Beefy Boxes and Bandwidth Generously Provided by pair Networks
Perl Monk, Perl Meditation
 
PerlMonks  

Re^2: Is this code secure, can I test it on my machine?

by szabgab (Priest)
on May 23, 2010 at 10:21 UTC ( #841250=note: print w/replies, xml ) Need Help??


in reply to Re: Is this code secure, can I test it on my machine?
in thread Is this code secure, can I test it on my machine?

"threat model"

Well, I understand that I should explicitly state what do I consider as a threat and what not but that in itself is to difficult for me now. Besides when I am asked if this code can be trusted, usually the person who asks this has even less understanding than I do. Which, you might guess, is really little.

So I go back thinking about the issue at hand.

I guess we have an advantage here that we have the source code so we don't necessarily need to check the behavior. We can check the source code.

In the code that raised the whole question one of the modules only contains some variables. most of the code is just looks like this:

# number of carnivores in the beginning $NUM_CARNIVORES = 30;
I am not a security expert but I think we can easily agree that such code in itself cannot be dangerous even though we are talking about carnivores here.

That means if I want to evaluate the code - regardless of my threat model or lack of it I can disregard those line when I am checking the source code.

OTOH if I see code like this:

use Carnivores;
that should immediately raise the red flag and tell me to look for the Carnivores.pm file to see what dangers might lurk in there.

Replies are listed 'Best First'.
Re^3: Is this code secure, can I test it on my machine?
by JavaFan (Canon) on May 31, 2010 at 11:36 UTC
    Well, I understand that I should explicitly state what do I consider as a threat and what not but that in itself is to difficult for me now. Besides when I am asked if this code can be trusted, usually the person who asks this has even less understanding than I do.
    That's easy. In that case, the answer is No, I cannot trust the code. You just don't have enough information. Even if you do have perfect knowledge of the third party code, you still don't know enough of your own system.

    Suppose the code you're looking at contains something like this:

    use Fcntl ':flock'; my $lockfile = "/var/lock/frobnitz"; open $lh, "+<", $lockfile or die $!; flock $lh, LOCK_EX or exit; sleep 600; exit;
    Harmless? Probably. Unless you have another program running that uses /var/lock/frobnitz for locking - that one will be blocked for 10 minutes.

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://841250]
help
Chatterbox?
and all is quiet...

How do I use this? | Other CB clients
Other Users?
Others chilling in the Monastery: (9)
As of 2018-07-17 12:02 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?
    It has been suggested to rename Perl 6 in order to boost its marketing potential. Which name would you prefer?















    Results (363 votes). Check out past polls.

    Notices?