possibly be missed is also good. If using md5 had any real benefit I'd say leave it, but what are you gaining?
      - hashhar 6y ago
        because CRC is actually worse for checking file content collisions (not that MD5 is perfect either).
        Reelin 6y ago
        > because CRC is actually worse for checking file content collisions So use SHA-1 or SHA-2 or SHA-3 or if you really hate NIST standards for some reason then CubeHash or Skein or Blake2 or ...
        waheoo 6y ago
        Are you seriously suggesting sha-1 as a good replacement to md5... for security reasons?
        Reelin 6y ago
        Ahh poop, looks like I was out of date. Apparently a practical demonstration of an attack with complexity ~2^60 was recently demonstrated against legacy GPG (the v1.4 defaults) for less than $50k USD. [1] That being said, it looks like it still required ~2 months and ~900 GPUs versus MD5 at 2^18 (less than a second on a single commodity desktop processor). So yeah, I agree, add SHA-1 to the list of algorithms to reflexively avoid for any and all purposes unless you have a _really_ good reason to use it. [1] https://www.schneier.com/blog/archives/2020/01/new_sha-1_attac.html https://www.schneier.com/blog/archives/2020/01/new_sha-1_att...
        skissane 6y ago
        The reason why CRC32C was chosen as a replacement instead of SHA-2 or whatever - what happens if in a few more years, SHA-2 isn’t considered secure any more and some future security audit demands it be changed again? Whereas, a CRC algorithm isn’t usually used for security purposes, so a security audit is far less likely to pay any attention to it. The whole issue started because a security-related technology was used for a non-security purpose.
  - raverbashing 6y ago
    The reason they ask is that they have to fill a checkbox that says "no MD5" and of course they're don't know that CRC32 is worse And to be very fair, a lot of security issues would be caught with basic checkbox ticking. Are you using a salted password hashing function instead of storing passwords in plaintext? Are you using a firewall? Do you follow the principles of least privilege?
    - deleted 6y ago
      [deleted]
    - waheoo 6y ago
      Except this is not for password hashing. Why is this so difficult to grasp.
  - waheoo 6y ago
    What is this weird incessant need to play devils advocate. Sometimes people are just right.
    - kbenson 6y ago
      Because most times people aren't "just right", they're just unwilling to widen their point of view, and/or they turn the issue into a way to assert their own importance and intellect over someone else at the expense of those they work with. I don't need some coworker getting into some drawn out battle about how MD5 is fine to use when we can just use SHA (or CRC32C as that person did, which is more obviously non-useful for security contexts) and be done in 30 minutes. The auditor is there to do their job, and if what they request is not extremely invasive or problematic for the project, implementing those suggestions is your job, and arguing over pointless things in your job is not a sign of something I want in a coworker or someone I manage.
      - waheoo 6y ago
        > they turn the issue into a way to assert their own importance and intellect over someone else at the expense of those they work with. This is exactly what the auditor is doing. How can you not see the irony here? > I don't need some coworker getting into some drawn out battle This isn't a drawn out battle. This is a really fast one, md5 is fine here, you didn't check the context of its use, thats fine, whats the next item on your list? Whats fucking hard about that? Is this some kind of weird cultural thing with American schooling teaching kids they can't question authority?
        kbenson 6y ago
        > This is exactly what the auditor is doing. The auditor was asked to do it and is being paid to do it. Presumably, the people arguing are paid to implement the will of those that pay them. At some point people need to stop arguing and do what they're paid to do or quit. Doing this over wanting to use MD5 seems a pretty poor choice of a hill to die on. > This is a really fast one, md5 is fine here, you didn't check the context of its use, thats fine, whats the next item on your list? There are items like this all throughout life. Sure, you can be trusted to drive above the speed limit on this road, and maybe the speed limit is set a little low. But we have laws for a reason, and at some point you letting the officials know that the speed is two low and they really don't need to make it that low goes from helpful to annoying everyone around you. > Whats fucking hard about that? Indeed, what is so hard about just accepting that while you're technically correct that MD5 isn't a problem, you're making yourself a problem when you fight stupid battles nobody but you cares about, but everyone has to deal with? > Is this some kind of weird cultural thing with American schooling teaching kids they can't question authority? Hardly. Pompous blowhards exist in every culture. Also, that's hilarious. Your talking about a culture that rebels against authority just because they think they that's what they're supposed to do, even if it's for stupid reasons and makes no sense. See the tens of millions of us that refuse to wear masks because it "infringes on our freedom".
- andreareina 6y ago
  Not hard to win if everyone is being reasonable. Given an auditor that thinks all uses of MD5 are proscribed, what would you put the odds of them being reasonable at? ETA: per 'kbenson it's not hard to conceive of a situation where proscribing MD5 is reasonable. Taking 'skissane's account at face value is probably reasonable, but my implicit assumption that the auditor would not explain if pressed isn't being charitable.
  - reallydontask 6y ago
    indeed Specially with the audit/pen test theatre where they have to put something in the report, otherwise why are they getting paid £20K for two days work? So most people choose the past of least resistance, when it doesn't matter much, so that you fight where it does.
    - waheoo 6y ago
      Picking your battles is something we all need to learn to do. I for one like to pick the easy wins, like this.
- benhurmarcel 6y ago
  In a large company you have to choose your battles.
- Delk 6y ago
  As a technical choice, that's true. So the argument shouldn't be hard to win, assuming you're dealing with reasonable people, who are also answering to reasonable people. Those people (e.g. the leadership) also need to care enough about that detail to just not dismiss your argument because making the change is not a problem for them. And they need to not be so security-oriented (in a naive way) as to consider a "safer" choice always a better one regardless of whether there's a reasonable argument for it or not. That's more assumptions than it is sometimes reasonable to make. "You don’t actually need to listen to auditors" is decidedly not true for a lot of people in a lot of situations, and arguing even for technically valid or reasonable things is an endurance sport in some organizations. I mean, I even kind of want to agree with heavenlyblue's argument that you should fight that fight for the exact reason they're saying, and can see myself arguing the same thing years ago, but at least in case of some organizations, blaming people for taking skissane's stance would be disproportionate.
  - waheoo 6y ago
    Oh sorry, I thought we were discussing working with rational people. If you're working with irrational people you're going to have to do irrational things, but that's kind of a given isn't it? We don't really need to discuss that.
BrandoElFollito 6y ago
I do it for the sake of educating our management. For now 10 years, I refuse to acknowledge the finding of the consulting company which flags the password scheme I use (passphrases) because the norm they use (a national one) talks about czps, symbols etc. I refuse to sign off and note that our company is a scientific one and to the difference of the auditors, we understand math taught to 16 yo children. This goes to the board who gets back to me, I still refuse on ethical gtounds and we finally pass. This is sad that some auditors are stupid when some other are fantastic and that you depend on which one you get assigned. A good read: https://serverfault.com/q/293217/78319 https://serverfault.com/q/293217/78319

