Survey Results

FirstPrevNext

Re: Buffer over-runs James R. Twine11-Jun-02 9:21 James R. Twine 11-Jun-02 9:21     I specifically mentioned ostrstream, not streams in general.  And it would be interesting to see how the streams in your case were being used, just to be sure that they were not being abused.    Peace! -=- James. "Some People Know How To Drive, Others Just Know How To Operate A Car." (Try Check Favorites Sometime!) Re: Buffer over-runs Tim Smith10-Jun-02 10:38 Tim Smith 10-Jun-02 10:38  After using them for a while, I basically came to the conclusion that these streams need to be redesigned fromt he ground up again. Nice start, but they have a lot of limitations (not to mention adding 50k to your program just so you can format a number). Right tool for the right job. Printf works just fine. Tim Smith I know what you're thinking punk, you're thinking did he spell check this document? Well, to tell you the truth I kinda forgot myself in all this excitement. But being this here's CodeProject, the most powerful forums in the world and would blow your head clean off, you've got to ask yourself one question, Do I feel lucky? Well do ya punk? Re: Buffer over-runs (clarification) Tim Smith10-Jun-02 10:49 Tim Smith 10-Jun-02 10:49  Ok, my real point to all this really isn't about if streams are better than *printf. They both work just find but only a fool wouldn't see that streams are safer. HOWEVER, my real point was that buffer overrun problems extend far outside the formatting of output and strings. Streams will go a long way to fixing these problems, but they won't even come close to correcting all buffer overrun problems. Tim Smith I know what you're thinking punk, you're thinking did he spell check this document? Well, to tell you the truth I kinda forgot myself in all this excitement. But being this here's CodeProject, the most powerful forums in the world and would blow your head clean off, you've got to ask yourself one question, Do I feel lucky? Well do ya punk? Re: Buffer over-runs James R. Twine10-Jun-02 4:03 James R. Twine 10-Jun-02 4:03     I think you mean sprintf(...), because the discussion is about buffer overruns...    And snprintf(...) is a simple way to prevent them.    Peace! -=- James. "Some People Know How To Drive, Others Just Know How To Operate A Car." (Try Check Favorites Sometime!) Re: Buffer over-runs John M. Drescher10-Jun-02 16:23 John M. Drescher 10-Jun-02 16:23  Tim Smith wrote: ostringstream As a MFC, ATL and WTL programmer I never use any streams at all. Although, I do use stl containers like map, list, set, and vector a lot. John Re: Buffer over-runs Chris Losinger12-Jun-02 7:44 Chris Losinger 12-Jun-02 7:44  at least use snprintf - to limit the number of chars to be put in the buffer. -c shh! the audience (and the NSA) is listening ISEffects - effects for images Re: Buffer over-runs Matt Gullett10-Jun-02 16:48 Matt Gullett 10-Jun-02 16:48  We should definitely use appropriate C++ classes for dealing with memory when raw performance is not needed. When raw performance is needed, though, there is no substitute for stack allocated C style arrays. And heap allocated C style arrays will still outperform any object oriented solution available today. I have experimented in one of my libraries with CString, std::string and TCHAR arrays and there is no doubt that TCHAR arrays delivered the best performance by far and in this particular system, performance was/is far more important than OOP. It definitely requires more work to make sure that it is done right and does not overwrite memory or access deleted memory but when needed it's the only way to go. Not near release Matt Newman9-Jun-02 16:15 Matt Newman 9-Jun-02 16:15  I haven't worried at all about security yet since I haven't gotten even close to a release version. - Matt Newman / Windows XP Activist -Sonork ID: 100.11179 Could you Would you with a goat? - Dr Suess Re: Not near release Andreas Saurwein10-Jun-02 4:25 Andreas Saurwein 10-Jun-02 4:25  Is that your way of telling you will tuck in security just before release? Well, then I would suggest some readings on that topic. Andreas Vote against software patents in europe Re: Not near release Matt Newman10-Jun-02 16:17 Matt Newman 10-Jun-02 16:17  Somewhat. I am trying to get the core of the program done first. However, say my program uses password autheticiation the CheckPassword() function doesn't do anything it just assumes it is okay and passes it on. When I get a functioning build (ie the starts doing it's function) I will make CheckPassword() actually check the password etc etc. For example the server I am working on accepts connections and nothing more so there isn't any need for security so far. - Matt Newman / Windows XP Activist -Sonork ID: 100.11179 Could you Would you with a goat? - Dr Suess Re: Not near release Andreas Saurwein10-Jun-02 21:30 Andreas Saurwein 10-Jun-02 21:30  I really suggest that you read some book on security (e.g. Writing Secure Code, MS Press). There is more to security programming than a CheckPassword() function. And since you mentioned a server, things like DoS and similar attacks come into mind. Think about Andreas