| 00:00.20 | unum | mgeary: yes he has |
| 00:00.20 | mgeary | it's easy to create an algorithm that *you* cannot decrypt |
| 00:00.20 | unum | and been sued for it :) |
| 00:00.30 | mgeary | heh. didn't see that |
| 00:00.52 | unum | he's been sued a couple of times for calling specific products snake oil |
| 00:00.57 | mgeary | ah |
| 00:01.07 | mgeary | ~schneierfact |
| 00:01.44 | mgeary | "bruce schneier dreams in sha-256 hash codes" |
| 00:03.56 | unum | he always has the best links on his blog |
| 00:04.15 | mgeary | but his squid obsession borders on unhealthy |
| 00:04.29 | mgeary | i mean, i like squid... |
| 00:04.34 | mgeary | ...i just can't eat a whole one |
| 00:05.00 | mgeary | well, one of those lil' suckers, maybe |
| 00:05.11 | unum | ya I can eat several calimaria size ones |
| 00:05.12 | SunSparc | Have a good weekend all!!! |
| 00:05.15 | unum | but not the ones he posts |
| 00:07.46 | fungus | mindjuju: I forgot to mention that in many cases Security by obscurity creates more inconvenience for the users and administrators than the security it provides. |
| 00:08.03 | mgeary | but unum brought that up |
| 00:09.19 | mindjuju | fungus - in the event that it is discovered or is it because the application is flawed, or both? |
| 00:09.40 | mgeary | no, because you're making someone use nonstandard methods to do common tasks |
| 00:09.53 | mgeary | like running ssh over port 12345 |
| 00:10.01 | fungus | exactly |
| 00:10.01 | mindjuju | oh gotcha |
| 00:10.08 | mindjuju | k, that makes sense |
| 00:10.29 | fungus | Or blocking pings in your firewall. |
| 00:10.50 | mgeary | ooh, yeah, that one's annoying |
| 00:10.53 | fungus | Sure nobody can ping you or traceroute to you, but neither can you. |
| 00:10.59 | mgeary | "is our server down? Gee, i dunno" |
| 00:12.03 | mindjuju | heh |
| 00:12.34 | mgeary | however, one thing that's technically security by obscurity, but is pretty cool, imo, is port knocking |
| 00:12.47 | mgeary | i've never managed to get it set up, but i'd like to some day |
| 00:12.58 | mindjuju | yeah, dataw0lf presented on that a long time ago at #uphpu |
| 00:13.06 | mgeary | cool |
| 00:13.07 | mindjuju | i might still have the notes on that somewhere |
| 00:14.42 | fungus | port knocking is actually a mix of obscurity and authentication. |
| 00:14.56 | mgeary | yeah, i could go with that |
| 00:14.57 | fungus | Depending on the implementation. |
| 00:16.05 | PoeticIntensity | ok.... I just finished reading the backlogs on this conversation... |
| 00:16.08 | PoeticIntensity | and I have a question. |
| 00:16.37 | mgeary | ~congratulate PoeticIntensity |
| 00:16.37 | jbot | ACTION congratulates PoeticIntensity on being a new owner of a $500 brick. |
| 00:16.37 | PoeticIntensity | One of the things I like about coding stuff myself (even if it isn't as featureful), is the whole "security through obscurity" thing... |
| 00:16.47 | PoeticIntensity | and I'm now wondering if it's even classified as such. |
| 00:16.53 | PoeticIntensity | I don't know... |
| 00:17.05 | mgeary | well, what kind of "security" are you talking about? |
| 00:17.10 | PoeticIntensity | I used wordpress for a little less than a year, when I just got fed up with it and decided to write my own blogging software. |
| 00:17.31 | PoeticIntensity | didn't take me long, and I feel it's more secure (even if that feeling is bogus)... |
| 00:17.36 | PoeticIntensity | primarily because of two things: |
| 00:17.49 | PoeticIntensity | 1. I wrote the code, and am confident it's as secure as it needs to be... |
| 00:18.01 | mgeary | 1) there aren't a million bots scanning for known exploits in your code |
| 00:18.01 | PoeticIntensity | and 2. it's only used in 1 place on the entire Internet... |
| 00:18.09 | PoeticIntensity | thus making it.... yes... precisely, mgeary |
| 00:18.23 | mgeary | well, again sec. by obsc. isn't *bad* |
| 00:18.26 | PoeticIntensity | is that..... sec. by obsc.? |
| 00:18.32 | PoeticIntensity | no.... I know that. |