by Delk 6y ago

waheoo 6y ago

I agree with your sentiment in general, but this is telling a dumbass where to go. Its not a hard argument to win. Md5 here is fine, its not a security check.

kbenson 6y ago
Sometimes the point isn't technical, but social. So MD5 isn't used for security purposes right now. At some point someone will want some hashing function, and they'll probably look at what the code already uses. The last thing you want is someone a bit clueless goi g "it was good enough there, it's good enough here" and using MD5 where they shouldn't. Removing it from a codebase helps with that problem. The problem here is that people assume they know every possible reason why the auditor might ask for something, when they don't. If the auditor is asking for it, and it costs almost nothing to do, maybe just do it instead of wasting everyone's time by acting like you know the totality on the subject, and everyone will probably go home happier at the end of the day.
- andreareina 6y ago
  Isn't that what code review is for? To me that sounds like arguing against string formatting because someone could think it's ok for SQL queries. An auditor's job doesn't end at saying what things should be changed, it should include why as well (granted, we don't know the full content of the auditor's report here, maybe they did say why).
  - kadoban 6y ago
    Code reviews are good checks. Making it more difficult for dumb ideas to show up in a code review and possibly be missed is also good. If using md5 had any real benefit I'd say leave it, but what are you gaining?
    - hashhar 6y ago
      because CRC is actually worse for checking file content collisions (not that MD5 is perfect either).
      - Reelin 6y ago
        > because CRC is actually worse for checking file content collisions So use SHA-1 or SHA-2 or SHA-3 or if you really hate NIST standards for some reason then CubeHash or Skein or Blake2 or ...
        waheoo 6y ago
        Are you seriously suggesting sha-1 as a good replacement to md5... for security reasons?
        Reelin 6y ago
        Ahh poop, looks like I was out of date. Apparently a practical demonstration of an attack with complexity ~2^60 was recently demonstrated against legacy GPG (the v1.4 defaults) for less than $50k USD. [1] That being said, it looks like it still required ~2 months and ~900 GPUs versus MD5 at 2^18 (less than a second on a single commodity desktop processor). So yeah, I agree, add SHA-1 to the list of algorithms to reflexively avoid for any and all purposes unless you have a _really_ good reason to use it. [1] https://www.schneier.com/blog/archives/2020/01/new_sha-1_attac.html https://www.schneier.com/blog/archives/2020/01/new_sha-1_att...
        skissane 6y ago
        The reason why CRC32C was chosen as a replacement instead of SHA-2 or whatever - what happens if in a few more years, SHA-2 isn’t considered secure any more and some future security audit demands it be changed again? Whereas, a CRC algorithm isn’t usually used for security purposes, so a security audit is far less likely to pay any attention to it. The whole issue started because a security-related technology was used for a non-security purpose.
- raverbashing 6y ago
  The reason they ask is that they have to fill a checkbox that says "no MD5" and of course they're don't know that CRC32 is worse And to be very fair, a lot of security issues would be caught with basic checkbox ticking. Are you using a salted password hashing function instead of storing passwords in plaintext? Are you using a firewall? Do you follow the principles of least privilege?
  - deleted 6y ago
    [deleted]
  - waheoo 6y ago
    Except this is not for password hashing. Why is this so difficult to grasp.
- waheoo 6y ago
  What is this weird incessant need to play devils advocate. Sometimes people are just right.
  - kbenson 6y ago
    Because most times people aren't "just right", they're just unwilling to widen their point of view, and/or they turn the issue into a way to assert their own importance and intellect over someone else at the expense of those they work with. I don't need some coworker getting into some drawn out battle about how MD5 is fine to use when we can just use SHA (or CRC32C as that person did, which is more obviously non-useful for security contexts) and be done in 30 minutes. The auditor is there to do their job, and if what they request is not extremely invasive or problematic for the project, implementing those suggestions is your job, and arguing over pointless things in your job is not a sign of something I want in a coworker or someone I manage.
    - waheoo 6y ago
      > they turn the issue into a way to assert their own importance and intellect over someone else at the expense of those they work with. This is exactly what the auditor is doing. How can you not see the irony here? > I don't need some coworker getting into some drawn out battle This isn't a drawn out battle. This is a really fast one, md5 is fine here, you didn't check the context of its use, thats fine, whats the next item on your list? Whats fucking hard about that? Is this some kind of weird cultural thing with American schooling teaching kids they can't question authority?
