35 ms·

Why not just store each user's information in a file whose name is based on HMAC(some secret, user's account number)? That should be secure against enumeration

by wtbob 12y ago

Why not just store each user's information in a file whose name is based on HMAC(some secret, user's account number)? That should be secure against enumeration attacks.

cperciva 12y ago
That would also work (once they fixed the directory index issue). But their code was written in PHP, so I didn't think it was worth trying to explain that option to them.
- sarciszewski 12y ago
  Yeah, because all PHP programmers are idiots right? :(
  - cperciva 12y ago
    Let's just say that there's a strong correlation. ;-) EDIT: To elaborate: I'm definitely not saying that all PHP developers are idiots. But PHP is a much easier language to learn than many others, so it gains a lot of users at the low end of the ability spectrum. There are just as many talented and security-aware Windows users as there are talented and security-aware Debian users, but there are far more untalented and security-unaware Windows users.
    - sarciszewski 12y ago
      --$respect['cperciva']; The implication in your word choice came across as unfair and elitist. > EDIT: To elaborate: I'm definitely not saying that all PHP developers are idiots. But PHP is a much easier language to learn than many others, so it gains a lot of users at the low end of the ability spectrum. There are just as many talented and security-aware Windows users as there are talented and security-aware Debian users, but there are far more untalented and security-unaware Windows users. Okay, that's a fair statement. I thought you were calling ME an idiot :P
      - cperciva 12y ago
        I thought you were calling ME an idiot Not at all. Until now I didn't realize you were a PHP developer.
    - mikegioia 12y ago
      I can't believe I have to say this to you, but suggesting there's a "strong correlation" between PHP developers and idiots is a complete insult. It's actually bigotry in action. To further suggest you held back a better solution because you assumed the PHP developer was too stupid to understand file hashing is both another insult and bad practice. It doesn't matter if there's 10 or 10 million PHP developers, it's still insulting. You sell a product online, and you've now alienated a large developer community. I'll never recommend or sign up for tarsnap now.
      - cperciva 12y ago
        To further suggest you held back a better solution because you assumed the PHP developer was too stupid to understand file hashing is both another insult and bad practice. It wasn't a better solution. It was one of many alternatives which came to mind; but I offered them the best solution (serve the graphs from a PHP script) and the easiest solution (run a cron job to delete the old graphs).
      - SamReidHughes 12y ago
        Using PHP is a choice, it's not innate. You are not defined by the programming language you choose to be.
    - thaumaturgy 12y ago
      I'm a PHP programmer too. I've also been a C, C++, Pascal, WFL, COBOL74, 68k assembly, etc. etc. etc. programmer for the last 30ish years (and paid off and on for it for almost 20 now, by all kinds of different places). I also founded a local developer group, and I certainly wasn't the least knowledgeable guy there when it comes to application security. I get that you didn't intend it as an insult, and you probably didn't have people like me in mind when you made that comment. However, the relatively recent "PHP programmers are stupid" thing has so turned me off to any kind of programming discussion that I now habitually avoid any discussion of programming at all -- for the first time in all my years as a programmer.
      - mikegioia 12y ago
        Thank you! I just sent a long email to the HN moderators about this very issue. This pervasive anti-PHP mentality is rampant and actively discourages me (and other PHP devs) from contributing.
  - derefr 12y ago
    No, it's rather that all idiots are PHP programmers; or rather, that PHP attracts idiots. You can certainly be a non-idiotic PHP programmer, and there may certainly be just as many good PHP programmers as there are good programmers for any other language. But you, and they, are outnumbered by the bad "this is my first language and first project" programmers, who tend to adopt PHP for that purpose. and because of that, if you know nothing else about a programmer, knowing that they primarily program in PHP should tend to be Bayesian evidence against their programming skill/experience, just like knowing someone lives in India should tend to be Bayesian evidence against the likelihood of them being wealthy, or knowing someone likes {pop, classic rock, modern country} music should be Bayesian evidence against the diversity of their taste in music. It's not that there aren't tons of counterexamples; it's that there's this one huge overlapping subgroup that happens to have that property, and dominates any statistical effects. (Respectively, "people learning their first language"; "people born in poverty with no way out"; and "people who only listen to music provided by their single local radio station.") Of course, if some other language were easier to learn than PHP, the dominating subgroup of "people who know 0.5 programming languages" would become attached to that language instead of PHP. So the fact that this group is attached to PHP is actually a point in favour of PHP as a platform. It's still a point against its statistical median user.
