network profile
| bio | website | |
|---|---|---|
| location | Netherlands | |
| age | 35 | |
| visits | member for | 1 year, 10 months |
| seen | Jan 18 at 12:14 | |
| stats | profile views | 32 |
|
Jan 18 |
comment |
What is the technique to determine if a user is “reading” a page called? (similar to “infinite scroll”) For the record, I consider it one of the worst usability innovations of the past decade. |
|
Jan 14 |
comment |
Any recipient can modify an order confirmation mail, right? Does this ever matter ? @Polynomial: John doesn't have to. If John says it should be $10, but customer says it's $9, then someone with some technical clue can tell the real one from the forgery through the signature. John doesn't have to be that person. |
|
Jan 14 |
answered | Are image uploads also vulnerable to sql injection? |
|
Nov 21 |
answered | Why block outgoing network traffic with a firewall? |
|
Sep 14 |
comment |
XSS : Blacklist characters vs. whitelist @Luc: You probably mean the right thing, but the wording is a bit misleading. Things you store in the database are output, just like things you send to the client, and you need to supply both in the appropriate format (SQL syntax, HTML, etc.). Things you read from the database and things you receive from a client are inputs, and while you validate and possibly restrict those, you don't escape them; if anything, you translate from POST fields or whatever encoding you receive to your internal encoding (typically UTF-8). |
|
Sep 14 |
comment |
In PGP, why not just encrypt message with recipient's public key? Why the meta-encryption? @adlwalrus: I send encrypted mail to multiple recipients all the time. Not specifically mailing lists though. |
|
Sep 14 |
comment |
XSS : Blacklist characters vs. whitelist +1. "Sanitize your inputs" does not mean "store HTML-encoded text in your database". |
|
Sep 14 |
comment |
XSS : Blacklist characters vs. whitelist Escaping input and output is wrong; you will be escaping twice, and that is practically never correct. |
|
Sep 14 |
comment |
How to mitigate the risk of a continuous integration service security breach? Don't you do any manual testing before you deploy? |
|
Sep 14 |
comment |
How to mitigate the risk of a continuous integration service security breach? The race condition is easily averted by keeping track of which version passed CI. |
|
Sep 5 |
comment |
Has any virus attempted to compromise the anti-virus database? "But e.g. if a virus wrote itself to e.g. a usb storage device and you left it plugged in, the BIOS could boot from that device and you be hosed." - shouldn't boot-from-usb be disabled in any sane BIOS configuration anyway? |
|
Aug 4 |
awarded | Yearling |
|
Jul 9 |
comment |
How should I tell an organisation that they are vulnerable when I wasn't given permission to check? Yes, but the problem is that by using the WiFi without permission, OP already trespassed. The fact that the WiFi was completely unsecured does not matter in this regard. |
|
Jun 1 |
revised |
Should passwords be revealed in error message? added 204 characters in body |
|
Jun 1 |
answered | Should passwords be revealed in error message? |
|
Jun 1 |
comment |
Should passwords be revealed in error message? @symcbean: Does the term 'in-depth security' ring any bell? |
|
Jun 1 |
awarded | Citizen Patrol |
|
May 31 |
comment |
Is TLS flawless enough to prevent eavesdropping carried out by an ISP? There is also the risk of unencrypted e-mail passing between mail servers, which is completely out of your hands unless you encrypt your e-mail on top of TLS. |
|
Apr 28 |
comment |
Haskell and Happstack security You are right, it's not exactly what I was looking for, but good reading still. Thanks! |
|
Apr 27 |
awarded | Student |
