241–250 of 279 posts
Earlier quoted context omitted.
How about building upwards? Learn to think in three dimensions.
Earthquake territory, which severely limits how far up you can go.
Earlier quoted context omitted.
You don't hear of any high-profile bank disclosures, which I imagine is probably because they have security teams that keep up with everything religiously. Most old brick banks have internal systems architected in ways that a younger intruder in the Anonymous mold wouldn't know anything about, as well; you're starting to get into big iron Cobol land. That said, I don't think it's an impossible task (is anything?), an…
There was actually a high-profile incident not too long ago with one of the big banks' online banking system. Users could view other people's account information just by incrementing an integer in the URL as I recall. It's not necessarily so much that banks are secure, but hacking them is much riskier than hacking Bitcoin sites, especially for white-hats.
Earlier quoted context omitted.
As a fan of responsible disclosure, the sad state of the universe is that telling people "upgrade to X now" on an open-source project makes it very easy for anyone to diff to find out what the fix is, which makes it very easy for people to figure out how to exploit it.
No. A thousand times. A bit more creativity should be allowed when handling a vulnerability of this magnitude. For example, publish a patch that escapes all input in curious ways, presumably to prevent SQL injection. Pad it, obfuscate the actual fix with code-noise, make it annoying to read. Then release it as some handwavy, semi-plausible "follow-up" to the previous SQL-injection, urging everyone to upgrade in small…
Earlier quoted context omitted.
Gold does not have that much of inherent value either.
Gold is inherently useful as a tangible object with exploitable physical properties. Gold, for example, has good conductivity and is used to plate electrical connections. Gold is also useful for its rust-resistance. Thus, on this basis, like all useable physical goods, gold has some inherent value as a commodity.
I don't know the answer, but I can tell you it's miniscule.
Look at the transaction volumes there https://vircurex.com/ - that does not look serious. By they way chrome shows their https certificate also has some problems.
Earlier quoted context omitted.
That's probably 10s of thousands of eyes who don't know their arse from their elbow, including the guys who wrote it. Possibly 2-3 people have read it who know their shit. The rest are just consumers. Frameworks only centralise the security concerns - they don't necessarily make it better. That is in the hands of the implementor and their ability to build bullet proof abstractions. One fuck up and your system is glob…
I think you seriously underestimate the sheer quantity of people looking through it, my friend. And if we're using that metric, it's extremely unlikely your average team member knows his or her ass from their elbow, either.
I agree with your second point, which is why I am a senior member of an architecture team in a company with 80 developers. It's our job to make sure ass and elbow confusion doesn't compromise the product.
Earlier quoted context omitted.
Earthquake territory, which severely limits how far up you can go.
Which is why the financial district was wiped off the map during the 1989 earthquake, whereas lower units such as those in the marina survived without problems?
So long as the foundation is bedrock, there is nothing preventing the building of highrises in San Francisco. We have the technology.
Earlier quoted context omitted.
Perhaps they should have done this up front, you know as part of the engineering, hence my point. Stopping and thinking for a bit usually covers these problems. I've read a huge chunk of the rails framework source code and it certainly used to be a pretty amateur piece of kit. The argument is definitely not preposterous. Are you saying guarding against bad inputs and enforcing type is bad? A language which uses no ty…
>Perhaps they should have done this up front, you know as part of the engineering, hence my point. And you know what, I have a feeling they did have multiple people looking over the code, and it's been vigorously refactored over the years. Rails 3 is a somewhat different beast from Rails 2. Careful auditing reduces bugs but does not eliminate them. Crowing about "proper engineering" is very nice but is somewhat farci…
For example float vs decimal types in finance. You really want your bank running on floats when doing interest calculations?
Earlier quoted context omitted.
That is an absolutely terrible lesson to draw from this episode. First and most importantly, Airbnb and Uber are not disrupting industries burdened primarily by consumer safety regulations; they are disrupting industries burdened primarily by barriers to entrance that are designed to direct economic rents to politically favored actors. Huge difference. There is no plausible 'consumer protection' story for preventing…
Legitimate banks don't get hacked? Is that true?
Earlier quoted context omitted.
That is an absolutely terrible lesson to draw from this episode. First and most importantly, Airbnb and Uber are not disrupting industries burdened primarily by consumer safety regulations; they are disrupting industries burdened primarily by barriers to entrance that are designed to direct economic rents to politically favored actors. Huge difference. There is no plausible 'consumer protection' story for preventing…
Legitimate banks don't get hacked? Is that true?