I just read through the PHP Zend Certified Engineer study guide, and found at least 5 questions that have at least partially incorrect answers. (1 was grossly incorrect)

@ircmaxell can you share an example?

I've never seen the test nor the guide, so I'm interested

@ircmaxell Heh, no surprise there, lol.

Escaping output may help protect from which common security
vulnerabilities? (Choose 2)


A: Clickjacking
B: Cross-Site Scripting
C: Cross-Ste Request Forgery
D: SQL Injection

The answer it says is B and D

But I stand that B and C are correct, since all XSS vulnerabilities are autoamtically CSRF vulnerabilities

To be honest, I don't know what the exact definition of "Clickjacking" is

Mmmmm re B and C, that may be down to interpretation, thinking.....

I think it's a specific type of XSS vulnerability

Well, is SQL output? I think B and C is more practical of an answer than B and D

I would argue that it does not protect against all forms of CSRF

It definitely does not protect against all forms of CSRF

But if you don't, it can open up CSRF

@ircmaxell true

so it does add a layer of protection against it

@ircmaxell true. And it says "may help protect"

Which differs from "gives protection against".

right

I would like to know their reasoning for excuding C then.

which is why I stand by that C is more correct than D

Yeah, or basically, B, C and D

Looking up what A is

Yeah, if they said all 3, then I'd be fine

Um.... technically speaking, and maybe I'm looking at it a bit too narrowly, couldn't it protect against all of those?

Yeah, if you buy that clickjacking is a subset of XSS, then all 4 are correct

again, if you consider SQL output

@GeorgeMarian I still don't understand the difference between Clickjacking and XSRF

Maybe the term "Clickjacking" is used in the context of malicious pages

care to explain?

Not malicious injections into good pages

@What Clickjacking doesn't necessarily have to be cross-site. Say, within a Facebook application.

@GeorgeMarian ah, true, true

@balpha owasp.org/index.php/…

So, click-jacking is basically redirecting the user's click to something other than what they believed they were clicking on.

right.

Either that. or logging the click through a third party service

@ircmaxell hmm -- okay, in that definition -- probably true.

Yeah, which is why i don;t like their answer

well, I disagree with the definition

> It is imperative that no XSS vulnerabilities are present to ensure that CSRF defenses can't be circumvented.

oh?

Yeah, this stinks. You can't make questions that are open to interpretation multiple choice

@ircmaxell it's also imperative that you lock the door to the bank to prevent people from stealing money. that doesn't mean that opening the door is stealing.

For example, I could think of a clickjacking example that is caused by incorrectly escaped HTML, which proper escaping would protect against

@balpha Well, not really. Since if you have an XSS vulnerability, you cannot protect against CSRF at all. So it's a little bit different...

@What Yeah, agreed. At least that are this open...

@ircmaxell I don't disagree with that. My point is that those are two different attack vectors, even if they can be used together. (I also agree that the question sucks, by the way)

Well, but let's look at something more traditional

A buffer overflow can be used for arbitrary code execution. Does that mean that it's wrong to say that without securing all buffers you might be susceptible to arbitrary code execution? They are 2 different attack vectors, but one can enable the other.

I'd say that depends on whether data from outside being processed or not.

@ircmaxell Sure, but ensuring that you've dealt with all buffer overflows doesn't necessarily mean that you're protected from arbitrary code execution.

@ircmaxell Yes, and that explains why that test questions sucks (which I agree with). But it doesn't say that code execution is a subset of buffer overflow exploits or the other way around.

Absolutely

@GeorgeMarian Right, it's a one way dependency. But there does exist a link between them, and that's my point.

Sure, but not all buffer overflows can be exploited for arbitrary code execution.

True, but not all XSS can be CSRF (but most can)

That basic issue is one oversimplification.

Well, at least we agree that the question sucks

lol

Yes, indeed. I have a beta copy of that guide (v1.3) and I have lots of issues with what I've seen.

Do you have one of the non-beta versions?

v1 which is available from the site

It is freely available?

cool

The free one or the one that comes w/ the voucher purchase?

@What AFAIK, no. I found the link to a beta version in webinar I watched about the new test for PHP 5.3.

@What zend.com/en/services/certification/php-5-certification

on the right column

That one is freely available.

@ircmaxell thanks

Np

Just scheduled myself for the ZCE exam on Tuesday

Was the exam still $195 (USD)?

yeah

After this, I'm thinking about going for CompTIA Security+

So if they say output encoding protects against sql injection, they a) consider sql commands to be output, and b) encourage to forget the whole parametrization idea. Am I reading that right?

Yup

Hmm...those a-holes. The webinar tried to make it seem like that was the reason for the increased price of the cert. (Not I believed it.)

Nice

@GeorgeMarian What was the reason?

