meta user
network profile
| bio | website | blog.bstpierre.org |
|---|---|---|
| location | United States | |
| age | 38 | |
| visits | member for | 1 year, 11 months |
| seen | May 21 at 0:41 | |
| stats | profile views | 66 |
Hey
|
Dec 25 |
revised |
Public wifi security protocols formatting and typos |
|
Dec 23 |
revised |
Is strip_tags() horribly unsafe? add link |
|
Dec 22 |
asked | Using “canaries” to detect intrusion? |
|
Dec 22 |
awarded | Electorate |
|
Dec 22 |
comment |
Why would the browser present the certificate for an unknown outside site? And: don't click through the warning! You may see this the first time each day because the address for the site you are trying to visit is not in the DNS cache. Refresh the page until you get to the right place. (Unfortunately, since these kind of DNS services don't follow standards, your browser/resolver may cache the response (for 10 minutes) so you may need to restart your browser and/or wait until the bogus response's TTL expires.) |
|
Dec 21 |
answered | How can you become a competent web application security expert without breaking the law? |
|
Dec 21 |
revised |
Strange STP traffic in my network, possible MitM attack? spelling |
|
Dec 21 |
comment |
Finding security consultant for doing in-depth code review? In my experience in development (not focusing on security issues), code review is hands-down more efficient than testing. It seems longer, but when you find a a bug in a code review, it's generally a straight line to a fix versus debugging to find the problem based on a test failure. Review also tends to be more complete than testing, and finding+fixing bugs before the product leaves the building is literally 100x cheaper than after they've been found by a customer. Security bugs probably have an even bigger multiplier. |
|
Dec 21 |
awarded | Enthusiast |
|
Dec 20 |
answered | rsa certificate authorities |
|
Dec 20 |
revised |
Multibyte character exploits - PHP/MySQL deleted 16 characters in body; edited tags |
|
Dec 20 |
answered | How can I check wifi activity? |
|
Dec 20 |
answered | How to see whether the pcap contains RTP traffic? |
|
Dec 20 |
revised |
How can I keep my programmer collegues informed about security issues? formatting |
|
Dec 20 |
revised |
Why do we authenticate by prompting a user to enter both username and password? Does prompting the password only suffice? fix typo |
|
Dec 20 |
comment |
Are passwordless SSH logins more secure? Possibly of interest: gnome-keyring ssh agent timeout -- make the keyring "forget" your password when the screensaver kicks on. You can also do ssh-add -t3600 to make ssh-agent drop your key after an hour. |
|
Dec 19 |
comment |
Killing IP connections who “spam” with requests @JeffFerland: I don't think so: the regex in the filter file will only match the URL(s) that you specify. So an innocent user requesting 200 images+scripts+css all at once won't be affected, just the malicious request for the same "content.html" 10 times in 30 seconds (or whatever N times in M seconds the OP wants to set as a bound). Just as long as the filter file doesn't specify a broad wildcard to match all the embedded content that an innocent user is going to pull on each page load. |
|
Dec 19 |
revised |
Killing IP connections who “spam” with requests clean up filter comment |
|
Dec 19 |
comment |
Killing IP connections who “spam” with requests and: serverfault.com/questions/310599/… |
|
Dec 19 |
comment |
Killing IP connections who “spam” with requests See also: serverfault.com/questions/208341/… |
