Viewing profile — ircmaxell

True, but in this case if you can write an invalid hash into a database, you can likewise write a valid one, and as such this doesn't really enable anything. The one thing this doe…

Heck, a very popular Java book (Android programming specifically) has examples of database queries using concatenation (and hence SQLi).

Except that in PHP type declaration mismatches are actually errors... They aren't just "documentation" to be used by static analyzers.

> PHP. This is a known weakness in PHP's bcrypt implementation. From Wikipedia, "Many implementations of bcrypt truncate the password to the first 72 bytes." I would hope that they…

The only implementations of bcrypt (and crypt(3)) that I've seen that's NOT vulnerable to this are Golang and Python. It has nothing to do with PHP...

> I would recommend that the author read up on NFAs and DFAs -- they are a formalism better suited to lexers than tries. Author here. The actual regex implementation uses a NFA. Th…

Well, let's look at it realistically: http://arstechnica.com/security/2015/01/yes-123456-is-the-mo... The #1 password out of 3.3 million was 123456, which was used 20,000 times. So…

Well, let's imagine an attack scenario. As an attacker, I get SQL access to your DB (meaning no access to the encryption key). I then download the user names, and the hashes. I the…

> A properly implemented, simple pepper can only help password security and can't hurt it. Well, yes. But what is the definition of "properly"? There are definitely constructions o…

We looked into using it. After much thought, we decided not to, here's why: https://wiki.php.net/rfc/scalar_type_hints_v5#why_not_use_us... I break down all of the proposed alterna…

> Having the caller do it seems quite pointless when the recipient is anyway doing it. Actually, I disagree. The caller is the only one who has semantic information about what the …

> You don't hire 10x just people who make other people 10x? Then that person you just hired is 10x. The point was more that I value a person's ability to lift those around them muc…

I don't hire nor value 10x engineers. So no problem there. I hire and value engineers that elevate those around them to 10x. And this behavior lowers people, not elevates. So no, t…

> If PHP is the slowest part of your application, you're probably in good shape. Or doing something epicly wrong. One of the two...

Actually, the PECL compiler he mentions generates C, and then compiles it using GCC with -O3. So in a way, yes it is measuring the speed of a C program. Not a hand-optimized one, b…

Why did we tolerate it? Because we weren't given the tools to do anything about it. We couldn't kick or ban people. We couldn't moderate our own room. All we (as owners) could do w…

That's definitely valid. However, in the vast majority of cases where someone complains about CV-PLS in my experience, it's because they had their question closed. For example: htt…

That's absolutely a valid experience. There are plenty of others who've had positive experiences as well. And those "caustic individuals" have a LOT to share if you're willing to e…

How do you solve the torrent of duplicates and low quality questions then? The review queue is backed up all the time (currently 11900 questions with 1+ close-vote). Ignoring the p…

This has been discussed time and time again: - http://meta.stackoverflow.com/q/256501/338665 - http://meta.stackoverflow.com/q/271899/338665 - http://meta.stackoverflow.com/q/27809…

> Something seems horribly wrong here, no? Yes. The distributions are effectively forking these versions, and keeping the same version numbers. Leading to some REALLY awkward probl…

I counted any point release since the latest security release as secure. So for PHP's 5.6 line, only 5.6.4 is secure, since 5.6.4 is a security release. I'm currently crunching num…

Well, it won't idle if there is another process ready to execute (load is greater than 1). If there is no process wanting to execute, it will idle. Again, I'm not saying this is pr…

So, I tried this in the past. The problem you'll run into with PHP specifically is that reading an undefined string offset (past the end) will result in a notice: http://3v4l.org/n…

The far better approach is to just make the operations not depend on the secret. You only really need to worry about timing attacks for values that the attacker doesn't know, and y…