Amen. All these people who parrot, "Don't roll you own crypto" need to get out of the math/programming kitchen and go get a crypto burger from some national fast food joint.
My advice would be don't roll your own primitives, but other than that, have at it.
Often times, the hack is through a web front-end. Back-end systems (such as DBs) are heavily firewalled, logged, monitored, etc. and are generally very well protected. Systems guys (OS and DB) know security pretty well and have been doing it for a long time now.
Much of the web software that powers the front-end is complex (PHP, Java, .Net, JS, CSS, SQL, includes, 3rd-party libraries from everywhere, etc). That complexity has a broad attack surface that is difficult and time consuming to test. And many devs are late to the security party (unless we're talking OpenBSD developers).
Management wants to push out new features by X date. Devs have very little time to test and are behind on security anyway. Hackers have all the time in the world to poke at the web front-end and test every possible combination of things until they finally get in.
In a nut-shell, that's the problem as I've seen it.
We use SHA1_Pass. It does not store password data. It generates passwords as needed. The info required to generate the passwords is stored on our internal wiki. The secret sentence is only in our heads and never stored or written down anywhere and when an employee leaves, we change the secret sentence. Here is an example map.
Very inspiring. I have no interest in start-ups and that sort of thing, but I do admire your intestinal fortitude. You hung in there and did it. And really that's all life is about.
This is the same reason I re-wrote a lot of my Python code in C++ many years ago. Distributing one self-contained, statically linked executable just works and even the most clueless user can download and run it.
But I still use a lot of Python and I'm sure this guy still uses a lot of Ruby. Everything has its place.
Very well said. There is no one perfect programming language, no one perfect algorithm and no one perfect data structure for all problems and constraints you will face as a CS practitioner.
Really, a CS education is just preparing you to pick the right solution for the problem/constraints at hand. For example, you can loop through a list. That approach works fine. However, when you begin to scale, you may find that look-ups against a tree-based data structure or perhaps a hash table are much more time efficient at the cost of more complexity, more space and more educated programmers.
Great read. This sentence sums it up best I think, "Why, why, why would people expect to get great results if they flaunt all the best-practices that have developed over the past 20 years?"
The world is all about trivialities today and escapism (let's not face reality). Especially in the West. Young men and women (in general) don't really mature until their mid 30s and some never do.
We have an entire generation of people distracted every 30 seconds by fart apps, juvenile videos and self-photos in the bathroom. We need more engineers, doctors and lawyers and serious thinkers.
Maybe I'm just getting older, but that's my honest opinion.
Law Enforcement is a very tight knit community. They trust each other and that trust builds over the years. They are almost like a family. And apparently, this is their go to guy for gang codes.
Security through obscurity is useless. I have heard people repeat this for the last 20 years. They are wrong and they have no idea what they are talking about. They just parrot what others say. Like chaos it perpetuates itself.
We camouflage tanks. We build stealth fighters. If obscurity had zero value, we'd just paint the tanks bright pink with hot orange flames and drop all the stealth research too. No need to sneak around. Obscurity is useless right?
Hide from the bear and it might not find and eat you. Move your ssh port and your logs will have less idiots out there filling them up. That fact alone is worth changing ports.
Obscurity has its place along side other tactics. And when you put it all together, you'll have a more secure system.
So please cut the "Security through obscurity" crap.
There are large working Python 2 code bases in a lot of organizations. It works great. Fabulously reliable. Extremely well-tested. Been running great for years. They have no desire or need to upgrade and will run Python 2 and pay devs to maintain it forever.
False positives are the life of security. Microsoft Updates (update.microsoft.com) was just blacklisted by malwaredomains this week. It happens. Algorithms are not humans.
My advice would be don't roll your own primitives, but other than that, have at it.