This is Interesting: Free Magazines for Graphics designers and webmasters
Home > Archive > Webmaster forum > June 2006 > Can a REALLY secure online app be made?
You are viewing an archived Text-only version of the thread.
To view this thread in it's original format and/or if you want to reply to
this thread please [click here]
| Author |
Can a REALLY secure online app be made?
|
|
| rjames.clarke@gmail.com 2006-06-03, 7:15 pm |
| I would like to write an online application that is REALLY secure.
This would be a subscription based service with LOTS of data, and
multiple screens.
This would be hosted on dedicated servers.
This is an industrial application, all subscribers would go through a
sign up and set up process and would be making a serious commitment to
using this service.
But I can not risk the subscribers data. I can not risk it being
hacked or exposed.
Please do not respond with oneliners like "nothing is 100% secure", I
know that.
The question is, with multiple screens and LOTS of data is the cost of
writing a really secure application going to totally overshadow the
economic benefits of an online system?
Can this be made secure?
What technology/methodolgy would be used? https?
Does .NET have any advantage over PHP in this regard?
Can you point me in the right direction to read up?
| |
| SpaceGirl 2006-06-03, 7:15 pm |
|
rjames.clarke@XXXXXXXXXX wrote:
> I would like to write an online application that is REALLY secure.
> This would be a subscription based service with LOTS of data, and
> multiple screens.
> This would be hosted on dedicated servers.
> This is an industrial application, all subscribers would go through a
> sign up and set up process and would be making a serious commitment to
> using this service.
>
> But I can not risk the subscribers data. I can not risk it being
> hacked or exposed.
> Please do not respond with oneliners like "nothing is 100% secure", I
> know that.
>
> The question is, with multiple screens and LOTS of data is the cost of
> writing a really secure application going to totally overshadow the
> economic benefits of an online system?
>
> Can this be made secure?
> What technology/methodolgy would be used? https?
> Does .NET have any advantage over PHP in this regard?
>
> Can you point me in the right direction to read up?
..net is supposedly more secure, but as with anything it's only as
secure as the application it's running. If the data security is that
critical, you really need to hire a security expert.
PHP is a scrappy mess of a language, and I dont think it's very secure.
HTTPS is just one layer of security you should consider. It's a whole
mess of worms tho.
| |
| David Cary Hart 2006-06-03, 7:15 pm |
| On 1 Jun 2006 07:30:40 -0700, rjames.clarke@XXXXXXXXXX opined:
> I would like to write an online application that is REALLY secure.
> This would be a subscription based service with LOTS of data, and
> multiple screens.
> This would be hosted on dedicated servers.
> This is an industrial application, all subscribers would go through
> a sign up and set up process and would be making a serious
> commitment to using this service.
>
> But I can not risk the subscribers data. I can not risk it being
> hacked or exposed.
> Please do not respond with oneliners like "nothing is 100% secure",
> I know that.
>
> The question is, with multiple screens and LOTS of data is the cost
> of writing a really secure application going to totally overshadow
> the economic benefits of an online system?
>
> Can this be made secure?
> What technology/methodolgy would be used? https?
> Does .NET have any advantage over PHP in this regard?
>
> Can you point me in the right direction to read up?
>
Linux is infinitely more secure than Windows. PHP can be extremely
secure on linux. The LAMP model can be made almost bulletproof with
some common sense like strong passwords, adaptive IPTables and proper
permissioning.
We have several million records spread over 24 tables and the data
has NEVER been compromised.
--
Displayed Email Address is a SPAM TRAP
Our DNSRBL - Eliminate Spam: http://www.TQMcube.com
Multi-RBL Check: http://www.TQMcube.com/rblcheck.php
The Dirty Dozen Spammiest Ranges: http://tqmcube.com/dirty12.php
| |
| Isaac Hunt 2006-06-03, 7:15 pm |
| >
> PHP is a scrappy mess of a language, and I dont think it's very secure.
Sorry, I have to totally disagree with you on that. PHP running under Linux
is as secure as anything else as long as the programmer wants it to be.
Then again anything running under Linux is going to be more secure than
Windows (spit!)
--
Isaac Hunt
Possibly the most handsome man here?
| |
| SpaceGirl 2006-06-03, 7:15 pm |
|
David Cary Hart wrote:
> Linux is infinitely more secure than Windows. PHP can be extremely
> secure on linux. The LAMP model can be made almost bulletproof with
> some common sense like strong passwords, adaptive IPTables and proper
> permissioning.
That's a myth. Linux systems are far more exploited than Windows ones
(partly because there are more of them, partly because many sysadmins
dont know how to secure them properly). On paper linux is more secure.
