Slashdot is powered by your submissions, so send in your scoop


Forgot your password?

Submission + - Secure File Transfer with windows/.Net hosting? 4

galego writes: "I've done a variety of web development at work and at home. I'm thinking of getting a .Net hosted account to do some work with that. One of the things I always look for when looking at hosting companies is a secure (well, encrypted that is) form of file transfer. For Windows/.Net hosting, are there any good options out there? I've looked around some and I don't really see any so far. I tried once to set up sftp on windows on a system at work (that is without paying for some custom/proprietary version), and it didn't go so well. Some *n*x hosting companies don't offer sftp, but if they allow ssh, then I can at least use scp. I'm not seeing anything equivalent with Windows/.Net hosting ... suggestions?"

Comment Re:Yeah. (Score 2, Insightful) 605

At my last 2 jobs developers have had security exceptions for local admin rights. The combination of money lost due to wasted time otherwise plus the fact that developers are going to cause less harm than average users is apparently enough to persuade even management.

I think there's validity to that ... for most semi-responsible developers.

However, if you are programming with security exceptions, you are likely to develop things that have/require more security exceptions (e.g. you must be admin/dbo/superuser/root to run it). It's not going to happen just because you're running as admin ... but it becomes much easier to do so ... unless you have pretty rigorous testing specifically targeting other user types. My team all has regular user accounts on their desktops and we do just fine. A couple of us (me as lead) have admin rights to maintain the system (we have a duplicated network/environment to do our work), install stuff etc.

Why propagate the Microsoft development model of must-be-admin-to-run-the-software?>

Comment Re:Monopoly position to overcharge for their softw (Score 1) 266

How exactly did they "eliminate alternatives"

One way is to buy-and-shelf. There's also flooding the market with a free-but-inferior product ... that didn't quite work with Money against Quicken though

and made contractual obligations with their resellers. *gasp*

Some would say that's where they used thugs and tommy guns ... or some modern equivalent, like lawyers who can manipulate 'immoral laws'. Yes ... if OEMs and other companies had more cojones to tell M$ to screw off, some of this would have taken care of itself. Of course, we're in the US ... we use legislators and lawyers to solve that stuff.

Comment Forget your silly pr0n folks (Score 1) 174

Granted, some of you are concerned about people finding out the sites you visit, but what about a real world problem (or two)?

Some time back, there was an attack that threw a phony dialog pop-up saying that your timeout had been expired at your bank site. Combine that with being able to see *what* bank's site (and whether or not you have been at it recently). This could even be injected through a compromised ad-server system or the like. Maybe you don't even have to visit my site. There's some moving parts in there, but things like this, combined with click-happy-and-fill-in-personal-data user syndrome could make for some pretty sophisticated attacks.

From a private organization's perspective (many of whom have private systems, blocked off from the outer world) ... this can also be used to help map their internal network from the outside (just by one of their users visiting a site). Think about that after you visit your interal cisco web interface and then merrily tab into some other site.

I am particular about who I allow to set cookies, but not so much about my history (except that I do wipe it .. and other 'private data' when FF closes). don't know that I'll change that behavior yet, but will probably modify the config on visited site styles as some have suggested here.

Comment Re:And? (Score 1) 543

But most SS card applications are issued at the hospital nowadays. I got mine when I was 8 or 10 or something (I remember getting it). in the case of all my kids, my wife filled out the application at the hospital, or it was included in a packet from the hospital. Just another reason to hate SS (and the rat hole it is that we pound money down into).

Comment Re:Has Bruce gone bat **** loco? (Score 1) 173

Security is a mindset. Every person has to have the concept of "secure environment" in their head every day, be they developers, users of IT systems, or even the seemingly-rare non-IT user (i.e. custodians). People need to understand why security is so crucial, and they have to be involved in the process; just designing technical controls around them always fails quickly, because people who don't value security will abuse whatever privileges they have, thinking that they're helping someone.

And you need an ISSO or some other security expert/chief/scary person to strike fear into them and into having that mindset. I think a Czar sounds scary, don't you? ;-)

Comment Re:Makes sense (Score 1) 173

>>The Democrats aren't much better, but at least they're trying to spend money on people in THIS HEMISPHERE, let alone in this country.

Well, then independent of who let this through (below), Bush's Admin. or the Democratic Congress ... maybe they should go kill this (heard about it on the radio):

Comment Re:Hmm. (Score 4, Informative) 84

Hope you're not trying to "enumerate the bad" (i.e looking at $foo ~= /<script/i in the input ... or even '<'). There are lots of ways to escape such validators. A great resource on some is here: I say, unescape everything back to the browser (even email addresses). OWASP has a good resource:

Comment Re:I can think of a few (Score 1) 496

but the notion that "wireless=fundamentally insecure" seems dubious at best.

I would say "Wireless=More Attack Surface" ... Some might say fundamentally *less* secure because of that fact. A key factor in security is reducing attack surface to only what is necessary for the required/intended of the functionality.

Yes ... people should take more care in operating wired networks as well.

Slashdot Top Deals

egrep -n '^[a-z].*\(' $ | sort -t':' +2.0