| 00:18.35 | fungus | That does help. and that could be thought of as an obscurity tactic. |
| 00:18.35 | PoeticIntensity | and agree 100%... |
| 00:18.51 | PoeticIntensity | I'm wondering if it's even in the same class as what you guys are talking about.. |
| 00:18.59 | mindjuju | but not true security by obscurity though, methinks |
| 00:19.02 | mgeary | well, it's a broad and fuzzy spectrum |
| 00:19.07 | PoeticIntensity | yeah |
| 00:19.15 | mindjuju | casue the code is secure |
| 00:19.27 | PoeticIntensity | If I had written the code to be used without a password..... |
| 00:19.29 | PoeticIntensity | and it needed one... |
| 00:19.40 | PoeticIntensity | and depended just on the fact that it's a less-known URL / etc.... |
| 00:19.41 | fungus | It's partially related. Your actual security is the important part. The custom code being less well known is an "obscurity" factor that is a side benefit. |
| 00:19.48 | PoeticIntensity | then I'd be depending on its obscurity... |
| 00:19.50 | PoeticIntensity | and that would suck. |
| 00:20.05 | PoeticIntensity | fungus, that's what I thought. |
| 00:20.16 | mgeary | i believe one precept is that if someone else had access to your source code, but still couldn't compromise your system, then you've avoided sec. by obsec. |
| 00:20.22 | PoeticIntensity | we should have a security-related UPHPU meeting... |
| 00:20.27 | PoeticIntensity | we need to get Joshua up here. |
| 00:20.33 | mgeary | because, you know, you're using authentication-- another security layer |
| 00:20.49 | PoeticIntensity | right. |
| 00:20.50 | PoeticIntensity | yes. |
| 00:20.54 | mindjuju | that would be cool poeticintensity |
| 00:21.00 | PoeticIntensity | yeah.... |
| 00:21.10 | PoeticIntensity | I'm very interested in web dev security practices.... |
| 00:21.20 | PoeticIntensity | but everything I've read is relatively elementary... |
| 00:21.42 | PoeticIntensity | as far as securing a PHP-based site. |
| 00:22.10 | PoeticIntensity | something else I'm interested in learning about is XSS hacks / prevention.. |
| 00:22.51 | fungus | XSS prevention is easy... Just strip, and sanitize all input from users. |
| 00:23.07 | PoeticIntensity | isn't that ..... normal....? |
| 00:23.13 | fungus | lol |
| 00:23.17 | fungus | for real devs |
| 00:23.23 | PoeticIntensity | make sure the content is precisely what you're expecting, and nothing more? |
| 00:23.24 | mgeary | i believe you can completely prevent XSS just by stripping <script...> from user input |
| 00:23.38 | mgeary | don't think you can do XSS w/o javascript |
| 00:23.40 | PoeticIntensity | easy enough. |
| 00:24.05 | fungus | When sanitizing you should filter input through a whitelist of good stuff, and strip out the rest. |
| 00:24.26 | PoeticIntensity | that's a bit extreme, fungus.... |
| 00:24.29 | PoeticIntensity | what about usernames? |
| 00:24.36 | PoeticIntensity | blog posts... |
| 00:24.36 | fungus | Otherwise bad people will find ways around your blacklisting. |
| 00:24.50 | fungus | usernames are easy. |
| 00:24.57 | PoeticIntensity | it'd be fairly impossible to create a whitelist of stuff people could post to a blog. |
| 00:25.01 | PoeticIntensity | unless I'm missing something... |
| 00:25.04 | fungus | blog posts are a lot harder |
| 00:25.25 | fungus | whitelist of characters for usernames |
| 00:25.30 | PoeticIntensity | I see. |
| 00:25.46 | fungus | match /[a-zA-Z0-9_-]+/ should be close to good enough |
| 00:26.13 | fungus | input from users intended to be formatted and re-displayed is a lot harder. |
| 00:26.34 | fungus | that is why many forums use BBCode |
| 00:26.41 | PoeticIntensity | right. |
| 00:27.17 | PoeticIntensity | strip_tags is a great function.. |
| 00:27.27 | PoeticIntensity | creates a whitelist for acceptable tags... |
| 00:27.28 | fungus | You need to create a whitelist of HTML tags you will accept, and strip the rest. |
| 00:27.36 | fungus | lol, yeah |
| 00:27.57 | mindjuju | mgeary not true |
| 00:28.04 | PoeticIntensity | not sure if they could use the attributes (style / onClick) within the accepted tags to do any harm, though. |