    - rwallace 12y ago
      On the one hand, there is truth in what you say about the statistics. On the other hand, treating individuals as though they were statistics tends to be boorish and obnoxious behavior. If you were running a forum for discussing sports cars, for example, you probably wouldn't consider it acceptable to say 'Indians are not welcome on this site, they haven't got any money so they wouldn't know anything about sports cars'. Similarly, if you encounter a bad programmer who uses PHP, it's fine to criticize him for being a bad programmer. It's not okay to insult PHP programmers in general.
- mikegioia 12y ago
  What an asshole comment. Edit: to the downvoters, can you please explain how it's acceptable to correlate PHP developers and idiots?
  - cperciva 12y ago
    You may think that I was wrong in my belief, but my comment was just answering a question I was asked.
  - SamReidHughes 12y ago
    Why are PHP developers so defensive?
    - mikegioia 12y ago
      It's like you don't even know you're doing it. I, Mike Gioia, am defensive. Not "PHP developers". Would you not be defensive if you were called an idiot because of the language you choose to program in? Every time PHP comes up in these forums someone makes a smart-ass comment about how PHP developers are somehow lesser. THAT is why I get defensive, because of how celebrated and rampant it is here to treat PHP developers like complete shit. Your account is just as old as mine and while I don't know how active you are on PHP-related threads, it's something I see time and time again here. It's a cancer in this community and when you see it and hear it as much as I do it becomes a serious burden. No other group of programmers is stigmatized like PHP devs are for seemingly no other reason than how many bad ones there are. Yes there are bad PHP developers, but the blanket dismissal is, in fact, bigotry!
      - yourad_io 12y ago
        > No other group of programmers is stigmatized like PHP devs are for seemingly no other reason than how many bad ones there are. Yes there are bad PHP developers, but the blanket dismissal is, in fact, bigotry! Woah. Deep breath. PHP is a legitimate tool. Great for some things. Less great for others. Knowing how to use a tool can't make you an idiot, or bad at what you do. If you only know how to use one tool, you're likely bad at your job, and/or the n00b that we're talking about as the butt of the "PHP developer" joke: The guy who implements something by following a tutorial and modifying small bits, until he gets used to the language. Except, guess what - we're all "that guy" when we're in a new language. We start at README.md, a.k.a. step 1. We're making fun of ourselves when we first tried to do $x in $y without realizing that (naturally!! dumb noob!) in $y you actually do $x via $asdf. And even further back, when we started out with.. BASIC? PHP? Something inviting. Come to think about it... A lot of really good developers, who later may have transitioned to other languages, have probably started out with PHP. But I digress. I've always thought that the php-devs-are-bad joke is just a more instantiated version of $noobs-are-bad. I identify as a PHP developer. I owe PHP. I've worked with PHP extensively and would implement in it again, if and when it were appropriate. I don't get mad at PHP dev jokes. If I'm called a bad developer because I know a language more than them (and not a joke to lighten the mood or something), then the wielder of the argument is truly the idiot[1]. You may as well be saying "long division is retarded" because you just do it on the iPhone, man, or "French Speakers are idiots". PS: This is my read on it. I try to live by an expanded Hanlon's razor ("Never attribute to malice that which is adequately explained by... $x") and also happen to believe that when you get upset/offended over trivialities, you "give power away". Being overly sensitive only ends up hurting yourself. [1] And you have to wonder - does he even know that the hammer can also remove nails?
perlgeek 12y ago
It's a good idea, but if you do that properly, you should have a system in place rotate the secret, and if shell scripts work with those graph files, they might also need access to both the hashing function and the secret. I wonder if instead one could use mod_rewrite (assuming Apache), and check the URL against %{REMOTE_USER}.
- wtbob 12y ago
  I'm not certain why one would want to rotate the secret on a regular basis; it'd only need to be changed in case of exposure. A truly robust system would have a way to easily say 'rotate the secret' rather than have to manually change it. Basically, it's a poor man's capability system: once one has a URL to one's graphs, one can easily share them around, but if one doesn't have the URL and doesn't have the secret, one cannot determine the URL, thanks to the power of a decent hash function in the HMAC.

