902 reputation
210
bio website security.stackexchange.com
location United States
age 34
visits member for 1 year, 11 months
seen Oct 16 at 1:33

I'm a programmer that does some security work. I went to school for security stuff and have a stack of certifications. I hope to be a useful contributor to the community.


May
3
comment What is the difference between a Gateway and a Firewall?
This type of question can be easily answered with a simple web search. As you continue to learn more about security it will help to be proactive about searching out for the answers yourself. In addition to being faster you'll also gain more domain knowledge as you expose yourself to more technical detail, rather than only getting 'pre-chewed' information. Best of luck in your endeavors.
Apr
17
comment Bypassing Web Application input validation
Maybe, but not in practice. shrugs Firewalls that look for this type of stuff generally look at it two ways; known encoding schemes and statistical algorithm analysis. Everything is everything 'in theory', that doesn't make it a good idea to try and identify it all. IMO.
Apr
16
comment Sharing Nmap scan results in a web page
fair enough :-)
Apr
16
comment Sharing Nmap scan results in a web page
I guess you could use some of the msframework utilities to present nmap logs but isn't that kind of like swatting a fly with a howitzer?
Apr
5
comment What does this injected code do?
@D3C4FF: ups for a great response.
Mar
21
comment How do cellphones discover wireless APs?
The phone will initiate the connection utilizing information contained in the beacon frame OR that is pre configured in the device. For example, you might have a private AP that isn't broadcasting. Your phone could still connect to that AP if you know certain information, such as the ESSID. Once the device(phone) negotiates a connection to the AP it is connected to that network and 'normal' networking protocols take over. The device does initiate the connection, but the AP is identified (re: your question) through a beacon frame or direct specification.
Mar
12
comment Should I use SSL on my database server?
I would say yes. Remember that your web server is on a public facing network and it is going to be broadcasting back to your DB in one fashion or another. I also suspect that your database does have a public facing aspect since you're getting to it from your web server, but I don't know how rackspace sets up their kit. It's possibly worth looking into how your services are structured but yes, I'd still recommend using SSL/TLS.
Mar
7
comment Are password complexity rules counterproductive?
Look up 'BatteryHorseStaple', XKCD. xkcd.com/936 if you're lazy :-P
Mar
6
comment Is there a need to define “language safety”?
Fair enough @jarnbjo but they are two distinct aspects of the VM and each has a discrete utility. Hence; comment and not dv :-P
Mar
6
comment Is there a need to define “language safety”?
The java sandbox is a construct of the jvm and has nothing to do with a browser other than that browser utilizing a jvm. Also, the majority of the problems that have been uncovered with java have very little to the with the 'sandboxing mechinism' but have exposed inconsistent and/incompatible implementations of the security manager.
Mar
5
comment How does one go about network forensics investigation with no prior knowledge?
I reserve the right to be a curmudgeon, thank you very much +asadz. Oh, and get off my lawn. :-P
Mar
5
comment How does Google get information about FTP servers - and how to avoid it?
This is not a security question, rather this question concerns how Google's web spidering process works. This question would be better suited for webmaster.se or plain old SO.
Feb
18
comment How and where can I best announce an XSS vulnerability in a relatively well-known website?
I completely forgot about ZDI. Upps for a good link, +Gufran.
Feb
18
comment How is distributed computing security ensured?
I understand where you could be confused with this, it's a big problem domain. Perhaps it would help to ask something to the effect of 'is there an industry standard security model for distributed computing systems?' If that were your question I might have pointed you toward NIST SP 800-144, or something like that.
Feb
18
comment How and where can I best announce an XSS vulnerability in a relatively well-known website?
+Matrix has a good point. It's a bit off topic but I would never provide a disclosure without a two party MOU in place. onion networks are great an all but if a company comes after me I don't want to hide. I want to humiliate them in a very public way :-)
Feb
18
comment How is distributed computing security ensured?
This question seems really broad. Distributed computing is achieved in a myriad or ways and there really is no 'one true answer' to the question as phrased. Furthermore data acuity 'How do they ensure that the result they get is the result of the calculus they asked?' is more a function of the implementing system design than of security. Please refine.
Feb
12
comment PHP injection on 777 file
@Rook, fair enough. On the whole I would agree with you in relation to most scripting languages but PHPs capacity to demolish an application or even a system elevates it to full fledged evil in my mind. Different strokes for different folks I guess.
Feb
11
comment PHP injection on 777 file
@Rook, I'm sorry... Maybe I misread that. "Runtime code injection isn't a 'real' vulnerability?" You may want to take that one over to academic.so, I think you have a new thesis statement there.
Feb
11
comment PHP injection on 777 file
Cory, possibly not helpful but you get the ups for the cut of your jib :-P
Jan
29
comment How can I find websites owned by a particular company?
No. I provided a reference. The main page of the website makes it very clear what the service provides. If you refuse to think for yourself I can't really feel too bad about it.