Re: [PHP] is there a problem with php script pulling HTML out of database as it writes the page??

On 7/17/08, Stut <stuttle@xxxxxxxxx> wrote:


On 17 Jul 2008, at 15:31, David Giragosian wrote:

On 7/17/08, Stut <stuttle@xxxxxxxxx> wrote:


On 17 Jul 2008, at 14:10, tedd wrote:

At 10:28 PM +0100 7/16/08, Stut wrote:

Oh, and you'd be working for me so bear that in mind ;)

-Stut


It's no wonder why you haven't found anyone. :-)


Thanks for that tedd.

Seriously though, I'm wondering if my expectations are too high... I
expect
them to know that addslashes is not adequate protection against SQL
injection. I even had one tell me "SQL injection? I can't remember but
I'm
sure I've used it before". And I won't even go into the guy who asserted
that he's always worked with DB administrators who've dealt with security
issues so he'd never needed to learn about it.

Am I expecting too much?!?

-Stut



Surely you're being rhetorical, Stut, but no, you're not expecting too
much.
However the guy(s) who worked in a larger organization likely did have a
very clear delineation of roles and responsibilities, as I am experiencing
in a new position, and therefore may not be current on best practices in
areas outside of their role. When my group leader instituted the current
policy regarding job functions, a number of the open source guys decided
their unused skills were eroding and/or they were not being exposed to new
learning, and they left the company.


There's no way I would ever hire anyone who says "security was somebody
else's responsibility". I don't care what their previous managers have said,
that's never a valid statement in my book. When you then add the fact that
no DB admin no matter how good they are can implement adequate security to
prevent SQL injection you get a developer who doesn't care about security
issues much less know anything about them.

-Stut


Saying security was someone else's responsibility is not the smartest
statement to make in a job interview. Whether that correlates to someone not
caring about security is a different matter, I think. Of course, if the
applicant said, "Security was somebody else's responsibility" in a flip
and/or arrogant manner and clearly showed no concern about it, then sure, on
to the next candidate. But I can imagine an exchange where somebody said
that, but then followed up with, "But here's how I would handle it..."

It sounds like the guy you interviewed was in the former category.

--David.

Relevant Pages

  • Re: Pentester convicted..
    ... and thus politely forcing them take responsibility for the protection of privacy of the data they carry. ... and ignored the first 2 reports. ... A security pro notices a flaw, checks to make sure he is not on crack ... Download FREE whitepaper on how a managed service ...
    (Pen-Test)
  • Re: Talk about "Fucking the Troops Around"
    ... a country at peace (where it should be the responsibility of the police ... What are the duties of an occupying force to provide security? ... not possible to compare the salary paid to a contractor to that paid to, ... Just like Walter Reed was a mistake? ...
    (rec.bicycles.racing)
  • Re: Outback Steakhouse response
    ... the amount of responsibility that a court would likely deem ... Who actually kills or harms a patron on their premises.Even robbing ... THAT is their liability if they choose to disarm legally armed ODCs. ... So if the restaraunt feels its security is sufficient then you are ok ...
    (talk.politics.guns)
  • Re: Zonealarm
    ... responsibility to cover their transgressions. ... He wasn't the one who was asking for advice. ... You came here ignorant of the business model, ... You came here ignorant of the security model, ...
    (comp.os.linux.security)
  • RE: How hackers cause damage...
    ... "Security Companies" that do not lock down systems or give ... Having enough people to completely secure all ... responsibility for negligence - systems are not always secured. ... be helpful to prosecute the person that *exploited* a vulnerability ...
    (Security-Basics)