      - kbenson 6y ago
        > This is exactly what the auditor is doing. The auditor was asked to do it and is being paid to do it. Presumably, the people arguing are paid to implement the will of those that pay them. At some point people need to stop arguing and do what they're paid to do or quit. Doing this over wanting to use MD5 seems a pretty poor choice of a hill to die on. > This is a really fast one, md5 is fine here, you didn't check the context of its use, thats fine, whats the next item on your list? There are items like this all throughout life. Sure, you can be trusted to drive above the speed limit on this road, and maybe the speed limit is set a little low. But we have laws for a reason, and at some point you letting the officials know that the speed is two low and they really don't need to make it that low goes from helpful to annoying everyone around you. > Whats fucking hard about that? Indeed, what is so hard about just accepting that while you're technically correct that MD5 isn't a problem, you're making yourself a problem when you fight stupid battles nobody but you cares about, but everyone has to deal with? > Is this some kind of weird cultural thing with American schooling teaching kids they can't question authority? Hardly. Pompous blowhards exist in every culture. Also, that's hilarious. Your talking about a culture that rebels against authority just because they think they that's what they're supposed to do, even if it's for stupid reasons and makes no sense. See the tens of millions of us that refuse to wear masks because it "infringes on our freedom".
andreareina 6y ago
Not hard to win if everyone is being reasonable. Given an auditor that thinks all uses of MD5 are proscribed, what would you put the odds of them being reasonable at? ETA: per 'kbenson it's not hard to conceive of a situation where proscribing MD5 is reasonable. Taking 'skissane's account at face value is probably reasonable, but my implicit assumption that the auditor would not explain if pressed isn't being charitable.
- reallydontask 6y ago
  indeed Specially with the audit/pen test theatre where they have to put something in the report, otherwise why are they getting paid £20K for two days work? So most people choose the past of least resistance, when it doesn't matter much, so that you fight where it does.
  - waheoo 6y ago
    Picking your battles is something we all need to learn to do. I for one like to pick the easy wins, like this.
benhurmarcel 6y ago
In a large company you have to choose your battles.
Delk 6y ago
As a technical choice, that's true. So the argument shouldn't be hard to win, assuming you're dealing with reasonable people, who are also answering to reasonable people. Those people (e.g. the leadership) also need to care enough about that detail to just not dismiss your argument because making the change is not a problem for them. And they need to not be so security-oriented (in a naive way) as to consider a "safer" choice always a better one regardless of whether there's a reasonable argument for it or not. That's more assumptions than it is sometimes reasonable to make. "You don’t actually need to listen to auditors" is decidedly not true for a lot of people in a lot of situations, and arguing even for technically valid or reasonable things is an endurance sport in some organizations. I mean, I even kind of want to agree with heavenlyblue's argument that you should fight that fight for the exact reason they're saying, and can see myself arguing the same thing years ago, but at least in case of some organizations, blaming people for taking skissane's stance would be disproportionate.
- waheoo 6y ago
  Oh sorry, I thought we were discussing working with rational people. If you're working with irrational people you're going to have to do irrational things, but that's kind of a given isn't it? We don't really need to discuss that.

BrandoElFollito 6y ago

I do it for the sake of educating our management. For now 10 years, I refuse to acknowledge the finding of the consulting company which flags the password scheme I use (passphrases) because the norm they use (a national one) talks about czps, symbols etc. I refuse to sign off and note that our company is a scientific one and to the difference of the auditors, we understand math taught to 16 yo children. This goes to the board who gets back to me, I still refuse on ethical gtounds and we finally pass. This is sad that some auditors are stupid when some other are fantastic and that you depend on which one you get assigned. A good read: https://serverfault.com/q/293217/78319 https://serverfault.com/q/293217/78319