Reputation
3,599
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
Badges
1 9 26
Newest
 Yearling
Impact
~236k people reached

Dec
21
comment Finding security consultant for doing in-depth code review?
In my experience in development (not focusing on security issues), code review is hands-down more efficient than testing. It seems longer, but when you find a a bug in a code review, it's generally a straight line to a fix versus debugging to find the problem based on a test failure. Review also tends to be more complete than testing, and finding+fixing bugs before the product leaves the building is literally 100x cheaper than after they've been found by a customer. Security bugs probably have an even bigger multiplier.
Dec
21
awarded  Enthusiast
Dec
20
answered rsa certificate authorities
Dec
20
revised Multibyte character exploits - PHP/MySQL
deleted 16 characters in body; edited tags
Dec
20
answered How can I check wifi activity?
Dec
20
answered How to see whether the pcap contains RTP traffic?
Dec
20
revised How can I keep my programmer collegues informed about security issues?
formatting
Dec
20
revised Why do we authenticate by prompting a user to enter both username and password? Does prompting the password only suffice?
fix typo
Dec
20
comment Are passwordless SSH logins more secure?
Possibly of interest: gnome-keyring ssh agent timeout -- make the keyring "forget" your password when the screensaver kicks on. You can also do ssh-add -t3600 to make ssh-agent drop your key after an hour.
Dec
19
comment Killing IP connections who “spam” with requests
@JeffFerland: I don't think so: the regex in the filter file will only match the URL(s) that you specify. So an innocent user requesting 200 images+scripts+css all at once won't be affected, just the malicious request for the same "content.html" 10 times in 30 seconds (or whatever N times in M seconds the OP wants to set as a bound). Just as long as the filter file doesn't specify a broad wildcard to match all the embedded content that an innocent user is going to pull on each page load.
Dec
19
revised Killing IP connections who “spam” with requests
clean up filter comment
Dec
19
comment Killing IP connections who “spam” with requests
and: serverfault.com/questions/310599/…
Dec
19
comment Killing IP connections who “spam” with requests
See also: serverfault.com/questions/208341/…
Dec
19
answered Killing IP connections who “spam” with requests
Dec
19
comment Time server security error
When the administrator makes a decision to jump the time, it happens under the control of the administrator. That's ok. When some unknown/untrusted server jumps the time, that's not good. The administrator can make a decision to do this when the system is not in use, or he can warn users, or he can force the system to reboot so that any affected applications will be restarted.
Dec
19
answered Time server security error
Dec
19
revised How can I keep my programmer collegues informed about security issues?
fix typos
Dec
19
revised Policy requirements of Sarbanes-Oxley (SOX)
fix copy/paste, add quoting
Dec
18
answered Secure PXE network OS installation
Dec
18
revised Firefox Add-ons: “x” as Add-on name?
embed image