3,877 reputation
11235
bio website ladadadada.net
location London, United Kingdom
age 34
visits member for 3 years, 10 months
seen 6 hours ago

I'm an Australian by birth but currently live in London. I'm a traveller at heart and I love seeing how different the rest of the world is. I'm always up for something new and interesting.

I've been playing with computers pretty much my whole life, working with them since 2000 in tech support and programming and as a full-time Sysadmin since 2006. I've been fascinated by security since about 2003 and I tend to become the default "security guy" at most places I have worked.

I enjoy all forms of sport and outdoors activities but particularly cycling, hockey, sailboarding, snowboarding, camping and Frisbee. I'm also passionate about the environment, growing my own food, cooking it and eating it.

https://twitter.com/ladadadada


Dec
15
revised Should I be worried about this url request I received on my site?
Formatting and spelling.
Dec
9
answered POODLE attack against TLS vulnerability
Dec
7
revised How can this web server be compromised?
added 155 characters in body
Dec
7
answered How can this web server be compromised?
Dec
1
comment Weird characters from contact page
That validation of the form fields you're doing before "forwarding" to thankyou.php, is that done using Javascript?
Dec
1
revised Weird characters from contact page
Formatting, removed unnecessary fluff.
Dec
1
comment Weird characters from contact page
The HTML5 "required" attribute is a client-side control. Browsers more than a couple of years old don't have it at all. No spam bot will ever implement it. You should enforce field validation in the target PHP script (which, if I understand correctly, is thankyou.php). It might help if you included the code from thankyou.php in your question.
Nov
25
reviewed Close Weird characters from contact page
Nov
25
comment Weird characters from contact page
You're probably right. Bots are better at solving CAPTCHAs (even ReCAPTCHA) than humans are these days. And bots don't have to be anywhere near as good as humans to make it economical if there's no rate-limiting in place.
Nov
21
reviewed Approve How does WebID fit in the SAML picture?
Nov
19
revised Ipsec connection fails
Formatting and spelling.
Nov
5
answered Can the attacker launch a sufficiently large SYN flood to overwhelm the victim's server?
Sep
30
awarded  Explainer
Aug
27
awarded  Scholar
Aug
27
accepted How should I choose a difficulty factor for my password hashing function?
Aug
11
comment REST API: does securing the first call with a CAPTCHA make sense?
You want to use email addresses as an identifier without verifying that the user owns the email address? Why use emails? Why not just let your users choose a unique username and use that as their identifier?
Aug
4
awarded  Nice Answer
Jul
23
comment what type of attack does LOIC do?
According to the screenshot, you can enter a URL which suggests it can also do HTTP flooding.
Jul
22
awarded  Enlightened
Jul
19
comment How do I report a vulnerability?
@SteveDL Yes, and Kaminsky's bug was too but the implementation was common to multiple DNS vendors. djbdns was not affected. Heartbleed was in library code so it too affected multiple vendors. Those were examples of bugs that were dealt with in secret with the vendors so that the exploitability window could be small. A protocol bug would be handled in a similar way.