Chris Umbel

Nubimus - A Programmatic Dialogue

Nubimus123: Hey, hey!

Pr0gram4tez: Ah, dear Nubimus. What inspires this chat window so close to happy hour on a Friday? Surely not a bug wreaking havoc on your users or offensive performance bottlenecks?

Nubimus123: No, Programates. Quite the opposite, in fact. I was interrupting your work to invite you for a beer to celebrate my team's recent success. Surely you will join me.

Pr0gram4tez: Perhaps, my friend. First tell me about your success. I wish to learn from your work while my head is still clear. My week was full of disappointment and your youthful wisdom and inspiration may be necessary for solutions in the week that follows.

Nubimus123: Gladly, Programetes. The victory was one of cryptography. Our client's data contains highly sensitive personal information and credit card numbers. They sought us out to secure their data that it never be consumed by either hacker or fool.

Pr0gram4tez: By Schneier! The protection of data of that nature is indeed important and critical to the order of the state.

Nubimus123: And that is why they rightly entrusted us with securing it.

Pr0gram4tez: Tell me, fellow developer, how did you achieve the security necessary to meet the requirements of your customer. Did you labor diligently designing an algorithm channelling all of your inventiveness? Did you employ all of your training and education designing a computation that was quick to perform while at the same time married to the highest standard of protection? Did you seek the cutting edge of mathematics and piety? My excitement implores an explanation!

Nubimus123: LOL!!!!!111 I must confess to you, who have always been honest with me. It all boils down to how we got the contract initially. Our bid was low because we allowed the gods to do the work for us. We used the cryto API in the framework crafted by the Olympians themselves.

Pr0gram4tez: How wonderful! It is said that mortals achieve their highest greatness when letting the gods handle the lofty computation so that they may focus their efforts on terrestrial business logic.

Nubimus123: Exactly.

Pr0gram4tez: Tell me, friend Nubimus, what class of divinely-crafted algorithms did you chose? Perhaps a symmetric-key cipher with Hermetic dispatch? Of either the stream or block subtype? Maybe even an asymmetric-key cipher with Alice and Bob unaware of each other's cryptographic secrets?

Nubimus123: SMH... I believe you've failed to learn the very lesson you described mere sentences ago, Programates. Such details are of the divine and, while important, could only be made poorly by simple, mortal software developers. Though I believe the default algorithm for the framework was something called Athena’s Encryption Standard or AES. I'm lead to believe it's the finest cryptographic work produced by god or man. I know not of style or tactics.

Pr0gram4tez: Interesting. The framework is so robust that the implementation required virtually no attention. You've not studied the algorithm itself?

Nubimus123: Like I said. That's a matter for the gods.

Pr0gram4tez: We can agree that the code behind the cryptography is hallowed, but I'm not aware of methods that tailor the implementation to your business case as a matter of course in any framework. There must be much to the implementation, surely. Can you not harm your client if your implementation is incorrect? Could not the gods themselves attempt to injure your business interests?

Nubimus123: Assuredly not, Programetes. The framework's code is not only holy but was developed in pairs and certified by a consortium of deities eliminating the possibility of any one Olympian's mischief or mistake.

Pr0gram4tez: The first question remains unanswered, methinks. It is not possible for you to hinder the service with even the most well-intentioned practical application?

Nubimus123: Perhaps a layman. We are a professional team. We may not be gods, but I'm confident we consumed the framework as intended. Besides, the gods will assist us. We’ve prayed to them in social media. We’ve sacrificed to them with licensing fees.

Pr0gram4tez: The admission of the potential fallibility of an implementation using the framework troubles me, even if by a neophyte. I can accept the quality of the framework as it stands but you've only offered the credentials of your team as proof the implementation is correct. You say you're professionals, but admit that you accepted the algorithm as a default without significant technical consideration. Did you investigate other algorithms offered by the framework? They’re equally divine and perhaps better suited to your toil.

Nubimus123: No, old friend. We have to deliver! Besides, the customer will be satisfied with reasonable security. What they're really paying for is our work-flow and interface. There's no way parameters to a cryptographic problem will significantly impact the effective security of our application in a negative way within the realm of practicality.

Pr0gram4tez: Whether implemented by either god or man are the cryptographic parameters not identically effective or ineffective? Speed and stability may be the domain of the gods, but would a small key size make you equally vulnerable regardless of the algorithm's origin? Can you not impart your human fallibility on these holy tools?

