Programming Languages

[moetheman]

Originally Posted by deviant

Oh man I LOL'd for about 20 minutes straight after that one. That post was funny on so many levels.

I can see you sidestepping the issue, which is "are MSFT products secure?", the answer to which is NO. Have the news for the last 8 years simply gone over your head?

Originally Posted by deviant

1) you don't know what you're talking about

You obviously haven't a clue. But hurry up and apply those patches, since you have to watch your PHP apps "like a hawk". LOL

Originally Posted by deviant

2) you don't know who you're talking to

That's whatever all the guys like you say.

Originally Posted by deviant

3) obvious troll is obvious

Look who's talking about a troll. Go on, insist that Windows is secure.

Originally Posted by deviant

4) I really don't care enough to correct you, it's funnier not to.

You keep believing that your patches and bulletins are the answer.

Originally Posted by deviant

Good stuff though, next you should watch a documentary on brain surgery and then go troll some neurosurgeons with your wisdom. You kind of argue like a drunk guy though, all over the place, rambling, not making any sense, implying someone is saying one thing when they're not and then basing your whole argument on that. With a little perfection of technique you could be a much better troll.

Funny, you have not provided a factual rebuttal to any of the references I have brought into the discussion. Not a single one.

Originally Posted by deviant

A majority of the vulnerabilities I posted links to were in regards to how the language itself handled data.

Thus my point, twit, programming skill INCLUDES knowing the language and its interpreter/compiler well enough to know those things, I can see that your definition of programming skill is limited to skill driving an IDE.

Originally Posted by deviant

If the vulnerability exists in a programming language's function and not how that function is implemented then yes. Examples of this were in those links I provided in the first post.

Once again, thus my point. I stated the code, not the interpreter or the compiler, thus, I was referring to the implementation.

Originally Posted by deviant

All of these quotes clearly indicate that you don't understand what leads to buffer overflows and other issues that different languages are prone to or why. Each depends on how the language is written and then how the language is implemented by the coder. Different languages produce different types of vulnerabilities.

It all comes down to the programmer's skill, as I stated. Programming skill, once again, implies a little more than driving an IDE, which is apparently your definition of it.

Originally Posted by deviant

Webapps are not typically vulnerable to "Buffer overflows"

Now, I wasn't specifically referring to web applications there, however you are dead wrong cocksucker! Webapps are indeed vulnerable to buffer overflows . . . if someone has the parameter in question, and the buffer size, he/she can overwrite the stack pointer and ram home shell code . . .

Originally Posted by deviant

(congrats on knowing a security term, here's your cookie)

You'll remember this when you get owned Jack. You will.

Originally Posted by deviant

unless the language it's written in is vulnerable. Are you allocating buffers and doing memory management in php or does php handle that genius?

Once again, I wasn't initially referring to webapps, but how pathetic of you, latching on to a strawman just to sidestep the issue.

Originally Posted by deviant

Secure coding practices address known issues and are not implemented by telepathy. Are you starting to realize what kind of asshat you put on by acting like you know it all? I see this kind of shit all day everyday, it's ok, people don't know what they don't know, but when you act like you do, you run the risk of looking like a real idiot.

Acting like I know it all? Gee, that's funny, I only stated the obvious, and you come back with "I work in security" - laughable.

Originally Posted by deviant

If you can decrypt it, so can whoever just pwn3d your box.

Your windows box perhaps.

Originally Posted by deviant

You have no idea how many people MS employs looking for bugs, you also have no idea how many people or what kind of equiptment they're using to look for bugs through fuzzing and other techniques.

they evidently don't employ enough, just look at Vista, what planet do you live on? Do you smoke crack dude?

Originally Posted by deviant

I'm not saying there's no bugs, I'm saying they've become so rare they sell for 6 figures easy and this is well known in the security industry. With all your knowledge of windows exploits, you must be sitting on a freaking goldmine over there man, what are you doing wasting your time on oprano!?!?

ROFLMAO - how pathetic of you, once again, sidestepping the issue with a strawman . . . did I say I knew windoze exploits? Did I? HAHAHAHAHAHA

Originally Posted by deviant

This was hilarious for many many many reasons. I'm only going to state the most obvious. It was a default install, from..... 2003.
"While receiving more attacks, the Microsoft XP SP2 machine and the Macintosh OS X 10.3.3 were not compromised by"

Right, because we ALL KNOW that the windows codebase has been completely rewritten since 2003, RIGHT . . . you are smoking MSFT crack kid, you are amazing, referring to a default install from 2003 AS IF IT WERE NOT MOSTLY THE SAME CODEBASE IN USE TODAY.

Originally Posted by deviant

The friend of a friend name dropping was pretty funny too, reminded me of elementary school.

Friend of a friend? Oh, that did not really happen, nooooo, Mitnick did not find that, and he's not a friend of the board, RIGHT . . . I actually found both facts to be an interesting coincidence, that Mitnick conducted that study, and that (according to Gonzo, I was surprised when he mentioned that) he's a friend of the board.

Originally Posted by deviant

The rest of your post was assumptions and made up personal attacks further leading me to believe you were drinking when you posted it. Either that or mommy put your helmet on too tight you tell me.

That's coming from the character that is convinced that Windows and MSFT products are safe. Laughable. By all means, you should sum up your expert findings in a blog post, and submit them to /. and HN . . . do it, please do it.

Originally Posted by deviant

In order to truely understand the flaws in your argument you really need a full course in secure coding practices, buffer overflows, and how programming languages handle memory allocation and management.

That's interesting, considering that my core arguments were simple references to the obvious . . . which you are evidently unable to see, or worse, you ignore the obvious, in the name of referring to yourself as a security expert, sticking to the safe little bulletins and patches, since that is so much easier than learning about the fundamental issues at work.

Originally Posted by deviant

That's what I meant by I'm not here to teach security class, hopefully this post will clear up a little bit of your confusion. If it doesn't that's your problem, not mine. I'm not here to hold your hand just because you talked shit on the internet, there's nothing to gain by proving to every idiot they're an idiot.

You are obviously incompetent at what you claim you work at, and it is sad to see that you truly have no clue, the whole track record of a technology has completely eluded you. That's pathetic dude. But, please, by all means, go on in full faith that your bulletins and patches are the answer, and that as long as MSFT does not DIVULGE (now do you understand? still don't get it?) information about security flaws, then that must mean that there aren't any . . .