2,030 reputation
11428
bio website syskall.com
location Montreal, Canada
age
visits member for 3 years, 5 months
seen Apr 9 at 17:08

I am an aspiring entrepreneur, founder of Voz Labs, an agile web development shop and lead developer / founder of dORM, a PHP object relational mapper. I write on syskall.com.

E-mail: olalonde AT gmail DOT com
Twitter: http://www.twitter.com/o_lalonde
LinkedIn: http://www.linkedin.com/in/olivierlalonde


May
27
comment Is it safe to have a DNS record pointing to 127.0.0.1?
I also use Vagrant and I fail to see in what way Vagrant solves that problem since modifying the hosts file in the VM won't let the host machine use that domain.
May
26
comment Is it safe to have a DNS record pointing to 127.0.0.1?
> Has each developer their own development server and does each one work on their own local copy? Yes.
May
26
comment CSRF protection and Single Page Apps
I'm not using Django but I re-used the jQuery code in their documentation (I use Node.js). Is it safe to just use X-Requested-With if CORS is disabled? Also, is there a case where you would want to protect against cross origin requests if you explicitly allow them in your same-origin policy?
May
26
comment CSRF protection and Single Page Apps
Thanks for the answer. I am wondering though why it is recommended to have an expiry on tokens. I was under the impression that refreshing tokens was only a means to prevent accidental double form submits.
Jan
10
comment What is your default umask set to?
@nealmcb they should be separated by far more than unix file permissions. most of them don't get shell access.
Dec
1
comment How much does a security audit cost?
I knew this would be a highly controversial answer but well, I was the only one who had the guts to throw out a number and actually answer the question :) My estimate of LoC/hour was a broad average since not all code is equally prone to vulnerabilities. The most critical parts might get you down at 100 LoC/hour while we the less critical parts (HTML/Javascript/domain model) can be mostly skipped. Anyways, it all boils down on how well the application is designed and documented.
Nov
22
comment Is it possible to take down a site using javascript in the URL bar?
If you're going to execute Javascript on an arbitrary page I suggest you use Firefox's Firebug extension (console pane).
Nov
18
comment What are the pros and cons of site wide SSL (https)?
@AviD: SSL for the whole site vs just login page
Nov
15
comment How much money does it take to equip a fully funded black hat team? How much money to defend against such a team?
I would say the hackers' salaries look pretty low assuming they are from developed countries.
Nov
15
comment Startup security
I've appended my answer to include some code related tips ;)
Nov
15
comment Startup security
@AviD done! feel free to up vote :D
Nov
13
comment How to open a file from the Internet in a secure way?
It's all about the way it's worded. First, OP didn't mention an OS which clearly hints he is not a professional and second, he plainly said "on my computer".
Nov
13
comment How to open a file from the Internet in a secure way?
Voted as off-topic. This site is for IT professionals. For that type of question, I would recommend superuser.com
Nov
13
comment Startup security
Still bad general advice because you shouldn't store confidential data in a cookie in the first place which is exactly what the folks at SO explained.
Nov
12
comment Startup security
Also I doubt that this startup can afford threat modeling.
Nov
12
comment Startup security
Encrypt Cookies: never seen any website do this, what is it supposed to help with? Save Session ids in the database: how does it help in regards to security?
Nov
12
comment What free tools or techniques exist to discover anomalies in network flows?
Given that the logs are not encrypted.