561 reputation
412
bio website blog.ircmaxell.com
location New Jersey
age 30
visits member for 3 years, 6 months
seen yesterday

I'm a developer who focuses in and with experience in and . I also specialize in , , and general development methodology and practice. I also have experience administrating both Windows and Linux machines.

You know you understand when everything not only makes sense, everything feels right

Check out my Resume over on Careers.StackOverflow


Jun
22
awarded  Notable Question
Feb
8
awarded  Scholar
Feb
8
accepted Timing Safe String Comparison - Avoiding Length Leak
Feb
5
comment Timing Safe String Comparison - Avoiding Length Leak
So, would something as an analog to the above (even with its potential length leak) be sufficient and beneficial in your opinion? Seems to be the general trend here.
Feb
5
awarded  Nice Question
Feb
3
comment Timing Safe String Comparison - Avoiding Length Leak
@mikeazo: I figured it was crypto simply due to it normally applying to practical implementations of crypto. If you could move it, it would be much appreciated! Thanks!
Feb
3
comment Timing Safe String Comparison - Avoiding Length Leak
For the record, this is related to an RFC for PHP to add a safe comparison function to core.
Feb
3
asked Timing Safe String Comparison - Avoiding Length Leak
Aug
24
awarded  Announcer
May
10
awarded  Yearling
May
1
awarded  Popular Question
Apr
12
awarded  Good Question
Mar
15
awarded  Commentator
Mar
15
comment Is request signing (digesting the request body) in a REST API necessary?
You might get better luck asking this question on security.stackexchange
Mar
13
comment Is $_SERVER[ ] a safe source of data in PHP?
@Rook: Minor note, but relying upon REMOTE_ADDR requires that your web server be properly configured as well. Sometimes it can be controlled...
Mar
13
comment Is $_SERVER[ ] a safe source of data in PHP?
@symcbean: I think you missed the point of my post. My point was that you should never trust anything outside of the source code of your application. This includes things coming from external sources that you "supposedly" can trust (like REMOTE_ADDR). Sure, it's hard to compromise PHP itself, but I was talking about second and third order compromises which leverage bugs (which can exist anywhere) and the nature that your app uses trusted data. Trust nothing is the only safe way to write code...
Mar
12
answered Is $_SERVER[ ] a safe source of data in PHP?
Oct
18
comment Bank forces me to use six character alphanumeric password
Well, if it's case insensitive, either they are storing it plain text, or they are lowercasing it prior to hashing. So I doubt they are really hashing at all... Prob storing plain text and doing a LIKE check in SQL...
Sep
23
awarded  Nice Answer
Sep
14
awarded  Editor