Wow, those are some pretty amateur mistakes. Just taking whatever data you got from the user with no checks? Really? And that's not something you fix later. That should stick out like a sore thumb the moment you write it, making you check that user == logged_in_user before you even move on. Wow.
Security Lessons Learned From The Diaspora Launch
51–60 of 142 posts
Re: Security Lessons Learned From The Diaspora Launch
#52[deleted]
Hire a coder from any of the outsourcing places. I hate to plug a specific link - really I do, but truth be told people can be found to do a job like that for $5.
Re: Security Lessons Learned From The Diaspora Launch
#53Excellent article. I can see why under the kind of time pressure they have been under there would be issues like these.
Interesting I was thinking in comparison to PHP where a beginner would much more likely be individually assigning each input into a SQL statement. Sure there are all kind of possibilities that can go wrong there to but mass assignment looks like it makes it so easy for someone to shoot themselves in the foot.
Re: Security Lessons Learned From The Diaspora Launch
#54"NoSQL Doesn’t Mean No SQL Injection" I lol'd. Mind if I use that? MongoDB is harder to secure and filter because you have all of Javascript to worry about, rather than just SQL (and where most servers can escape arguments themselves through prepared statements etc.). SQL databases are also well understood (for eg. in MS-SQL I can stop the remainder of the statement from executing with '--'). MongoDB with its JS engi…
Similarly: "...secret squirrel double-plus alpha unrelease..." Mind if I use that? It would be a terrific title for an animal fighting game I've been itching to make.
It's a snowclone of a line from Animal House.
Re: Security Lessons Learned From The Diaspora Launch
#55"For example, if you were logged in to a Diaspora seed and knew the ID of any photo on the server, changing the URL of any destroy action from the ID of a photo you own to an ID of any other photo would let you delete that second photo." When I was working as a pen tester I would completely scold developers for letting this happen - telling them that with everything we know today about security and good programming p…
> That was 11 years ago. The problem is, these kids are from college . They don't teach you stuff like "writing a secure web application" in college, or even try to. (Not that this is unreasonable, though perhaps I'm suggesting that there should be different career paths for CS majors and people who intend to be professional programmers. (I say as a CS-educated professional programmer))
> They don't teach you stuff like "writing a secure web application" in college
We had a class on it. They basically pushed us through OWASP from front to back :)
Re: Security Lessons Learned From The Diaspora Launch
#56After reading the article, also read this comment:
http://www.kalzumeus.com/2010/09/22/security-lessons-learned...
The comment negates some of the statements made in the post
Re: Security Lessons Learned From The Diaspora Launch
#57"NoSQL Doesn’t Mean No SQL Injection" I lol'd. Mind if I use that? MongoDB is harder to secure and filter because you have all of Javascript to worry about, rather than just SQL (and where most servers can escape arguments themselves through prepared statements etc.). SQL databases are also well understood (for eg. in MS-SQL I can stop the remainder of the statement from executing with '--'). MongoDB with its JS engi…
I haven't used MongoDB, but I think there is a fundamental difference in the way data is updated. I don't think you have to escape JavaScript in the user input, because you don't update by submitting a single String to execute. The user input is just data.
Re: Security Lessons Learned From The Diaspora Launch
#58It's not that the pre-alpha Diaspora has insecurities that bothers me, it's the whole execution.
What I really would like to see is a documented protocol - based on XMPP or some other established, well-tested protocol would be good, but if not then at least something.
Once you have that protocol - which tells you how Diaspora "seeds" communicate securely - you can let others build their own implementation, using Rails, PHP, Python, doesn't matter. Sure, release a reference implementation in Rails, but the protocol is the most important thing.
Unfortunately what we have is just another Facebook clone done in Rails, which is disappointing.
Re: Security Lessons Learned From The Diaspora Launch
#59Earlier quoted context omitted.
I've always thought it would make more sense for CS degrees to be for computer scientists (ie, people who want to do more high-level theoretical work), and that software development was more of a trade school, where you learned the languages, and were soon thrown into real-world style projects and apprenticeships. Imagine if your nurse came out of college having never stepped foot into a hospital, having only read ab…
We're conflating a lot of different professions here. Phlebotomists only have trade school, but they're still going to be exposed to some pure science - at the least biology but likely chemistry as well - in high school. Nurses and especially Doctors have years of pure science before they're ever allowed into their trade schools. Likewise there are a variety of software careers, from sysadmin to developer to architec…
>Nurses and especially Doctors have years of pure science before they're ever allowed into their trade schools.
This is an (unnnecessary) North American tick, whose pernicious influence is spreading.
Medicine has traditionally been an undergraduate degree in Europe and all former European colonies aside from the US, and those countries that are in its cultural sphere (like S. Korea, which got rid of its undergraduate medicine degrees.) My cousin started his Medicine degree at 17. It will take him five years. It's not like this is even unknown in the States, IIRC UCSD has a runaround where you get a Bachelor while doing an M.D.
And even in the US there are different types of nurses, some of whom went to college, some who didn't (LPN, RN and Nurse Practitioner). I understand demanding continuing education and testing to ensure competency, but college is a means of doing that, but not the only one.
Re: Security Lessons Learned From The Diaspora Launch
#60Lesson learned: Never let the outside world see your First Big Project Ever.
This is what Fred Brooks would have called the First System. Everybody builds this thing at the beginning of their career, and it's always this embarrassing. Mine, in 1996, took this a step further and actually prepared SQL statements in javascript before submitting them to the server to run. Yours probably did something equally bad. It's the rule of the First System. It's where we learn all the lessons we need so that we can do things right the Third time (I'll spare the Second System description for the time being...)
The key though is to make sure that nobody ever sees that code. Hopefully it will be locked away in some intranet vacation-time-planning app that nobody will ever dig into. That way you can look back at it in shame, but few others will ever know about it.
So here we have a team of people who have clearly never built anything at all, trying to learn on the job while being scrutinized by the entire world and actually submitting their code for public review.
God help them.