451 reputation
1312
bio website
location Austin, TX
age 35
visits member for 3 years, 8 months
seen 1 hour ago

I'm currently studying for a Master's in Information Assurance and plan to concentrate on software security.

I'm here to try (and sometimes fail) answering questions; to deepen my knowledge and meet people to code projects with.

Thanks for reading!


15h
answered VM production server and low entropy
Apr
9
comment Static code review approach
It's been almost a year. Can you select an answer?
Mar
25
awarded  Famous Question
Feb
19
comment How is it possible to embed executable code in an image
+1: thanks Microsoft! && Because Windows!
Jan
29
comment Understanding Java Security Providers
@dave_thompson_085 You are correct. I deleted my answers to questions 2 and 3 and directed readers to your answer. (I was really hoping to prod any kind of an answer here after two months...)
Jan
29
revised Understanding Java Security Providers
removed the blatantly incorrect portion of my answer and ceded to the better one.
Jan
28
answered Can a Java servlet filter be used to pull out scripts that aren't whitelisted?
Jan
28
answered Understanding Java Security Providers
Jan
2
awarded  Curious
Oct
27
comment Solution to allow JavaScript input but prevent XSS
+1 for showing one of the most non-obfuscated but still obfuscated XSS attacks I've ever seen.
Oct
27
comment Solution to allow JavaScript input but prevent XSS
Actually you have an auditing issue that @jrwren really opens right up for you. At a bare minimum, you're going to want some kind of versioning on any source code that a user submits and that you store. If you don't, and say that code IS used to launch attacks--you will at least be able to say when that piece of code was added, and be able to roll back to a known "good" state.
Oct
22
accepted How negative are virtual machines (vms) to /dev/urandom?
Oct
17
comment How negative are virtual machines (vms) to /dev/urandom?
So in answering the concrete question, "How badly does moving to a virtual machine harm entropy?" Its essentially subjective due to the total # of possible bits we lose in the move?
Oct
17
comment How negative are virtual machines (vms) to /dev/urandom?
Updated for a more concrete form of the question.
Oct
17
revised How negative are virtual machines (vms) to /dev/urandom?
added 60 characters in body
Oct
17
comment How negative are virtual machines (vms) to /dev/urandom?
@ThoriumBR Well, the results I got here were taken from one of our virtual machines. We use vmware, if that helps.
Oct
17
asked How negative are virtual machines (vms) to /dev/urandom?
Oct
17
comment Is a rand from /dev/urandom secure for a login key?
@NickJohnson run the following command on any linux machine: cat /dev/urandom | rngtest -c 1000 several times. IF its a vm (as many server environments are now) you'll fail FIPS compliance about every other run.
Jul
27
comment Exchange 2013 blocks txt file attachments - are there security reasons?
What about the simple hiding of file extensions? malicious.txt.exe ? Does exchange account for this?
Jul
23
comment security metrics on softwares developed
And if you're worried that these papers are just too aged, David Bell wrote "Looking Back at the Bell-La Padula Model" in 2005, and linked the problems in the 1970s to problems today.