Vote against software patents in europe Re: Not near release Matt Newman11-Jun-02 4:47 Matt Newman 11-Jun-02 4:47  Andreas Saurwein wrote: There is more to security programming than a CheckPassword() function I was just using that as an example. I do have to worry about DoS etc but my server doesn't really do anything that could be exploited yet. I was mearly saying that my project is in it's infancy and is even close to exposing criticaly information. Andreas Saurwein wrote: Writing Secure Code, MS Press Thanks for the book suggestion I will have to check that out. - Matt Newman / Windows XP Activist -Sonork ID: 100.11179 Could you Would you with a goat? - Dr Suess PARANOID ! Mauricio Ritter9-Jun-02 15:14 Mauricio Ritter 9-Jun-02 15:14  When you work in a bank... security is always an issue... I´m really paranoid with security... just as my bosses Mauricio Ritter - Brazil Sonorking now: 100.13560 Trank The alcohol is one of the greatest enemys of man, but a man who flee from his enemys is a coward. Re: PARANOID ! Komtiki10-Jun-02 18:55 Komtiki 10-Jun-02 18:55  I do GSM MO & BioMetric Solutions and security is really a big issue. Especially if you ship products worldwide!! Empowerment through development. If the development only WANTS TO WORK!! Security is overrated Jim A. Johnson9-Jun-02 9:52 Jim A. Johnson 9-Jun-02 9:52  I think we've gomne a little paranoid on security. I can't believe the number of places that expect me to supply a password these days. I've gotten to the point now that, if someone expects me to set up an account and supply a password in order to upload shareware to their site, I simply say "no". And I have a small set of passwords that I use for everything, along with a simple set of rules for deriving new ones. Maybe the security "experts" (parasites?) think this is a bad idea, but I have to live in the real world. Re: Security is overrated ColinDavies9-Jun-02 11:24 ColinDavies 9-Jun-02 11:24  Jim I keep a simple text file on my PC that has been encrypted by one password using a simple app. The text file contains all my accounts, Usernames/IDs and Passwords/ that I use. Darn boring but it works, All I have to remember is One Master Password and I have Access to the rest. "Maybe I should make a proper App that does this" Because I find it so darn useful. Regardz Colin J Davies Sonork ID 100.9197:Colin More about me Re: Security is overrated Kevin Stewart9-Jun-02 11:43 Kevin Stewart 9-Jun-02 11:43  There are actually a ton of password managers available for free that do this (even though I'm about to write one in C# just for the hell of it.) Search for "password managers" on Google and pick the one you like. Kevin Re: Security is overrated ColinDavies9-Jun-02 11:50 ColinDavies 9-Jun-02 11:50  I should have guessed they were already available. Regardz Colin J Davies Sonork ID 100.9197:Colin More about me Re: Security is overrated Rutger Ellen10-Jun-02 3:44 Rutger Ellen 10-Jun-02 3:44  Kevin Stewart wrote: There are actually a ton of password managers available for free that do this (even though I'm about to write one in C# just for the hell of it.) Search for "password managers" on Google and pick the one you like. Maybe they have a backdoor That would be a good reason to write one yourself Re: Security is overrated peterchen9-Jun-02 11:51 peterchen 9-Jun-02 11:51  Many web sites don't seem to require an account not dor security, but for acquiring your e-mail address... It's hard to scratch your ass when you sit on it.   [sighist] I miss... Daniel 'Tak' M.9-Jun-02 9:10 Daniel 'Tak' M. 9-Jun-02 9:10  "None - we just don't care" Access. ColinDavies8-Jun-02 18:33 ColinDavies 8-Jun-02 18:33  Most real security is real security not code. Like leaving passwords lying arround, easy passwords, File size checks. Logs etc. Regardz Colin J Davies Sonork ID 100.9197:Colin More about me Re: Access. Shog98-Jun-02 18:38 Shog9 8-Jun-02 18:38  I'm always amazed by how easily people will tell you their passwords. It's just not something that's taken seriously in a good many cases. -------- A common man's understanding of science. Not a normal common man's of course. A very smart common man's. -- Nish, on Science Writing Re: Access. ColinDavies8-Jun-02 19:40 ColinDavies 8-Jun-02 19:40  ring ring .. "Hello I'm John CrazyHorse from the special security detail can I check your details for an investigation we are doing for your employer." Actually hacking a network from the outside is quite difficult in comparisson. I know a lot of IT departments spend small fortunes on techo stuff, when they should be training employees on the basics. Regardz Colin J Davies Sonork ID 100.9197:Colin More about me Re: Access. SimonS9-Jun-02 4:06 SimonS 9-Jun-02 4:06  Colin Davies wrote: when they should be training employees on the basics You mean the infamous don't be dumb course? Cheers, Simon "Every good work of software starts by scratching a developer's personal itch.", Eric S. Raymond

Last Visit: 31-Dec-99 18:00     Last Update: 4-Jun-24 0:34 Refresh ᐊ Prev123 Next ᐅ

General    News    Suggestion    Question    Bug    Answer    Joke    Praise    Rant    Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.