Beefy Boxes and Bandwidth Generously Provided by pair Networks
The stupid question is the question not asked
 
PerlMonks  

Re^2: Secure Perl Coding Standards

by mr_mischief (Monsignor)
on Apr 07, 2009 at 20:39 UTC ( #756144=note: print w/replies, xml ) Need Help??


in reply to Re: Secure Perl Coding Standards
in thread Secure Perl Coding Standards

You make some very good points. The finer details of secure coding practice mean nothing if they are not followed. The most secure application code in the world can be a security nightmare when the application is configured incorrectly.

Treating all data that comes from outside the program as suspect or even downright hostile is one of the most important rules for security if not the most important. It's one that often gets forgotten when programming or configuring an application, though.

Any coding guidelines that help with robustness or maintainability help with security, too. If something's not robust and crashes when it's not a target of an attack, someone can crash it on purpose as well. They may even be able to crash it in a predictable enough way to exploit it. If code's not maintainable, then fixing security issues once they are found will take longer. Being security conscious is a good coding practice, but good coding practices in general help with security, too.

I realized since my post above that since PerlMonks is a great source for discussion of all things Perl, I probably should have included some node references. I did a little searching around the Monastery for other security discussions, and some of the topics you mentioned came up. As usual, the threads are generally more valuable taken together than any single node from a thread by itself.

In the vein of good general practices being good for security, Perl Best Practices and Perl::Critic are definitely worth a look.

As you say, though, the simple security issues that often aren't paid any attention should be addressed first. Get the low-hanging fruit that is most likely to allow the easiest route to exploitation, then move up the tree.

Update 2009-04-8: Thanks to ambrus for spotting a grammatical error. s/(secure and non-functional) (than insecure and functional)/$1 is better $2/;

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://756144]
help
Chatterbox?
[Corion]: Yay. FF now has u2f built-in (behind an about:config setting), so using an USB token to sign in actually works :)
[Corion]: So, it's not all bad with the new FF :)
[holli]: 2factor is a bit too much for me. i just use passwords like jhbn8789q27312laks dmaw98^
[moritz]: isn't there also some about:config setting to enable the old plugin API?
[Discipulus]: indeed, only the logo is nicer
[Corion]: moritz: Hmm, I doubt so, as I think they moved away from XUL and other UI stuff, which was used by most plugins I used
[Corion]: holli: I'm trying it out with Github and so far I don't dislike it. It's basically like an extra key I press to log in, which is an OK flow for Github
[Corion]: I haven't tried out recovery in case of a broken USB key though (even though I have three such U2F tokens lying around here)
[oiskuu]: randomly banging on the keyboard yields pretty poor entropy. much better to just base64 some /dev/random
moritz has a pass entry with recovery codes

How do I use this? | Other CB clients
Other Users?
Others rifling through the Monastery: (11)
As of 2017-11-20 20:23 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?
    In order to be able to say "I know Perl", you must have:













    Results (293 votes). Check out past polls.

    Notices?