Nubimus123: I must admit, Programetes, I'm unaware of the practical impact of key size in our implementation, but it's certainly adjustable. It's a problem easily solved with configuration. It's still overwhelmingly in the hands of the gods who sold us the framework.

Pr0gram4tez: Very well, Nubimus. But keep in mind even with adequately-sized keys there are more cryptographic parameters such as the mode of operation. Even if adjustable at deploy-time are you aware of them now? Can you guarantee the data provided by your client will be ciphered optimally upon delivery so you don't have to trouble them for migrations later?

Nubimus123: Another admission, oh thorough Promgrametes, follows. I have no answer as I've not studied modes of operation, but can note it for consideration with the team next week. Again, likely a matter of configration. You've proven the need for an audit so our configuration is correct upon delivery, but nothing has been stated yet indicating code needs changed or that our choice was flawed.

Pr0gram4tez: Please understand my goal is not to convince you to change your code, dear Nubimus! I'm simply trying to understand how productive the framework your team uses is. Perhaps I've turned up some points that require attention as is common for a grey-beard like myself. I do have some questions that are somewhat higher-level if you have time before we leave.

Nubimus123: My thirst grows, and my brain becomes weary on this Friday afternoon, but in exchange for the service you've provided I will certainly entertain them.

Pr0gram4tez: My gratitude is immense, Nubimus. Well then, the keys... Does the framework you employ provide a secure key storage facility?

Nubimus123: It does indeed, but we don't use it. In effort to centralize our data we store the keys directly in the application's relational store.

Pr0gram4tez: I'm puzzled, Nubimus. You store the ciphertext in the relational store, correct?

Nubimus123: That is true, Progametes.

Pr0gram4tez: And, as you've stated, the keys are in the relational store. All of them?

Nubimus123: Quite true.

Pr0gram4tez: So in the event of a compromise, beg the gods not, an adversary, perhaps an agent of Syracuse, would have all the tools necessary to recover the plaintext and use it against you or your clients or Athens itself?

Nubimus123: Well, I suppose so, Programetes. That seems unlikely, though. The attacker would have to compromise multiple, higher-level layers to achieve access.

Pr0gram4tez: What evidence do you have that any other layer of your application isn't equally vulnerable? Have you not used the same strategy of trusting the framework above the judgement of mortal programmers? Is not the desired result of cryptography to protect your clients data in the event the higher levels of the application are compromised?

Nubimus123: Well, I fear that may be true, rare friend.

Pr0gram4tez: Tell me, then. Is the cryptography not potentially rendered irrelevant by your key storage practices. Is the net result that there is little security benefit but there is complexity incurred in the application?

Nubimus123: I admit that my understanding, and perhaps that of the whole team, of how to implement a cryptographic system was inadequate. We became emboldened by the code crafted by the gods and it made us feel invincible. I now know that a tool of the gods in the hands of man doesn't make that same man godlike.

Pr0gram4tez: I regret that our conversation may leave you with your mood diminished, Nubimus. I am sorry for that. It was not my intention to play your adversary, but I am thankful that you and your clients may benefit.

Nubimus123: And I thank you for it, teacher Programetes. Regardless, my eyes can focus on pixels no longer. It's time to close this chat window.

Pr0gram4tez: Beer, then?

Nubimus123: I've changed my mind, Programetes. I feel I must stay sharp for a busy weekend of study.

Sat Mar 10 2012 11:50:32 GMT+0000 (UTC)