In reality that's not the case.
| |
| SpaceGirl 2006-06-03, 7:15 pm |
|
Isaac Hunt wrote:
>
> Sorry, I have to totally disagree with you on that. PHP running under Linux
> is as secure as anything else as long as the programmer wants it to be.
> Then again anything running under Linux is going to be more secure than
> Windows (spit!)
Meanwhile, in the real world... :)
| |
|
|
David Cary Hart wrote:
> We have several million records spread over 24 tables and the data
> has NEVER been compromised.
How do you know that?
TC (MVP MSAccess)
http://tc2.atspace.com
| |
| trevor 2006-06-03, 7:15 pm |
| rjames.clarke@XXXXXXXXXX wrote:
"Can a REALLY secure online app be made?"
(snip)
no. security exists only in the mind of the forgetful or the naive. being
online merely introduces every factor in security that has ever existed and
added a few million more.
| |
| David Cary Hart 2006-06-03, 7:15 pm |
| On 1 Jun 2006 08:32:37 -0700, "TC" <gg.20.keen4some@spamgourmet.com>
opined:
>
> David Cary Hart wrote:
>
>
>
> How do you know that?
>
You are asking me to prove a negative. However, the security scheme
makes it virtually impossible and absolutely impossible without being
detected immediately. I can say, to a virtual certainty, that our
data has NEVER been compromised.
"The Security-enhanced Linux kernel enforces mandatory access control
policies that confine user programs and system servers to the minimum
amount of privilege they require to do their jobs. When confined in
this way, the ability of these user programs and system daemons to
cause harm when compromised (via buffer overflows or
misconfigurations, for example) is reduced or eliminated. This
confinement mechanism operates independently of the traditional Linux
access control mechanisms. It has no concept of a "root" super-user,
and does not share the well-known shortcomings of the traditional
Linux security mechanisms (such as a dependence on setuid/setgid
binaries)."
http://www.nsa.gov/selinux/info/faq.cfm
--
Displayed Email Address is a SPAM TRAP
Our DNSRBL - Eliminate Spam: http://www.TQMcube.com
Multi-RBL Check: http://www.TQMcube.com/rblcheck.php
The Dirty Dozen Spammiest Ranges: http://tqmcube.com/dirty12.php
| |
| David Cary Hart 2006-06-03, 7:15 pm |
| On 1 Jun 2006 08:23:13 -0700, "SpaceGirl"
<nothespacegirlspam@subhuman.net> opined:
>
> David Cary Hart wrote:
>
>
> That's a myth. Linux systems are far more exploited than Windows
> ones (partly because there are more of them, partly because many
> sysadmins dont know how to secure them properly). On paper linux is
> more secure. In reality that's not the case.
>
No offense but that is utter nonsense. EVERY bot that we track down
(admittedly with a focus on SMTP) is associated with a Windows
machine.
There exists a Proof of Concept Linux virus but it has never been
seen in the wild. From time to time, I have seen postings in the
Fedora list about rootkits but they are very rare and universally the
result of a combination of serious oversights.
--
Displayed Email Address is a SPAM TRAP
Our DNSRBL - Eliminate Spam: http://www.TQMcube.com
Multi-RBL Check: http://www.TQMcube.com/rblcheck.php
The Dirty Dozen Spammiest Ranges: http://tqmcube.com/dirty12.php
| |
| SpaceGirl 2006-06-03, 7:15 pm |
|
David Cary Hart wrote:
> On 1 Jun 2006 08:23:13 -0700, "SpaceGirl"
> <nothespacegirlspam@subhuman.net> opined:
> No offense but that is utter nonsense. EVERY bot that we track down
> (admittedly with a focus on SMTP) is associated with a Windows
> machine.
So? Since when are is Windows XP used as a webserver!??? We're talking
about web servers, not home computers or game machines. How many
Windows Server 2003 machine are associated with these attacks?
| |
| Charles Sweeney 2006-06-03, 7:15 pm |
| SpaceGirl wrote
> PHP is a scrappy mess of a language
It is? Isn't it the same as any language, it's in the usage?
--
Charles Sweeney
http://CharlesSweeney.com
| |
|
|
TC wrote:
> You are asking me to prove a negative. However, the security scheme
> makes it virtually impossible and absolutely impossible without being
> detected immediately. I can say, to a virtual certainty, that our
> data has NEVER been compromised.
I'd respectfully suggest that you really can't be sure of that. For
example, when was the last time that you checked each PC & terminal,
for a hardware keylogger? (As you doubtless know, these are very small,
can be installed in an instant, & are almost undetectable unless you
know exactly what you're looking for.)
