Andy Smith

1,470 reputation

316

bio	website	andrewmichaelsmith.com
	location	United Kingdom
	age
visits	member for	2 years, 3 months
	seen	2 days ago
stats	profile views	53

Software Developer

	1,470 reputation	bio	website	andrewmichaelsmith.com	visits	member for	2 years, 3 months
316 badges		location	United Kingdom		seen	2 days ago

summary answers questions tags badges favorites bounties reputation activity

131 Actions

suggestions reviews revisions comments badges posts accepts all

Mar 28	comment	What is zero day? Isn't this a grey area - we know buffer overflows exist but that doesn't discount every new buffer overflow because "oh, we know about buffer overflows already". So therefore should we be discounting a new SQL vulnerability in Jon's Cat Blog? It seems odd to refer to that as an 0day, however.
Mar 18	comment	How would one crack a weak but unknown encryption protocol? I'm possibly being a bit pedantic here but isn't it "as good as nothing" rather than being "worse than nothing"?
Mar 8	comment	What are the disadvantages of Tor? So you're proposing limiting SSH login to only allow it from Tor? I'm not quite sure how you'd implement that but even if it is possible what's the point? It would be far better/simpler to limit SSH login to your I.P address(es). Also, as anyone can use Tor you're not really restricting people from accessing it - just obscuring it a little
Feb 10	awarded	Yearling
Jan 21	comment	How unlikely is it that a Google Doc link is guessed? And not forgetting the link hanging around in someone's browser history
Jan 15	comment	How can I tell whether this computer is part of a botnet? If it's a virus it's a very poorly written one! Is it possible that someone has installed some legitimate software that has these as dependencies? It sounds like unxutils.sourceforge.net. It's possible there are some programs out there that needs these installed
Jan 10	comment	Why do some antivirus programs find infections that others miss? @illsecure don't do this! VirusTotal is a great tool but anti-virus tools do more than just scan executables (such as use of heuristics). See prevx.com/blog/106/… for more information.
Jan 8	answered	Writing malware in java?
Jan 7	answered	Question about XSS example
Dec 12	answered	Where can I find worm traffic sample?
Dec 11	comment	Banking application login leaks information "If the username exists then show image" - I think here you've made an assumption that I have personally never seen. Usually it is the case that "if the username and password is correct then show image"
Nov 20	accepted	What XSS attacks doesn't “Reflective XSS Protection” defeat?
Nov 16	comment	What XSS attacks doesn't “Reflective XSS Protection” defeat? So what I guess what I'm really interested to know is are there any evasion techniques that mean that by design reflective XSS protection won't work? Is it just going to be a game of catch up forever or has someone found a really tricky evasion mechanism that webkit could not block for x reason
Nov 16	comment	What XSS attacks doesn't “Reflective XSS Protection” defeat? So are there any examples of such bypasses? Is there such a bypass that for some technical reason cannot be blocked? Or can all be eventually blocked?
Nov 16	comment	What XSS attacks doesn't “Reflective XSS Protection” defeat? And of course I have notified the owner of the website of the issue! :)
Nov 16	asked	What XSS attacks doesn't “Reflective XSS Protection” defeat?
Nov 1	comment	Use HTTP POST for Google Search queries For this specific question using a POST request is pointless but there are cases where it improves security. GET URLs are kept in the browsers history and may be obtained at a later date. Obviously with a search query this makes no different - the history will contain the resulting page which will also contain the query. But in the case of credit card data (for example) this should stay in the POST request, even on HTTPS!
Nov 1	comment	Is it necessary to scan users' file uploads by antivirus? I agree that anti-virus is over kill but perhaps running some kind of normalization on the data before passing it to the parser might reduce risk.
Oct 13	awarded	Popular Question
Oct 13	comment	I stupidly responded to an email from a hacker posing as a friend Sounds like you're fine - the only thing I can see happening from this is your email address being starred as someone to phish again :). Keep your passwords different and complicated, you'll be fine.