1,391 reputation
29
bio website
location Netherlands
age 35
visits member for 2 years, 8 months
seen Jul 2 '13 at 12:31

Nov
14
awarded  Nice Answer
Aug
4
awarded  Yearling
Jul
2
answered A DOM-based XSS is a vulnerability in the application or in the browser?
Jul
2
comment Hash(master + hostname) password scheme for a server pool
@Gilles: /dev/urandom "reuses" entropy from /dev/random, and while this is sufficient in most cases, the blocking that /dev/random suffers from is not generally a problem when interactively generating a single password, so I prefer to be on the safe side in this case.
Jan
18
comment What is the technique to determine if a user is “reading” a page called? (similar to “infinite scroll”)
For the record, I consider it one of the worst usability innovations of the past decade.
Jan
14
comment Any recipient can modify an order confirmation mail, right? Does this ever matter ?
@Polynomial: John doesn't have to. If John says it should be $10, but customer says it's $9, then someone with some technical clue can tell the real one from the forgery through the signature. John doesn't have to be that person.
Jan
14
answered Are image uploads also vulnerable to sql injection?
Nov
21
answered Why block outgoing network traffic with a firewall?
Sep
14
comment XSS : Blacklist characters vs. whitelist
@Luc: You probably mean the right thing, but the wording is a bit misleading. Things you store in the database are output, just like things you send to the client, and you need to supply both in the appropriate format (SQL syntax, HTML, etc.). Things you read from the database and things you receive from a client are inputs, and while you validate and possibly restrict those, you don't escape them; if anything, you translate from POST fields or whatever encoding you receive to your internal encoding (typically UTF-8).
Sep
14
comment In PGP, why not just encrypt message with recipient's public key? Why the meta-encryption?
@adlwalrus: I send encrypted mail to multiple recipients all the time. Not specifically mailing lists though.
Sep
14
comment XSS : Blacklist characters vs. whitelist
+1. "Sanitize your inputs" does not mean "store HTML-encoded text in your database".
Sep
14
comment XSS : Blacklist characters vs. whitelist
Escaping input and output is wrong; you will be escaping twice, and that is practically never correct.
Sep
14
comment How to mitigate the risk of a continuous integration service security breach?
Don't you do any manual testing before you deploy?
Sep
14
comment How to mitigate the risk of a continuous integration service security breach?
The race condition is easily averted by keeping track of which version passed CI.
Sep
5
comment Has any virus attempted to compromise the anti-virus database?
"But e.g. if a virus wrote itself to e.g. a usb storage device and you left it plugged in, the BIOS could boot from that device and you be hosed." - shouldn't boot-from-usb be disabled in any sane BIOS configuration anyway?
Aug
4
awarded  Yearling
Jul
9
comment How should I tell an organisation that they are vulnerable when I wasn't given permission to check?
Yes, but the problem is that by using the WiFi without permission, OP already trespassed. The fact that the WiFi was completely unsecured does not matter in this regard.
Jun
1
revised Should passwords be revealed in error message?
added 204 characters in body
Jun
1
answered Should passwords be revealed in error message?
Jun
1
comment Should passwords be revealed in error message?
@symcbean: Does the term 'in-depth security' ring any bell?