So, that version of the guide is a slightly better version that the one I had. It has some additional content and the formating as been cleaned up.

@ircmaxell To make more money off it, of course. :)

I don't know the real reason. Their costs may have also increased.

Ahhh

Well, I know Pearson isn't cheap as a testing center

I think they charge like $100 or $150 per exam for themselves

It was one of the questions that came up in the webinar and the presenter kinda flubbed his way through it.

"Well, now it comes with this great guide so you don't have to purchase that yourself." or something to that extent.

lol

I'm not paying $1000 for the Test Prep

Damn it, this cold or w/e is really cramping my style and I have an interview tomorrow.

@ircmaxell Yeah, that's nuts. Maybe if an employer was paying for it.

possibly

but it better include in-person training for that price

Right. But, I have a feeling it's a webinar. lol

yeah

which isn't worth it IMHO

nods

Yay! AT&T is buying T-Mobile. Now I am back with AT&T for the third time in a decade. I just can't freaking get away

/facepalm

Probably better than tiny almost useless government telco...:P

yeah. I liked T-Mobile up unitl this. Need to find a new carrier now

has had just about enough of these excessively paranoid credit card verification systems.

German news present this as a good thing

because T-Mobile going to the US was a waste of money

fair enough

hah

Verizon > All.

Eih

3g is way too slow on VZW

and no modern Google Experience Android phones == they don't have me as a customer anymore

Agreed... LTE for my next phone. Seems everyones drooling over the Thunderbolt all of a sudden.

I want stock android. No blur, no other garbage sense.

Android is incredible, I'm loving it... Never had an easier more enjoyable OS.

Ah, well then you have to get involved, rooted, and start flashing things. I'm running a rom called SuperClean 2.9.1, and it doesn't have any bloated crap from samsung or verizon.

Plus it's Froyo, which still hasn't been released officially for the Fascinate.

I'm on Gingerbread

What phone? There's an alpha GB for the Fascinate with a new release coming within days.

Nexus S

You have a Nexus S?... You could compile from source.. it's bloated?

Not in the least

@ircmaxell Perhaps I misunderstood your original comment.

I could ROM it, but I haven't yet (there's no features I would gain that I want)

@Fosco No you didn't. Every decent android phone they have has a bloated ui on it

Ok... they come stock with a bloated ui, yes they do.

they do? Which?

I was agreeing with you :)

Ahhh, ok

Gingerbread is about everything I could want

tethering (free), FAST, etc

Woot! Devils won again!

Hi

sup

Tired. Working on several apps. The world goes round.

You, @ircmaxell?

Not bad.

chilling

good to hear

App idea:

app idea:

An app that allows you to bookmark times in your audio file.

So you can start from where you left off.

interesting I guess

@Fosco, @ircmaxell thoughts?

very good idea for audiobooks.. usually if I download one, it's just one big mp3

I've got a money making application in mind (not a cell-phone app, but a regular desktop app)

@ircmaxell Good for podcasts, speeches and lectures. Not so practical for songs.

Well, yeah

@ircmaxell Good luck with it.

@Fosco Exactly. I'm almost done with it. My cousin emailed me with this request last Thursday actually.

Thanks. Boarderline ethical, but legal...

@ircmaxell Do tell! :)

@ircmaxell - ?

A smart poker playing bot, and set it free on the poker sites...

@ircmaxell Haha

Well, I think I could build one that's pretty dam good

Been there, done that... :) Very very hard, and also very risky.

Well, it depends on your approach how hard it is

very risky, yes

I played with that stuff years ago, had a lot of fun... wrote various rulesets and expected value calculators, etc..

I never played poker, maybe once. Wouldn't know.

I love it

Not my thing.

hrm, I thought print was a function in PHP

nope...

php.net/manual/en/function.print.php

yeah, it's a language construct

oh ok I see what you meant.

Even I knew that.

:-)

@Moshe lol :)

Well, I'm still too tired to think.

I want to make something stupid like Coin Dozer, with stupid in-app purchases, to take stupid money from stupid people.

@Fosco Well I know an iOS developer who is willing to work for a ... fee.

Ok Moshe... I'd like to talk officially about contracting out an iOS app.

is not sure if @Fosco is continuing the joke or is serious

Do you Skype?

I don't. I google talk or AIM.

apparently he's serious

The first four lette - eh, moshberm

Of course I'm serious )

google talk or AIM

opens chat client

invited

For those reading the transcript, this conversation has moved to another part of the interwebs, allegedly protected by SSL, passwords and ultimately, big brother Google.

/me hacks @Moshe's email account to view the conversation

ignores @ircmaxell, but pings him

Yes?

whistles

Hiya all.

senses deja vu

@Fosco - there?

Something strange just happened.

It's all good.

Ok

closes safari