902 reputation
210
bio website security.stackexchange.com
location United States
age 34
visits member for 1 year, 9 months
seen Jul 29 at 1:11

I'm a programmer that does some security work. I went to school for security stuff and have a stack of certifications. I hope to be a useful contributor to the community.


Mar
7
comment Are password complexity rules counterproductive?
Look up 'BatteryHorseStaple', XKCD. xkcd.com/936 if you're lazy :-P
Mar
6
comment Is there a need to define “language safety”?
Fair enough @jarnbjo but they are two distinct aspects of the VM and each has a discrete utility. Hence; comment and not dv :-P
Mar
6
comment Is there a need to define “language safety”?
The java sandbox is a construct of the jvm and has nothing to do with a browser other than that browser utilizing a jvm. Also, the majority of the problems that have been uncovered with java have very little to the with the 'sandboxing mechinism' but have exposed inconsistent and/incompatible implementations of the security manager.
Mar
6
awarded  Informed
Mar
5
comment How does one go about network forensics investigation with no prior knowledge?
I reserve the right to be a curmudgeon, thank you very much +asadz. Oh, and get off my lawn. :-P
Mar
5
answered How does one go about network forensics investigation with no prior knowledge?
Mar
5
awarded  Critic
Mar
5
comment How does Google get information about FTP servers - and how to avoid it?
This is not a security question, rather this question concerns how Google's web spidering process works. This question would be better suited for webmaster.se or plain old SO.
Mar
5
answered Is there any way I can block (or conditionally approve of) iFrames on the client side?
Feb
18
comment How and where can I best announce an XSS vulnerability in a relatively well-known website?
I completely forgot about ZDI. Upps for a good link, +Gufran.
Feb
18
comment How is distributed computing security ensured?
I understand where you could be confused with this, it's a big problem domain. Perhaps it would help to ask something to the effect of 'is there an industry standard security model for distributed computing systems?' If that were your question I might have pointed you toward NIST SP 800-144, or something like that.
Feb
18
comment How and where can I best announce an XSS vulnerability in a relatively well-known website?
+Matrix has a good point. It's a bit off topic but I would never provide a disclosure without a two party MOU in place. onion networks are great an all but if a company comes after me I don't want to hide. I want to humiliate them in a very public way :-)
Feb
18
comment How is distributed computing security ensured?
This question seems really broad. Distributed computing is achieved in a myriad or ways and there really is no 'one true answer' to the question as phrased. Furthermore data acuity 'How do they ensure that the result they get is the result of the calculus they asked?' is more a function of the implementing system design than of security. Please refine.
Feb
18
answered How and where can I best announce an XSS vulnerability in a relatively well-known website?
Feb
12
comment PHP injection on 777 file
@Rook, fair enough. On the whole I would agree with you in relation to most scripting languages but PHPs capacity to demolish an application or even a system elevates it to full fledged evil in my mind. Different strokes for different folks I guess.
Feb
11
comment PHP injection on 777 file
@Rook, I'm sorry... Maybe I misread that. "Runtime code injection isn't a 'real' vulnerability?" You may want to take that one over to academic.so, I think you have a new thesis statement there.
Feb
11
revised PHP injection on 777 file
to make it readable
Feb
11
answered PHP injection on 777 file
Feb
11
suggested suggested edit on PHP injection on 777 file
Feb
11
comment PHP injection on 777 file
Cory, possibly not helpful but you get the ups for the cut of your jib :-P