3 ms·

Consider that a bunch of bad patches[1] introducing vulnerabilities have passed a strict reviewing process and made their way into the Linux kernel. I'd say the

Consider that a bunch of bad patches[1] introducing vulnerabilities have passed a strict reviewing process and made their way into the Linux kernel. I'd say there's a far more simple and effective way: just answer questions on StackOverflow by giving code with vulnerabilities (something that most novices aren't likely to notice) and look for them later in the wild. [1]: https://lore.kernel.org/lkml/YIV+pLR0nt94q0xQ@kroah.com/#r https://lore.kernel.org/lkml/YIV+pLR0nt94q0xQ@kroah.com/#r

bostik 5y ago
Considering StackOverflow rewards speed, and that most common questions fall into category of "how do I make thing X work?" - a good proportion of highly voted answers already come pre-loaded with vulnerabilities. And no, I'm not being snarky. I wish I was.
- _notathrowaway 5y ago
  Please, post some examples.
  - bostik 5y ago
    -cracks knuckles- Coming from Google, top answer to inserting data with python+psycopg2: https://stackoverflow.com/questions/61861310/how-to-use-psycopg2-to-insert-data-into-a-postgres-database https://stackoverflow.com/questions/61861310/how-to-use-psyc... (no bound variables, straight up format string) Same route, this time asking about allowing requests between subdomains: https://stackoverflow.com/questions/11161526/cross-subdomain-requests https://stackoverflow.com/questions/11161526/cross-subdomain... (question specifies they "already use CORS: <star>" and nobody even comments on that) And let's not forget, PHP is still a thing: https://stackoverflow.com/questions/43497587/how-to-display-postgresql-search-results-using-php https://stackoverflow.com/questions/43497587/how-to-display-... (yep, user supplied input goes straight to SQL query string) --- All of the above were results of about 10 seconds of searching. Each one came from the first page of Google results - because let's be honest, that's what almost everyone cares about. To be fair, at least these days I can't find the "just use CORS=<star>" answers. They were bountiful two years ago, but maybe, just maybe, have been flagged as cataclysmically insecure since then. (EDIT: remove asterisks in CORS gripes)

bostik 5y ago

Considering StackOverflow rewards speed, and that most common questions fall into category of "how do I make thing X work?" - a good proportion of highly voted answers already come pre-loaded with vulnerabilities. And no, I'm not being snarky. I wish I was.

_notathrowaway 5y ago
Please, post some examples.
- bostik 5y ago
  -cracks knuckles- Coming from Google, top answer to inserting data with python+psycopg2: https://stackoverflow.com/questions/61861310/how-to-use-psycopg2-to-insert-data-into-a-postgres-database https://stackoverflow.com/questions/61861310/how-to-use-psyc... (no bound variables, straight up format string) Same route, this time asking about allowing requests between subdomains: https://stackoverflow.com/questions/11161526/cross-subdomain-requests https://stackoverflow.com/questions/11161526/cross-subdomain... (question specifies they "already use CORS: <star>" and nobody even comments on that) And let's not forget, PHP is still a thing: https://stackoverflow.com/questions/43497587/how-to-display-postgresql-search-results-using-php https://stackoverflow.com/questions/43497587/how-to-display-... (yep, user supplied input goes straight to SQL query string) --- All of the above were results of about 10 seconds of searching. Each one came from the first page of Google results - because let's be honest, that's what almost everyone cares about. To be fair, at least these days I can't find the "just use CORS=<star>" answers. They were bountiful two years ago, but maybe, just maybe, have been flagged as cataclysmically insecure since then. (EDIT: remove asterisks in CORS gripes)