3,062 reputation
417
bio website
location
age
visits member for 3 years, 8 months
seen 2 days ago

Interested in web application security and programming languages.


Jul
23
comment Has personal computing security gotten better or worse in recent years?
Maybe you could define "more secure" first. Perhaps, more secure means less likely to be prevented from engaging in a major life activity as a result of a cyber-attack. Any exploit that caused loss of reputation leading to loss of employment or marriage, drove someone to suicide, or made one a pariah within a community. Unfortunately, I don't think such things are tracked. Absent good data, you're left with claims of loss from businesses which have an incentive to inflate their claimed losses for insurance purposes.
Jul
23
comment Are password complexity rules counterproductive?
possible duplicate of XKCD #936: Short complex password, or long dictionary passphrase?
Jul
17
revised Difference between secure design patterns and a generic coding guidline?
added 24 characters in body
Jul
17
revised Difference between secure design patterns and a generic coding guidline?
added tag:defense
Jul
17
answered Difference between secure design patterns and a generic coding guidline?
Jul
17
comment How does arbitary code execution work?
We may have two different views, but hasn't "there is no such thing as an abstract vulnerability" been demonstrated false by counter-example?
Jul
17
comment How does arbitary code execution work?
As a further example, driving a tank, or wearing Ned Kelly-style armor would seem to be defenses against a range of bringing a knife to a gunfight style vulnerabilities, even though that doesn't help a blackhat figure out how to convince the sheriff to carry a knife instead of a gun.
Jul
17
comment How does arbitary code execution work?
maybe not from the black-hat side, but if defense mechanisms (like turning on ASLR or using SQL prepared statements) tend to be effective against whole classes of vulnerabilities then they are useful from the white-hat side.
Jul
17
comment How does arbitary code execution work?
What do you mean by "there is no such thing as an abstract vulnerability." Bringing a knife to a gunfight seems like an abstract vulnerability while bringing my Leatherman multi-tool to a gunfight against Billy the Kid at the OK Corral tomorrow at noon seems like a concrete instance of that abstract vulnerability.
Jul
17
revised How does arbitary code execution work?
added 126 characters in body
Jul
17
revised How does arbitary code execution work?
added 224 characters in body
Jul
17
revised How does arbitary code execution work?
added 224 characters in body
Jul
17
revised How does arbitary code execution work?
added 277 characters in body
Jul
17
revised How does arbitary code execution work?
added 277 characters in body
Jul
17
answered How does arbitary code execution work?
Jun
28
comment Is open-to-all CORS safe for non-cookie-based authentication schemes (e.g. OAuth)
@bananapeel, if token storage is done by the middleman, is it in an origin that is accessible from an origin that you serve complex HTML on, or does the middleman gate access to it somehow?
Jun
28
answered Is open-to-all CORS safe for non-cookie-based authentication schemes (e.g. OAuth)
Jun
27
comment Authenticating without a database
@Jan, Yeah. I just read the link from the OP closely. What's the usual protocol? Delete the answer or leave it so searchers who interpret the question differently can find it?
Jun
27
awarded  Nice Answer
Jun
26
revised Authenticating without a database
added 39 characters in body