Hot answers tagged

2

This is a Norton Security/Safeweb false positive. Their threat scanning engine is flawed when handling reponses from these 'hacked' URLs, which in vulnerable systems can do damage. The problem is that they interpret the response incorrectly, so sites that have no PHP/WordPress etc get flagged in error. This is hugely damaging to customer goodwill of course. ...


2

You're probably fine. SSH key-based login is designed to work over untrusted networks, without exposing key data - a VPN, even one which you don't control, doesn't change this. At no point in the sign-in process is the whole private key sent across the network - this would be a massive flaw in the system if it was the case, and would make SSH key login ...


1

You should not only protect yourself from XSS by scanning HTTP requests for attacks. Such a scan will never be complete, and there will always be some smart tricks that slip through the net. Your first line of defence must always be to properly sanitize untrusted data, so as not to create any XSS vulnerabilities in the first place. For how to do that, see ...


1

NGiNX SSL Session ID available in $ssl_session_id variable. Other NGiNX SSL variables can be found here, Embedded Variables section.



Only top voted, non community-wiki answers of a minimum length are eligible