lkml.org 
[lkml]   [2000]   [Feb]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Capabilities
On Sat, Feb 26, 2000 at 03:06:33AM +0000, Alan Cox wrote:
> > > The catalog too - consider what happens when part numbers get scrambled -
> > > ordering an inexpensive video card could get switched for an entire PC.
> >
> > Yes, but that is far less damaging than compromising the credit card numbers
> > and whatnot of the entire customer base.
>
> Anyone directly exposing databases of credit information on their internet
> machines deserves a negligence suit.
>
> A proper setup looks like this
>
>
> --[firewall]---[Web box] -serialline- [backend]
>
> The serial line takes a fixed command set to a verified small code daemon on
> the backend side. It has commands for 'store credit details' it has NO
> command for 'retrieve credit card number'. You don't need that functionality
> on the front end boxes.

Wouldn't it be nice if everyone did this. Sadly, from experience, I know
that few "professional" website companies do it properly like this.

For a start, most people writing code are really bad at it, and wouldn't
know how to build this setup. 99 out of 100 web programmers are dolts.

Second, people purchase websites based on cost, so developers who ignore
security can sell cheaper, and inevitably they do get more contracts.

Third, far too many customers *expect* to be able to read credit details
of sales via their browser. They go elsewhere when (not if) I say no.

I won't neglect to mention the large Australian web company who not only
has credit card details available on their main web server, but uses IIS
as web server software. I won't say who: the last good samaritan to tell
a large Australian corporation about a gaping security hole was sued.

PS: before somebody tries to steal all the credit details from any of my
websites (!) be forewarned that it's because of the above reasons that I
refuse to do "e-Commerce" for my customers without using third party web
credit card validators. These third parties have the proper setup.

--
Nathan Hand - Chirp Web Design - http://www.chirp.com.au/ - $e^{i\pi}+1 = 0$
Linux users aren't rebelling, we've already won - All Hell Can't Stop Us Now

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:56    [W:0.070 / U:0.304 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site