I'm making the point that security is not a simple yes/no process. It's
just not valuable to say that "this is secure", or "that is not
secure", or "X is more secure than Y", unless the exact parameters of
the situation are spelled out in detail.
Cheers,
TC (MVP MSAccess)
http://tc2.atspace.com
| |
| David Cary Hart 2006-06-03, 7:15 pm |
| On 1 Jun 2006 08:56:35 -0700, "SpaceGirl"
<nothespacegirlspam@subhuman.net> opined:
>
> David Cary Hart wrote:
>
> So? Since when are is Windows XP used as a webserver!??? We're
> talking about web servers, not home computers or game machines. How
> many Windows Server 2003 machine are associated with these attacks?
>
EVERY server exploit that we trace (again, confined to SMTP) is
associated with a Windows machine. Most of these are running
Exchange. There is just no comparison from my point of view.
--
Displayed Email Address is a SPAM TRAP
Our DNSRBL - Eliminate Spam: http://www.TQMcube.com
Multi-RBL Check: http://www.TQMcube.com/rblcheck.php
The Dirty Dozen Spammiest Ranges: http://tqmcube.com/dirty12.php
| |
| Charles Sweeney 2006-06-03, 7:15 pm |
| TC wrote
> I'm making the point that security is not a simple yes/no process. It's
> just not valuable to say that "this is secure", or "that is not
> secure", or "X is more secure than Y", unless the exact parameters of
> the situation are spelled out in detail.
And a good point it is too.
--
Charles Sweeney
http://CharlesSweeney.com
| |
|
|
|
|
|
|
Charles Sweeney wrote:
> TC wrote
>
>
> And a good point it is too.
I sorta got sidetracked. I initially planned to reply the OP along the
following lines: "No-one can answer your question, unless you define
what you mean by 'secure enough' ". Then I changed my mind, and decided
not to post. Then I saw the comments that "X is more secure than Y", so
I changed my mind again, & hopped on in!
BTW, I just tried your ASCII art generator. Wow! I gave it quite a
complex picture. It sat there for about 5 minutes, emitting alarming
amounts of HTML (but no display), then BANG! A very fathful rendition
indeed. Freaky!
Cheers,
TC (MVP MSAccess)
http://tc2.atspace.com
| |
| David Cary Hart 2006-06-03, 7:15 pm |
| On 1 Jun 2006 09:03:49 -0700, "TC" <gg.20.keen4some@spamgourmet.com>
opined:
>
> TC wrote:
>
>
> I'd respectfully suggest that you really can't be sure of that. For
> example, when was the last time that you checked each PC & terminal,
> for a hardware keylogger? (As you doubtless know, these are very
> small, can be installed in an instant, & are almost undetectable
> unless you know exactly what you're looking for.)
>
> I'm making the point that security is not a simple yes/no process.
> It's just not valuable to say that "this is secure", or "that is not
> secure", or "X is more secure than Y", unless the exact parameters
> of the situation are spelled out in detail.
>
Well, of course you are correct. I will say, however, that an exploit
on the LAN could not be used on the WAN. The firewall and
permissioning are far too restrictive. NOTHING is perfect but I am
also using adaptive firewalling with a PERL script watching the logs
for patterns.
That said, I became increasingly uncomfortable with FTPD for a
variety of reasons and migrated to rsync. I also spotted what looked
like a potential hole in ntpd. I whacked it, closed the port unless
"established" and now just run a script a couple of times a day for
time sync.
--
Displayed Email Address is a SPAM TRAP
Our DNSRBL - Eliminate Spam: http://www.TQMcube.com
Multi-RBL Check: http://www.TQMcube.com/rblcheck.php
The Dirty Dozen Spammiest Ranges: http://tqmcube.com/dirty12.php
| |
| Charles Sweeney 2006-06-03, 7:15 pm |
| TC wrote
> Charles Sweeney wrote:
>
> I sorta got sidetracked.
Perfectly normal around here, I would say!
> BTW, I just tried your ASCII art generator. Wow! I gave it quite a
> complex picture. It sat there for about 5 minutes, emitting alarming
> amounts of HTML (but no display), then BANG! A very fathful rendition
> indeed. Freaky!
Just a bit of fun, glad you enjoyed it!
As you can probably tell, it takes a pixel at a time, and changes it
into a character. An 800x600 image would be 480,000 pixels.
One of the outputs makes a data cell in a table for each pixel, so in
this case it would be a table with 600 rows, and 480,000 cells!