| 00:28.06 | mindjuju | events can be added to any HTML tag |
| 00:28.45 | fungus | Maybe you should write a custom strip_tags if your site is going to be accepting content from anyone. |
| 00:28.54 | PoeticIntensity | true, true... |
| 00:28.56 | mgeary | mindjuju: good point |
| 00:28.57 | fungus | keep your HTML tag list very strict. |
| 00:29.10 | PoeticIntensity | yup. |
| 00:29.35 | PoeticIntensity | sometimes I also wonder where the paranoia level sits.... |
| 00:29.40 | fungus | http://www.codinghorror.com/blog/archives/001181.html |
| 00:29.46 | PoeticIntensity | heh... I love that site. |
| 00:29.48 | mgeary | PoeticIntensity: you could do: "<span onclick='document.forms[0].action=\"mysite.com\'"> |
| 00:30.05 | PoeticIntensity | I don't allow spans... |
| 00:30.09 | PoeticIntensity | but you're right. |
| 00:30.18 | fungus | That's an example that explains why writing careful custom validation is important in some venues. |
| 00:30.54 | fungus | IMHO, for blog comments, only allow a few HTML tags, and strip all attributes. |
| 00:31.09 | mindjuju | there are also sploits in style that IE is vulnerable to |
| 00:31.11 | fungus | the few you allow might be: p, b, i, br, etc |
| 00:31.23 | PoeticIntensity | right. |
| 00:31.25 | PoeticIntensity | hmm.... |
| 00:31.32 | PoeticIntensity | is there a PHP function that strips attributes? |
| 00:32.15 | mindjuju | fungus has an ideology that he should prolly speak on |
| 00:32.26 | mindjuju | don't strip out all the bad, filter in the good |
| 00:32.39 | PoeticIntensity | well... |
| 00:32.42 | mindjuju | his case being, you can never strip out everything |
| 00:32.42 | PoeticIntensity | that's what I'm doing. |
| 00:32.52 | PoeticIntensity | I'm stripping all tags, but allowing a few. |
| 00:33.02 | fungus | exactly. It's impossible to enumerate all the bad in the world, but specifying the good is easy. |
| 00:33.08 | PoeticIntensity | but on those few, I want *no* attributes at all.... |
| 00:33.20 | PoeticIntensity | oh.... I thought that was pointed at me... |
| 00:33.25 | PoeticIntensity | fungus is dead-on, IMO. |
| 00:34.02 | fungus | s/(<[a-z]+)\s+[^>]+>/\1>/ |
| 00:34.15 | fungus | that should be pretty close to stripping all attributes |
| 00:34.15 | PoeticIntensity | hmmm... doesn't look like there's a function.... except the one fungus just wrote. :) |
| 00:34.32 | mindjuju | ~fungus++ |
| 00:34.36 | mindjuju | ~mgeary++ |
| 00:34.41 | mgeary | whew |
| 00:34.45 | mgeary | ~karma mgeary |
| 00:34.45 | jbot | mgeary has karma of 12 |
| 00:35.00 | mgeary | man that's burnin' a hole in my pocket |
| 00:35.04 | mgeary | gotta go spend some o' that |
| 00:36.24 | PoeticIntensity | I think I'm gonna spend some time trying to hack my site.... |
| 00:36.29 | PoeticIntensity | good points brought up in this discussion. |
| 00:36.33 | PoeticIntensity | I'm outta here! |
| 00:36.37 | PoeticIntensity | have a good weekend, ya'll! |
| 00:36.51 | mgeary | likewise |
| 00:36.52 | *** part/#uphpu mgeary (n=mgeary@166.70.44.49) |
| 04:07.40 | *** join/#uphpu beandog (n=sdibb@gentoo/developer/beandog) |
| 04:07.41 | *** mode/#UPHPU [+v beandog] by ChanServ |
| 04:08.56 | beandog | the pain! |
| 04:09.32 | *** join/#uphpu brasto (n=brasto@slcl007.digis.net) |
| 04:09.32 | *** mode/#UPHPU [+v brasto] by ChanServ |
| 05:15.37 | *** join/#uphpu mrkrow (n=chad@c-76-27-25-249.hsd1.ut.comcast.net) |
| 05:15.37 | *** mode/#UPHPU [+v mrkrow] by ChanServ |
| 07:52.57 | *** join/#uphpu carmony_ (n=justinca@c-67-164-249-224.hsd1.ut.comcast.net) |
| 07:54.55 | carmony_ | any night lurkers? |
| 09:06.36 | *** part/#uphpu brasto (n=brasto@slcl007.digis.net) |
| 11:14.47 | *** join/#uphpu mindjuju1 (n=mindjuju@76.8.222.130) |
| 14:45.09 | *** join/#uphpu jnbek (n=jnbek@unaffiliated/jnbek) |
| 14:46.23 | *** join/#uphpu jnbek (n=jnbek@unaffiliated/jnbek) |
| 18:52.20 | *** join/#uphpu carmony_ (n=justinca@c-67-164-249-224.hsd1.ut.comcast.net) |
| 19:12.14 | carmony_ | sup |