Categories

Presentation: Secure Coding Practices

Well my presentation went off OK, although there were only about 20-30 people present. I hope all truly enjoyed the presentation.

To the person that asked “doesn’t the use of an interpreted language make race conditions more difficult to address?” I must apologize as I totally mis-handled that question.

No, an interpreted language doesn’t make [...]

Tracing a process as a user

On Linux[*], just because a process is owned by a user does not mean that user can trace the process. By trace I mean using applications such as strace or gdb to peek at the internals of the process. The process must also be dumpable, that is whether the process may generate a a core [...]

cPanel 2010 Conference

The cPanel 2010 Conference is drawing nigh, October 4th – 6th. This year I will be presenting on secure coding practices. It seems many articles are focused on cross-site scripting, cross-site request forgery and other browser-targeted exploits. My presentation will focus on the server-side aspect of secure programming practices. It is especially designed for people [...]

SysAdmin Tip: recursive chown can open your system for exploit

A scenario system admins often encounter on shared hosting servers is the permission and ownership issue caused by using mod_php (otherwise known is PHP DSO). Files and directories created by mod_php will be owned by the user that Apache runs as, usually nobody or www-data. This presents a problem in at least two scenarios:

The [...]