Re: PHP mysql_excape but need to search for those items

From	Jerry Stuckle <jstucklex@attglobal.net>
Newsgroups	comp.lang.php
Subject	Re: PHP mysql_excape but need to search for those items
Date	2012-06-16 09:25 -0400
Organization	A noiseless patient Spider
Message-ID	<jri1gf$5v4$1@dont-email.me> (permalink)
References	(8 earlier) <4FD98900.7040306@arnowelzel.de> <jrciir$o1h$1@dont-email.me> <4FDB9CC7.7070402@arnowelzel.de> <jrgm8i$rfe$1@dont-email.me> <4FDC28D0.6010500@arnowelzel.de>

Show all headers | View raw

On 6/16/2012 2:33 AM, Arno Welzel wrote:
> Jerry Stuckle, 16.06.2012 03:07:
>
>> On 6/15/2012 4:36 PM, Arno Welzel wrote:
>>>
> [...]
>>> To read more about:<http://www.kb.cert.org/vuls/id/800113>
>>>
>>> Just because you can not imagine that his happens in reality does not
>>> mean that you can ignore the problem.
>>>
>>
>> Quite frankly, I don't believe everything I see on the web.  Do you have
>> any proof this has actually occurred?
>
> A well documented security hole does not exist for you, as long as
> nothing worse happens to you?
>

Sure - but how "open" is this security hole?  How easy is it to take 
advantage of?

You can say the same thing about 256 bit encryption.  It's not secure - 
it can be hacked.  However, it would take all the computers in the world 
longer than the universe has existed to hack it.

Or every time I leave my house, there is the security risk that someone 
will break in and take everything.  So I guess I should never leave my 
house.

The fact is, "security holes" exist all around us.  Just because the 
possibility exists does not mean it is a vulnerability to be concerned 
about.

These holes require the hacker be able to execute a specific pattern of 
steps, which can easily be detected and prevented, as the cert.org 
article stated.  This patter can easily be detected and prevented.  And 
all of these security holes have had patches available for 4 years.  No, 
I don't consider these security holes to be significant.

> ["Trustworthy" CAs]
>>> VeriSign is also on the list of the CAs which had at least one security
>>> problem:
>>>
>>> <http://www.reuters.com/article/2012/02/02/us-hacking-verisign-idUSTRE8110Z820120202>
> [...]
>>> <http://www.thetechherald.com/articles/DigiNotar-security-incident-goes-from-bad-to-worse>
> [...]
>> Again, I don't believe everything I see on the Internet.   But I have
>> used both Thawte and Versign, and know what a company has to go through
>> to get a certificate.
>
> I know as well what it takes to get a SSL certificate signed by
> VeriSign. Not much... generally just money.
>
> On what base do you trust VeriSign or Thawte?
>

I trust them because I have several clients with their certificates. 
And it takes a lot more than just money to get the first certificate. 
Renewals aren't bad, because you already have proven who you are previously.

> [...]
>>> As i already said: Don't trust a CA, only trust (or don't trust) the
>>> certificate. If it changes your browser will immediately tell you - even
>>> if it was signed by a CA.
>>
>> So, what is your solution?  Just telling someone not to trust a CA is
>> not a solution.
>
> That *is* the solution, if the CA is not trustworthy.
>
>

That is not a solution.  But you don't have one.  All you can do is piss 
and moan.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

Thread

PHP mysql_excape but need to search for those items mrgushi <mrgushi@gmail.com> - 2012-06-11 08:34 -0700
  Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-11 17:54 +0200
    Re: PHP mysql_excape but need to search for those items mrgushi <mrgushi@gmail.com> - 2012-06-11 09:48 -0700
      Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-12 11:26 +0200
  Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-11 12:38 -0400
    Re: PHP mysql_excape but need to search for those items mrgushi <mrgushi@gmail.com> - 2012-06-11 10:01 -0700
      Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-11 13:54 -0400
        Re: PHP mysql_excape but need to search for those items "J.O. Aho" <user@example.net> - 2012-06-11 20:38 +0200
          Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-11 17:06 -0400
            Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-12 11:35 +0200
              Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-12 08:00 -0400
                Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-14 08:47 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-14 07:40 -0400
                Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-15 22:36 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-15 21:07 -0400
                Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-16 08:33 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-16 09:25 -0400
                Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-18 09:39 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-18 08:48 -0400
                Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-18 19:30 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-18 13:41 -0400
                Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-18 19:49 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-18 15:10 -0400
                Re: PHP mysql_excape but need to search for those items Michael Fesser <netizen@gmx.de> - 2012-06-18 20:21 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-18 15:11 -0400
                Re: PHP mysql_excape but need to search for those items Michael Fesser <netizen@gmx.de> - 2012-06-18 21:34 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-18 17:22 -0400
                Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-19 15:36 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-19 10:41 -0400
                Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-19 17:34 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-19 12:35 -0400
                Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-19 18:39 +0200
      Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-12 11:32 +0200
  Re: PHP mysql_excape but need to search for those items "Álvaro G. Vicario" <alvaro.NOSPAMTHANX@demogracia.com.invalid> - 2012-06-12 09:38 +0200

csiph-web