by wtbob 12y ago

Why not just store each user's information in a file whose name is based on HMAC(some secret, user's account number)? That should be secure against enumeration attacks.

cperciva 12y ago

That would also work (once they fixed the directory index issue). But their code was written in PHP, so I didn't think it was worth trying to explain that option to them.

sarciszewski 12y ago
Yeah, because all PHP programmers are idiots right? :(
- cperciva 12y ago
  Let's just say that there's a strong correlation. ;-) EDIT: To elaborate: I'm definitely not saying that all PHP developers are idiots. But PHP is a much easier language to learn than many others, so it gains a lot of users at the low end of the ability spectrum. There are just as many talented and security-aware Windows users as there are talented and security-aware Debian users, but there are far more untalented and security-unaware Windows users.
  - sarciszewski 12y ago
    --$respect['cperciva']; The implication in your word choice came across as unfair and elitist. > EDIT: To elaborate: I'm definitely not saying that all PHP developers are idiots. But PHP is a much easier language to learn than many others, so it gains a lot of users at the low end of the ability spectrum. There are just as many talented and security-aware Windows users as there are talented and security-aware Debian users, but there are far more untalented and security-unaware Windows users. Okay, that's a fair statement. I thought you were calling ME an idiot :P
    - cperciva 12y ago
      I thought you were calling ME an idiot Not at all. Until now I didn't realize you were a PHP developer.
  - mikegioia 12y ago
    I can't believe I have to say this to you, but suggesting there's a "strong correlation" between PHP developers and idiots is a complete insult. It's actually bigotry in action. To further suggest you held back a better solution because you assumed the PHP developer was too stupid to understand file hashing is both another insult and bad practice. It doesn't matter if there's 10 or 10 million PHP developers, it's still insulting. You sell a product online, and you've now alienated a large developer community. I'll never recommend or sign up for tarsnap now.
    - cperciva 12y ago
      To further suggest you held back a better solution because you assumed the PHP developer was too stupid to understand file hashing is both another insult and bad practice. It wasn't a better solution. It was one of many alternatives which came to mind; but I offered them the best solution (serve the graphs from a PHP script) and the easiest solution (run a cron job to delete the old graphs).
    - SamReidHughes 12y ago
      Using PHP is a choice, it's not innate. You are not defined by the programming language you choose to be.
  - thaumaturgy 12y ago
    I'm a PHP programmer too. I've also been a C, C++, Pascal, WFL, COBOL74, 68k assembly, etc. etc. etc. programmer for the last 30ish years (and paid off and on for it for almost 20 now, by all kinds of different places). I also founded a local developer group, and I certainly wasn't the least knowledgeable guy there when it comes to application security. I get that you didn't intend it as an insult, and you probably didn't have people like me in mind when you made that comment. However, the relatively recent "PHP programmers are stupid" thing has so turned me off to any kind of programming discussion that I now habitually avoid any discussion of programming at all -- for the first time in all my years as a programmer.
    - mikegioia 12y ago
      Thank you! I just sent a long email to the HN moderators about this very issue. This pervasive anti-PHP mentality is rampant and actively discourages me (and other PHP devs) from contributing.
- derefr 12y ago
  No, it's rather that all idiots are PHP programmers; or rather, that PHP attracts idiots. You can certainly be a non-idiotic PHP programmer, and there may certainly be just as many good PHP programmers as there are good programmers for any other language. But you, and they, are outnumbered by the bad "this is my first language and first project" programmers, who tend to adopt PHP for that purpose. and because of that, if you know nothing else about a programmer, knowing that they primarily program in PHP should tend to be Bayesian evidence against their programming skill/experience, just like knowing someone lives in India should tend to be Bayesian evidence against the likelihood of them being wealthy, or knowing someone likes {pop, classic rock, modern country} music should be Bayesian evidence against the diversity of their taste in music. It's not that there aren't tons of counterexamples; it's that there's this one huge overlapping subgroup that happens to have that property, and dominates any statistical effects. (Respectively, "people learning their first language"; "people born in poverty with no way out"; and "people who only listen to music provided by their single local radio station.") Of course, if some other language were easier to learn than PHP, the dominating subgroup of "people who know 0.5 programming languages" would become attached to that language instead of PHP. So the fact that this group is attached to PHP is actually a point in favour of PHP as a platform. It's still a point against its statistical median user.
