Reputation
10,679
Top tag
Next privilege 15,000 Rep.
Protect questions
Badges
1 15 39
Newest
 Civic Duty
Impact
~356k people reached

10h
reviewed Close How secure a secured PDF really is?
10h
reviewed Leave Open What can a trusted certificate do?
10h
reviewed Close Samba - WebDAV - SFTP
10h
comment Can you get past a regex or whitelisting?
Hi, this seems to be a question about coding and regular expressions, and not really about information security. I've voted to migrate this question to Stack Overflow.
1d
answered Getting spam calls from numbers similar to my own
1d
reviewed Leave Open How much can we trust open source implementations of crypto (security) libraries?
1d
comment How much can we trust open source implementations of crypto (security) libraries?
While this may seem "opinion based", it's actually a very fair question. The question is not "which library should I trust?", it's "how do I select a trustworthy library?"
Feb
6
comment Ethical way to get past a proxy server?
Hi Aaron, this question belongs over on Superuser, so we're voting to migrate it to that site.
Feb
6
reviewed Reviewed Ethical way to get past a proxy server?
Feb
6
reviewed Leave Open Tracking a criminal on my website
Feb
6
reviewed Close Build host application for Thales payshield 9000 HSM
Feb
5
comment Why are self signed certificates not trusted and is there a way to make them trusted?
@duskwuff, that's exactly how an https proxy, such as BlueCoat, works. The organization buys the proxy, then installs the proxy's self-signed certificate in the trusted root store of each of the organization's computers. The proxy then MITMs all connections, including encrypted connections, to ensure that "bad things" aren't allowed to pass through the proxy.
Feb
5
reviewed Close How does DRM enforcement work (across different platforms)?
Feb
5
comment Is information disclosure in a form of a server header is a real vulnerability?
@IlyaChernomordik, no, reliability is not worth the effort. It's the difference between a "targeted attack" and a "target of opportunity." These attackers don't care which server they attack; as long as they get a new server the attack is worth it. So if they have a list of 1000 potential victims, they will blast the attack at all 1000 at once. Even if 900 are already patched, and 90 are mislabeled to throw off attackers, and 5 are honeypots, that means the attacker still controls 5 new servers. He doesn't care if he has some bad data, as long as it's effective enough.
Feb
5
answered Is information disclosure in a form of a server header is a real vulnerability?
Feb
5
reviewed Looks OK Why did Poitras and Greenwald put their batteries in the fridge?
Feb
5
reviewed Close Unauthorized Password Access
Feb
5
reviewed Close find unix command and NTFS Stream
Feb
5
reviewed Leave Open detect forged e-mail system for windows?
Feb
5
reviewed Close How does SMTP facilitate sending spam?