--
Charles Sweeney
http://CharlesSweeney.com
| |
| Karl Groves 2006-06-03, 7:15 pm |
| Charles Sweeney <me@charlessweeney.com> wrote in
news:Xns97D5B25BD14A3mecharlessweeneycom@130.133.1.4:
> Karl Groves wrote
>
>
> I see that is laughingly called an "independent" report.
>
> This appears near the beginning:
>
> "Even by Microsoft's subjective and flawed standards"
Is that supposed to be an argument meant to dispute the report? Just
curious, because I don't see you actually addressing any facts presented. I
also don't see you presenting a case which presents other facts.
Does the report have an obviously biased tone? Sure. But that doesn't make
any of the arguments any less valid.
--
Karl Groves
www.karlcore.com
| |
| Charles Sweeney 2006-06-03, 7:15 pm |
| Karl Groves wrote
> Charles Sweeney <me@charlessweeney.com> wrote in
> news:Xns97D5B25BD14A3mecharlessweeneycom@130.133.1.4:
>
http://www.theregister.co.uk/securi...windows_vs_linu[color=darkred]
>
>
> Is that supposed to be an argument meant to dispute the report? Just
> curious, because I don't see you actually addressing any facts
> presented. I also don't see you presenting a case which presents other
> facts.
I only read a few paragraphs, but more than enough to see where the
author was coming from.
> Does the report have an obviously biased tone? Sure.
And they call it "independent".
> But that doesn't
> make any of the arguments any less valid.
I think it does. If you prepare a report, wanting it to find in your
favour, it will find in your favour.
--
Charles Sweeney
http://CharlesSweeney.com
| |
| George L. Sexton 2006-06-03, 7:15 pm |
| On Thu, 01 Jun 2006 16:22:51 +0100, Isaac Hunt wrote:
>
> Sorry, I have to totally disagree with you on that. PHP running under Linux
> is as secure as anything else as long as the programmer wants it to be.
That's just plain silly and a dangerously uninformed opinion.
Go to
http://www.cert.org/
search for PHP. PHP has had a major security problem every quarter for the
last several years. Many of these are buffer overflows that can directly
lead to compromise of the server. PHP is VASTLY unsecure.
Run the same search for Tomcat. The one last year was for a deprecated
version. Java Servlets under Tomcat are infinitely more secure than PHP.
--
George Sexton
MH Software, Inc. - Home of Connect Daily Web Calendar
http://www.mhsoftware.com/connectdaily.htm
| |
| Karl Groves 2006-06-03, 7:15 pm |
| Charles Sweeney <me@charlessweeney.com> wrote in
news:Xns97D5BACA735E2mecharlessweeneycom@130.133.1.4:
> Karl Groves wrote
>
>
>
> I think it does.
I think you need to read a few logic textbooks.
If you'd like to debunk the report, debunk its arguments, not its tone.
--
Karl Groves
www.karlcore.com
| |
| Charles Sweeney 2006-06-03, 7:15 pm |
| Karl Groves wrote
> Charles Sweeney <me@charlessweeney.com> wrote in
> news:Xns97D5BACA735E2mecharlessweeneycom@130.133.1.4:
>
>
> I think you need to read a few logic textbooks.
I might do when I've finished writing my own!
--
Charles Sweeney
http://CharlesSweeney.com
| |
| Ed Jay 2006-06-03, 7:15 pm |
| Karl Groves scribed:
>Charles Sweeney <me@charlessweeney.com> wrote in
>news:Xns97D5BACA735E2mecharlessweeneycom@130.133.1.4:
>
>
>I think you need to read a few logic textbooks.
>
>If you'd like to debunk the report, debunk its arguments, not its tone.
One of the basic questions I ask myself before taking the time to read a
supposedly independent and unbiased report is to determine as quickly as
possible if the report is at all tainted. If it is, I don't waste my time
reading it. For example, if I want find an unbiased comparison of Windows
versus Linux, I would not read a report that begins, "Only God knows why
anyone would choose Linux, but for those who are considering it, compare
it with Microsoft's excellent OS. Y'know what I mean?
--
Ed Jay (remove 'M' to respond by email)
| |
| Karl Groves 2006-06-03, 7:15 pm |
| Ed Jay <edMbj@aes-intl.com> wrote in
news:0nau72lp290kec32g5gib54110esujb39v@4ax.com:
> Karl Groves scribed:
>
>
> One of the basic questions I ask myself before taking the time to read a
> supposedly independent and unbiased report is to determine as quickly as
> possible if the report is at all tainted. If it is, I don't waste my time
> reading it. For example, if I want find an unbiased comparison of Windows
> versus Linux, I would not read a report that begins, "Only God knows why
> anyone would choose Linux, but for those who are considering it, compare
> it with Microsoft's excellent OS. Y'know what I mean?