  - rwallace 12y ago
    On the one hand, there is truth in what you say about the statistics. On the other hand, treating individuals as though they were statistics tends to be boorish and obnoxious behavior. If you were running a forum for discussing sports cars, for example, you probably wouldn't consider it acceptable to say 'Indians are not welcome on this site, they haven't got any money so they wouldn't know anything about sports cars'. Similarly, if you encounter a bad programmer who uses PHP, it's fine to criticize him for being a bad programmer. It's not okay to insult PHP programmers in general.
mikegioia 12y ago
What an asshole comment. Edit: to the downvoters, can you please explain how it's acceptable to correlate PHP developers and idiots?
- cperciva 12y ago
  You may think that I was wrong in my belief, but my comment was just answering a question I was asked.
- SamReidHughes 12y ago
  Why are PHP developers so defensive?
  - mikegioia 12y ago
    It's like you don't even know you're doing it. I, Mike Gioia, am defensive. Not "PHP developers". Would you not be defensive if you were called an idiot because of the language you choose to program in? Every time PHP comes up in these forums someone makes a smart-ass comment about how PHP developers are somehow lesser. THAT is why I get defensive, because of how celebrated and rampant it is here to treat PHP developers like complete shit. Your account is just as old as mine and while I don't know how active you are on PHP-related threads, it's something I see time and time again here. It's a cancer in this community and when you see it and hear it as much as I do it becomes a serious burden. No other group of programmers is stigmatized like PHP devs are for seemingly no other reason than how many bad ones there are. Yes there are bad PHP developers, but the blanket dismissal is, in fact, bigotry!
    - yourad_io 12y ago
      > No other group of programmers is stigmatized like PHP devs are for seemingly no other reason than how many bad ones there are. Yes there are bad PHP developers, but the blanket dismissal is, in fact, bigotry! Woah. Deep breath. PHP is a legitimate tool. Great for some things. Less great for others. Knowing how to use a tool can't make you an idiot, or bad at what you do. If you only know how to use one tool, you're likely bad at your job, and/or the n00b that we're talking about as the butt of the "PHP developer" joke: The guy who implements something by following a tutorial and modifying small bits, until he gets used to the language. Except, guess what - we're all "that guy" when we're in a new language. We start at README.md, a.k.a. step 1. We're making fun of ourselves when we first tried to do $x in $y without realizing that (naturally!! dumb noob!) in $y you actually do $x via $asdf. And even further back, when we started out with.. BASIC? PHP? Something inviting. Come to think about it... A lot of really good developers, who later may have transitioned to other languages, have probably started out with PHP. But I digress. I've always thought that the php-devs-are-bad joke is just a more instantiated version of $noobs-are-bad. I identify as a PHP developer. I owe PHP. I've worked with PHP extensively and would implement in it again, if and when it were appropriate. I don't get mad at PHP dev jokes. If I'm called a bad developer because I know a language more than them (and not a joke to lighten the mood or something), then the wielder of the argument is truly the idiot[1]. You may as well be saying "long division is retarded" because you just do it on the iPhone, man, or "French Speakers are idiots". PS: This is my read on it. I try to live by an expanded Hanlon's razor ("Never attribute to malice that which is adequately explained by... $x") and also happen to believe that when you get upset/offended over trivialities, you "give power away". Being overly sensitive only ends up hurting yourself. [1] And you have to wonder - does he even know that the hammer can also remove nails?

perlgeek 12y ago

It's a good idea, but if you do that properly, you should have a system in place rotate the secret, and if shell scripts work with those graph files, they might also need access to both the hashing function and the secret. I wonder if instead one could use mod_rewrite (assuming Apache), and check the URL against %{REMOTE_USER}.

wtbob 12y ago
I'm not certain why one would want to rotate the secret on a regular basis; it'd only need to be changed in case of exposure. A truly robust system would have a way to easily say 'rotate the secret' rather than have to manually change it. Basically, it's a poor man's capability system: once one has a URL to one's graphs, one can easily share them around, but if one doesn't have the URL and doesn't have the secret, one cannot determine the URL, thanks to the power of a decent hash function in the HMAC.