The Daily WTF: Curious Perversions in Information Technology

PleegWat · 2014-11-13 Reply Admin

I've used HP Fortify at work. It generates traces of what it thinks are vulnerabilities, often along the lines of:

main.c: variable 'filename' read from program arguments
... (passing along)
output.c: fopen(1): Untrusted value used to access the filesystem

In our process a developer marks all detected issues as how problematic they actually are, including a 'not an issue' verdict. These are then forwarded to a security team where they do some form of cross-referencing, ensuring our analysis is correct.

CarrieVS · 2014-11-14 Reply Admin

abarker:
Oh, lemur them alone. It's just some harmless fun.

It's gibbon me a headache.

Shoreline · 2014-11-14 Reply Admin

CarrieVS:
It's gibbon me a headache.

What's with the anti-joke police? I think all you guys just have a chimp on your shoulder.

chubertdev · 2014-11-14 Reply Admin

I tried to tell my wife some of these jokes late last night, but in the midnight hour, she cried boooooooooonoooooooooooboooooooo

boomzilla · 2014-11-14 Reply Admin

Timing is everything in comedy.

FrostCat · 2014-11-14 Reply Admin

You must have been happy, if you're familiar with the mating habits of bonobos.

Luhmann · 2014-11-15 Reply Admin

FrostCat:
the mating habits of bonobos.

they do give a fuck?

FrostCat · 2014-11-15 Reply Admin

Many of them, apparently.

urkerab · 2014-11-18 Reply Admin

Shoreline:
The consultant is WTF for thinking this question of security vs maintainability hadn't been answered before. I hope he was a recent graduate.

Maybe he graduated before the option of turning off stacktraces in production had been created.

2018-01-16 Reply Admin

Yes, it can be used, but that's just security through obscurity, aka no security. When someone does find a way to abuse this then you won't even know it.

Exceptionally Secure

Leave a comment on “Exceptionally Secure”