17,156 reputation
974235
bio website lamontconsulting.com
location New York, NY
age 37
visits member for 3 years, 8 months
seen 34 mins ago

The following message is ROT26 encrypted:

SSL isn't good enough. Your website can be hacked.
Help solve the problem by advocating these RFCs:

TLSA (formerly DANE for DNS) Fixes the hackable CA problem

TLS-OBC: Fixes TLS, and the Related Domain Cookie Attack


About me


See ...my LinkedIn profile

Bitcoin: 1Ev4VoQYqZzJa1YvDCyUxFjpFhtK34evHk


Feb
22
comment Whitelisting DOM elements to defeat XSS
Your link says that it's the "old and crusty" version of CSP. I think the new one is at the w3c: dvcs.w3.org/hg/content-security-policy/raw-file/tip/…
Feb
22
comment How should I serve untrusted / unsanitized documents (PDF, DOC, XLS) to end users over the web?
@DW I realized I didn't formulate my question correctly. I've changed it substantially. See my comment to Avid above. Originally, I was attempting to re-purpose your answer for securing images in my first question to general documents since I thought they can be exploited with similar mechanisms (depending on the software and "trust zone" involved).
Feb
22
comment How should I serve untrusted / unsanitized documents (PDF, DOC, XLS) to end users over the web?
@AviD I was getting ahead of myself, and did this Jeopardy style. My underlying question is "how to I secure document transmission over the web", my assumed answer was to "convert it into a "Safe" format". I've edited the question; do you think I altered it too much and had best delete it and start over?
Feb
22
revised How should I serve untrusted / unsanitized documents (PDF, DOC, XLS) to end users over the web?
deleted 1003 characters in body; edited title
Feb
22
revised How should I serve untrusted / unsanitized documents (PDF, DOC, XLS) to end users over the web?
added 428 characters in body; edited title
Feb
22
comment How should I serve untrusted / unsanitized documents (PDF, DOC, XLS) to end users over the web?
@GeorgeBailey - I'm ultimately looking for a conversion exe that can run locally or on a server, and has some programmatic interface I can leverage. Lacking that, I'll suffice with command line switches. (If the TOS permits, I may wrap the Google Docs service into an EXE)
Feb
22
revised How should I serve untrusted / unsanitized documents (PDF, DOC, XLS) to end users over the web?
added 428 characters in body; edited title
Feb
22
comment How should I serve untrusted / unsanitized documents (PDF, DOC, XLS) to end users over the web?
I've never explored Google Docs, but like the idea of neutralizing content ... even if that final format is HTML. I would think HTML in a browser would be more risky than other formats. Is there have a converter that converts all text into the markup StackExchange uses?
Feb
22
comment Which files are more insecure than others?
Notepad isn't totally immune... See this (patched) bug relating to Unicode when the following sentence is saved "This app can break" or "Bush hid the facts". More info here...
Feb
22
revised How should I serve untrusted / unsanitized documents (PDF, DOC, XLS) to end users over the web?
added 7 characters in body
Feb
21
comment Help to account all the points of physical access to a rack server to steal software
Thanks; I asked the second set of questions (Are you more concerned about Intellectual Property/Code or Private Keys) since you may be able to protect your interests using software. I know people that are using the Azure Service Bus to allow "local" access to a remote server doing stock analysis. The algorithms are kept "private" in a trusted datacenter, and the namespaces keep the client and server anonymous. This all happens with transport encryption.
Feb
21
asked Blackberry QNX / Playbook encryption details
Feb
21
asked How should I serve untrusted / unsanitized documents (PDF, DOC, XLS) to end users over the web?
Feb
21
comment C# Image.FromStream is that secure?
@AviD - Yes, I started researching the question and saw how similar this is to the other questions. The only think that prevented me from flagging this as a duplicate is that this Q is was scoped to a particular .NET API, and not broad like the others. Also Yaniv is new to Sec.SE and may have not expected quality answers elsewhere on the site.
Feb
21
revised C# Image.FromStream is that secure?
added 10 characters in body
Feb
21
comment How can I be protected from pictures vulnerabilities?
@symcbean Whats a compression bomb, and when would it happen?
Feb
21
revised C# Image.FromStream is that secure?
added 10 characters in body
Feb
21
revised C# Image.FromStream is that secure?
added 624 characters in body
Feb
21
comment Help to account all the points of physical access to a rack server to steal software
Are you more worried about private key theft, or intellectual property? What kind of app is this? Why does the business require your code in this hostile location?
Feb
21
comment Help to account all the points of physical access to a rack server to steal software
Curious... Is this actually a "hosting company", a "customer", or another department within a mega-corporation? How does this hoster know so much about your app?