bstpierre

2,947 reputation

1418

bio	website	blog.bstpierre.org
	location	United States
	age	38
visits	member for	1 year, 11 months
	seen	Mar 31 at 15:57
stats	profile views	65

Hey

	2,947 reputation	bio	website	blog.bstpierre.org	visits	member for	1 year, 11 months
1418 badges		location	United States		seen	Mar 31 at 15:57

summary answers questions tags badges favorites bounties reputation activity

209 Actions

suggestions reviews revisions comments badges posts accepts all

Dec 12	suggested	suggested edit on SIEM system, what are the benefits?
Dec 10	comment	How can I convert my encypted PGP secret key for use performing SSH authentication? @JeffBurdges: web.monkeysphere.info
Dec 8	comment	Can web sites detect whether you are using private browsing mode? @SonnyOrdell: I think my answer is full of enough disclaimers that it's obvious the short answer is "no". As I mention in my comment/questions on the OP, I think the real answer depends on what the web site operator wants to do with the detection.
Dec 8	answered	How dangerous is it that there are DNS entries for our domain that we did not register?
Dec 7	comment	How can I keep my identity anonymous as a website owner/administrator? +1 for the 2nd para: if you're using tor, you can increase the circuit length and use new circuits frequently (MaxCircuitDirtiness). +1 for the suggestion to firewall everything outbound except for the proxy port (this is valid for tor as well as SSH). -1 for the last para -- beware relying on, for example, Blogger.com for anonymity: Google operates in many countries and may be forced by a local government to hand over data (e.g. China).
Dec 7	comment	How to guarantee that password is hashed on server-side? @RoryAlsop: I like the contractual idea -- do you know of anyone putting language like this, say, in their privacy policy or TOU?
Dec 6	comment	On-line cryptographically signed date/time? Is there anything preventing you from operating a service that meets your exact specifications? You're willing to pay, and it seems likely that you could assemble it from freely available components and host it yourself. Linode (for example) runs about $200 a year; depending on your requirements you may be able to use a cheaper host.
Dec 6	comment	How can I keep my identity anonymous as a website owner/administrator? +1 but beware that you should only access your VPS, email, and registrar via HTTPS: TOR exit nodes could snoop your login credentials if you connect via plaintext.
Dec 6	answered	Proxy vs. Firewall
Dec 6	answered	Listing of DNS vulnerabilities
Dec 6	revised	Listing of DNS vulnerabilities fix grammar
Dec 6	suggested	suggested edit on Listing of DNS vulnerabilities
Dec 6	comment	Install my own proxy My past experience has been with openssh on cygwin. But it's been a long time since I've used windows heavily. You might start with this: sshwindows.sourceforge.net -- or post a question (maybe on superuser or serverfault?) about windows ssh servers
Dec 5	comment	Install my own proxy @50ndr33: Windows, linux, Mac, other?
Dec 5	answered	Install my own proxy
Dec 5	accepted	Filter user input before the database or upon display?
Dec 5	comment	Filter user input before the database or upon display? This is an excellent answer. You managed to read between the lines of my question and covered all of the relevant points. I especially appreciate the "why" -- I knew this intuitively but hadn't formulated in the way you have.
Dec 5	revised	Filter user input before the database or upon display? clarify my intent
Dec 3	comment	Filter user input before the database or upon display? Indeed. About an hour after I posted the question I found a spot where an output variable wasn't escaped.
Dec 3	comment	Filter user input before the database or upon display? Good list of the issues with escaping input. FWIW, this isn't my code -- I'd definitely use a framework. At least with a framework, it's easier to inspect for places where the developers either use low-level functions, or circumvent the framework.