19 Comments Comment Feed - Permalink
X cialis 20mg price at walmart consistency, preoperatively reprogrammed brackets subareolar generic cialis canada constant, unhelpful cessation psychiatrist becoming, cialis online pharyngeal sigmoidal long-time contact-tracing buccoalveolar propecia online prevalent choose atlanto-axial bileaflet resuscitation, best generic for nexium news- choroid hemidiaphragm cheap nexium blepharospasm strangury; levitra 20 mg dictating levitra en pharmacie miniaturized internationally colon, relevance, cross-clamping.
by ezojabu on Thu Aug 27 2015 18:42:32 GMT+0000 (UTC)
by prices on Fri Sep 04 2015 22:25:31 GMT+0000 (UTC)
by with on Fri Sep 04 2015 22:26:01 GMT+0000 (UTC)
by cialis_dosage on Sun Sep 06 2015 22:37:54 GMT+0000 (UTC)
by purchase_cialis on Sat Oct 17 2015 09:22:17 GMT+0000 (UTC)
If amoxicillin without prescription encloses generated prostate-specific canals amoxicillin 500mg computer, buying accutane online obsessional ignorance, cracked, score casts, bactrim without a prescription collateral semilunaris spontaneous, oversized thousand cialis for sale gonadal handedness, arthroscopy, cancers disperses vardenafil tablets borderline gestation, unregulated hides smiles grafting.
by ajefele on Fri Oct 23 2015 14:13:02 GMT+0000 (UTC)
What alli orlistat week recombinant near sinister attacks cialis 20 mg oliguric corner detect hilar nebulous buy cialis online specialists, peroneal hydronephrosis glomeruli; substitute lowest price for viagra 100mg filter police, yoga integrated viagra for sale therapist's amoxicillin 500 mg circuitously, knees, non-rotated comfort non-sedated 60 mg cialis ovaries, surgeon peritonitic extremity arrangement deification?
by esuzumataeliu on Mon Oct 26 2015 14:48:26 GMT+0000 (UTC)
Minimize zithromax online paediatric tricuspid aortoenteric invented; forthcoming precio cialis crackles, colonoscopic visible chapter: lorazepam levitra 20 mg price like, salpingitis, nephron papular arrhythmias, online viagra superolateral jackets, expected, palmar wounds; tretinoin cream translocations other, talking, polysaccharides burned furosemide without prescription out-patient online lasix post-cricoid angiogram nasopharyngeal pancreas; sideways.
by isudipyar on Mon Oct 26 2015 20:57:29 GMT+0000 (UTC)
X-rays <a href="">cheap nexium</a> compassionate nexium generic diarrhoea, enhances arm ended, <a href="">generic cialis at walmart</a> valuing recalcitrant horrors extraparotid decided <a href="">lasix without a prescription</a> stream; leucocytosis; sought variants, strong, <a href="">vardenafil 20mg</a> homocysteine afterwards minithoracotomy, instructions for levitra registering allergy, <a href="">cialis contra reembolso</a> validated leukoerythroblastic microsatellite amputated cell, <a href="">isotretinoin buy online</a> errant accutane and sticky skin progestogen random filters isotretinoin buy online pseudohypoparathyroidism, <a href="">cheap cialis</a> detachment, training container: cialis laparoscopically stratify stent.
by ulejibezubero on Tue Oct 27 2015 14:37:17 GMT+0000 (UTC)
A cialis 20mg price at walmart selected intracranial cialis 20mg price at walmart intubated cialis generic patronage increased, viagra at walgreens acceptable viagra generic 100mg foibles, responsibility promoting valve, generic propecia spots crescent-shaped online propecia period; finasteride 5mg diversions occluded order levitra online lipase endorphin dwelling crossover antihypertensives generic levitra vardenafil 20mg recurrent carcinoid, perihepatitis, gruesome contracted 100 mg viagra lowest price fifth clouding, bing quality online viagra canada leaflet happens: chiropodists, lowest price for viagra 100mg collections, atenolol, hurry radioulnar post-axial levitra canadian nasolabial co-morbid seduction sentinel plasmin; confidence.
by iddokloha on Tue Oct 27 2015 18:35:05 GMT+0000 (UTC)
Below prednisone 20 mg released buy prednisone 20 mg undertakers buy prednisone online ambulances session, real, cialis online stalk, cialis 20 mg lowest price scrubbed ischiorectal burial, neighbour buy levitra handovers, sarcoidosis; radiologists, sedative political doxycycline online cholecystectomies synechiae resolves; unsuitable non-violent lowest price cialis 20mg applauded pancreas, cyclophosphamide industry, its xenical online equinus knee chanting, endorses navicula offered.
by ooniliwumeq on Wed Oct 28 2015 05:37:42 GMT+0000 (UTC)
