Reputation
3,471
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
Badges
7 21
Newest
 Yearling
Impact
~192k people reached

Jan
29
comment White list or black list sanitation for international input?
@O'Rooney, try the Normalization FAQ, the Normalization section in the "Unicode security guide". The Unicode Security Considerations is also good, but a bit eye-glazy.
Nov
19
awarded  Yearling
Oct
13
comment Is this a good hash function?
This doesn't look like a secure hash function so manufacturing a collision is trivial. The rotate amount (4) is a factor of the byte size so any zero high-bits from ASCII text tend to collect which increases the chance of accidental collision. It avoids multiplication so it may consume less power than something like Java's builtin String hashCode.
Oct
13
revised Is this a good hash function?
formatting
Jul
24
awarded  Constituent
Jul
21
awarded  Caucus
Jun
3
awarded  Nice Answer
Nov
19
awarded  Yearling
Sep
30
awarded  Explainer
Sep
24
awarded  Autobiographer
Sep
1
revised Does an established SSL connection mean a line is really secure?
added 246 characters in body
Sep
1
answered Does an established SSL connection mean a line is really secure?
Aug
28
comment How can document.referrer be used for XSS?
@MichaelBlake, sorry, I misunderstood which part was the payload and which was the container.
Aug
27
comment How can document.referrer be used for XSS?
assigning to innerHTML doesn't run <script>s. Try <img onerror="..." src=bogus> instead.
Aug
27
answered Does CSRF prevention also prevent reflected XSS attack?
Aug
25
comment CSRF vulnerability in CGI/shell script web interface of hardware
@SilverlightFox, Does the safe method convention in RFC 7231#4.2.1 sound like the right term to you?
Aug
25
revised CSRF vulnerability in CGI/shell script web interface of hardware
edited body
Aug
25
comment CSRF vulnerability in CGI/shell script web interface of hardware
@SilverlightFox, Good point. I suppose the HTTP DELETE method is idempotent if it succeeds silently when its target address does not refer to anything, and PUT is idempotent since it overwrites, but allowing DELETE and PUT cross-origin while disallowing POST would surprise many. Will edit.
Aug
19
answered What's the inverse of sandbox security pattern?
Aug
12
revised Can installing Snort make me vulnerable?
formatting