6,100 reputation
624
bio website ralstonrats.co.uk
location Scotland, United Kingdom
age
visits member for 3 years, 11 months
seen Nov 20 at 22:51

Nov
20
comment HTTP status code for successful login
Google discussions of the PRG pattern first. There are a lots of pros of cons.
Nov
12
comment Browser page “Not resolved” page hijacked by yandex
"access and change this without a user knowledge" - because you've explicitly installed a program (anti-virus) which is designed to interfere with your access to the net.
Nov
8
answered Writing errors to Apache's log file from PHP - are there any pitfalls?
Nov
8
comment Avast https scanning
...do they generate the certificates on the fly (implying there's a 'root' certificate in every installation) or a single wildcard certificate for every website? And for pre-registered HSTS? What can possibly go wrong?! (OMG!)
Oct
24
comment Old floppy disk protection
By writing your filesystem or using a low level disk editor.
Oct
24
answered Old floppy disk protection
Oct
24
comment What can my university see if they have my MAC address?
A big caveat here is that MAC address spoofing is trivial; if the school treats the MAC address as your identity (i.e. without other control mechanisms) then you might want to consider the outcome if someone else uses your MAC address to abuse the internet facilities.
Oct
15
awarded  Nice Answer
Oct
1
comment Firewall log entry: need help in interpretation
From the way you have presented your question you may still have a long journey ahead of you. The information you've provided suggest that it may be a jabber client. But you've not told us anything about the architecture of the network or the hosts. Have you verified that 192.168.0.0 traffic only comes from your internal network? have you verified that the MAC address is appropriate to the srcip? What OS is running at the srcip?
Sep
24
comment Securing server to server http communication
"A public-private key pair is generated for each client" - you seem to be reinventing client certificates here?
Sep
24
comment Are externally referenced libraries (CDN's) a security issue?
Recommened by whom? Why?
Sep
24
answered Are externally referenced libraries (CDN's) a security issue?
Sep
24
comment Are externally referenced libraries (CDN's) a security issue?
"You have no work with updating the libraries yourself" - not necessarilt true. Most repositories host libs usng a naming convention that includes the version number - and not all developers backport security fixes. See also developers.google.com/speed/libraries/devguide#jquery
Sep
23
answered Why does malware periodically check google.com
Sep
23
comment Is my authentication persistence system design secure?
The last bullet above is really important - is always directing the user to a landing page after applying the 'remember me' cookie sufficient protection? Obviously doesn't provie any protection within the session though implying that CSRF tokens are still required.
Sep
12
comment Tell people that I can encrypt emails
I disagree that putting your fingerprint in an email is a good idea - it encourages people to think that a fingerprint delivered in this way should be trusted.
Aug
29
comment SQL injection filter evasion
As you say dynamic SQL is a problem - it makes a massive performance difference to QBE if you build a custom query string. The key point is that blacklisting is always a poor solution - but whitelisting can only ever deal with a finite set of possibilities. Transforming an input to guarantee it's isolation (escaping) is a valid approach but requires a certain amount of discipline.
Aug
28
comment SQL injection filter evasion
Agree mostly with Clockwork-Muse, bu parameterized queries are just one solution. If you ave to deal with text at all, then checking for most of the SQL keywords is a better approach - but no substitute for proper isolation of data from SQL code.
Aug
18
comment Linux file information leakage
(and don't forget about backup files - zip, tar, cpio etc)
Aug
12
answered Permissions security scenarios for a web server