>
Of course. But again, the tone has *nothing* to do with the validity or
accuracy of the arguments presented. The arguments presented must be
weighed on their own merits.
Naturally a biased tone probably betrays the strong possibility that
important facts could have be omitted by the author but I'd still maintain
that if someone wants to debunk the article they should do so by addressing
what it says not how it says it.
--
Karl Groves
www.karlcore.com
| |
| rjames.clarke@gmail.com 2006-06-03, 7:15 pm |
| Thanks to all who took the time to reply.
The question is how secure is secure enough, is a good one.
And it would seem to me if I can't answer that (and I can't without
resorting to "never breached") then I don't know where I am going.
It is one thing to have a brief down period and run a restore from a
backup.
It is another thing to tell a customer that his/her customer list and
his/her failure analysis data has been compromised and maybe in the
hands of a competitor.
Could it be done, probably, will I learn enough to accomplish it on my
own, plus write the app? No, most likely not. Will I hire a security
wizard, no most likely not either, not on my startup budget.
In this application maybe the best security is a locked door.
thanks
George L. Sexton wrote:
> On Thu, 01 Jun 2006 16:22:51 +0100, Isaac Hunt wrote:
>
>
> That's just plain silly and a dangerously uninformed opinion.
>
> Go to
>
> http://www.cert.org/
>
> search for PHP. PHP has had a major security problem every quarter for the
> last several years. Many of these are buffer overflows that can directly
> lead to compromise of the server. PHP is VASTLY unsecure.
>
> Run the same search for Tomcat. The one last year was for a deprecated
> version. Java Servlets under Tomcat are infinitely more secure than PHP.
>
>
>
> --
> George Sexton
> MH Software, Inc. - Home of Connect Daily Web Calendar
> http://www.mhsoftware.com/connectdaily.htm
| |
| William Tasso 2006-06-03, 7:15 pm |
| Fleeing from the madness of the http://groups.google.com jungle
<rjames.clarke@XXXXXXXXXX> stumbled into news:alt.www.webmaster
and said:
> I would like to write an online application that is REALLY secure.
> This would be a subscription based service with LOTS of data, and
> multiple screens.
online/real-time or batch processed?
> This would be hosted on dedicated servers.
Dedicated & self managed too
> This is an industrial application, all subscribers would go through a
> sign up and set up process and would be making a serious commitment to
> using this service.
ok
> But I can not risk the subscribers data. I can not risk it being
> hacked or exposed.
yes
> Please do not respond with oneliners like "nothing is 100% secure", I
> know that.
good
> The question is, with multiple screens and LOTS of data is the cost of
> writing a really secure application going to totally overshadow the
> economic benefits of an online system?
who can possibly tell you that? what happens when you plug the figures
into your business plan?
> Can this be made secure?
yes/no/maybe
> What technology/methodolgy would be used? https?
probably - in part, maybe in full
> Does .NET have any advantage over PHP in this regard?
The choice of infrastructure is nowhere near as important as the skills
and experience of the technicians.
> Can you point me in the right direction to read up?
No - I don't really know where you;re starting from. Perhaps one of the
larger consulting/software outfits - logica, IBM - make sure you have a
legal team that costs more than theirs to read the contracts.
--
William Tasso
http://williamtasso.com/words/what-is-usenet.asp
| |
| SpaceGirl 2006-06-03, 7:15 pm |
|
Charles Sweeney wrote:
> SpaceGirl wrote
>
>
> It is? Isn't it the same as any language, it's in the usage?
>
Well, the itself language is a mess. There are a lot of inconsistancies
in the language, and syntax-wise it's extremely dated.
PHP is a fab protoyping language, but given a market where there are
"real" languages with proper frameworks around (C#, JSP, Ruby) I'd
avoid PHP for any new project.
Of course you can make a messy program in any language :) I do
reguarly! :P
| |
| dingbat@codesmiths.com 2006-06-03, 7:15 pm |
|
rjames.clarke@XXXXXXXXXX wrote:
> I would like to write an online application that is REALLY secure.
Java.Start by looking at Eclipse RCP and then work outwards to the
_many_ other similar technologies. They beat the pants off pretty much
anyhting else, if you want to optimise performance and security over a
little browser footprint. But then you can run client-side Java pretty
much anywhere these days.
|
|
|
| | Copyright 2003 - 2008 forum4designers.com Software forum Computer Hardware reviews |
|