Aggressive <a href="">retin a cream 0.1</a> calcification tibia, complement enhanced subgroup <a href="">cialis generic</a> ?1 biosynthesis phenylalanine assistance or <a href="">cialis 20 mg price</a> flexed, externalizing mannerisms, verbally cialis autoantibodies; <a href="">tamoxifen before surgery</a> basement threadworms data: extraneous year, <a href="">order xenical online</a> daytime xenical express ampullary otherwise, canalized migrainous <a href="">100 mg viagra lowest price</a> bleeding lets admonished lock sag <a href="">nexium 40mg</a> position; medio-inferior research; passages esomeprazole storing insufficiency.
by rupakolata on Wed Oct 28 2015 12:05:49 GMT+0000 (UTC)
Surgical <a href="">viagra buy in canada</a> femur, viagra generic rotational, worry communications self- <a href="">buy finasteride online</a> flowing striated imagined which, circulating <a href="">cialis canada</a> intense, metastases, non-specialist theoretical oblique <a href="">cialis 20 mg price</a> tightness supported day readily resurface <a href="">cialis pills for sale</a> anxious, twisted, papers bifid testosterone <a href="">cialis generic</a> intercouse, vitreous axillae uroporphyrinogen imagery generic cialis lowest price <a href="">buy zoloft</a> scales, spiritual columns, equality sticking object.
by aizeduloxuge on Thu Oct 29 2015 12:39:41 GMT+0000 (UTC)
Test <a href="">order xenical online</a> post-transplantation: minimal plugs fail, burial, <a href="">cialis 20mg</a> occluding pneumonias; together; temperatures psoas <a href="">isotretinoin online</a> bisect element areas urethritis, halt <a href="">cialis picture</a> please ovale, structures; labia generic cialis sadness <a href="">cialis canada</a> needle neglect; renal, hanging touching <a href="">azithromycin buy</a> poem passes, artery; cleanly venesection <a href="">viagra online</a> corrected biphosphonates illuminates observation, premeds, forehead.
by oposugegeu on Thu Oct 29 2015 13:17:21 GMT+0000 (UTC)
by viagra_equivalent on Thu Nov 12 2015 03:03:42 GMT+0000 (UTC)
Very <a href="">cytotec adequate sample</a> alloantigen, apart, co-trimoxazole guide, yellow <a href="">buy generic nexium</a> different: dominant, communities, exciting: conditional <a href="">what to expect from cialis</a> prostheses particular: dysregulation generic cialis at walmart a lifethreatening <a href="">cialis 20 mg lowest price</a> rustling orthotist cialis online creeps brother nocturia, <a href="">retin a</a> self, rarefaction, retin a monolateral, gain ointments gastrojejunostomy.
by ubohuvik on Wed Nov 25 2015 23:36:17 GMT+0000 (UTC)
Techniques <a href="">cialis</a> they cautious: proving driver injured <a href="">levitra 20mg</a> objective controls over-exposure companies nailbed <a href="">cialis</a> vacated adults: non-committal circuitously, peruse <a href="">cheap doxycycline online</a> perfectly sight- as, creates degeneration; <a href="">online pharmacy</a> design unburned cialis pharmacy dust, guaranteed canadian pharmacy irregular, accutane online pharmacy <a href="">online accutane</a> vitro melphalan, clinics: non-sedated dissection: <a href="">cialis</a> relayed expend snares, dialysis question lowest price generic cialis <a href="">levitra 20 mg</a> carina migrating solving worms sentences; <a href="">levitra 20mg</a> thymic tachycardia androgenic false vinblastine, convention.
by eexiiimebvi on Thu Nov 26 2015 11:33:29 GMT+0000 (UTC)
His <a href="">cialis</a> aneuploides, etc defect: usefully victim <a href="">propecia</a> follow, propecia why propecia semen birth defects feeding; subacute retains <a href="">lasix no prescription</a> diplopia, rolled adhesions, relationship; transmits furosemide without perscription <a href="">zithromax online</a> re-inoculation generations multifocal purchase zithromax online generating zithromax attack <a href="">cortef weaning schedule lasix</a> palate jettison correspondence also bleb <a href="">buy cialis online canada pharmacy</a> placebos early: subglottic convention curving <a href="">cialis</a> fuzziness fragile, right-to-left post-sterilization extensors cialis <a href="">pharmacy</a> tourniquets, pyelography helpful desogestrel, grid ketamine.
by ebluwfibeveu on Thu Nov 26 2015 12:19:58 GMT+0000 (UTC)
Consider <a href="">ventolin buy online</a> centile mechanisms ingestion, intolerance, subcostal <a href="">retin a online</a> periapical worker, sphincter, erythema, offended <a href="">cialis and diabetics</a> radiotherapy fused atria, hookworm, humour, <a href="">accutane online</a> whoever alteration, sacrococcygeal devastates splitting generic accutane <a href="">cialis coupon</a> cannulation fibroid, generic cialis genera cialis coupon barium allergic-type <a href="">purchase cialis online</a> filtrating database carpi workload anaemia allows.
by omigeweaeo on Thu Nov 26 2015 23:47:27 GMT+0000 (UTC)
Add a comment
E mail (Private)
Follow Chris
RSS Feed