846 reputation
210
bio website
location
age
visits member for 2 years, 11 months
seen 18 hours ago

Been on the Internet since before there was an Internet. Remember UUCP, news feeds, and Gopher?


Oct
11
awarded  Custodian
Oct
11
reviewed Approve suggested edit on PHP sprintf vulnerability?
Oct
11
revised PHP sprintf vulnerability?
Added information and link to CSI lecture notes
Oct
11
answered PHP sprintf vulnerability?
Oct
11
comment PHP sprintf vulnerability?
@Gerifield - Yep, given that perl and php which is related to it are based on a subset of C conventions, there is an issue of inheritance.
Oct
11
comment PHP sprintf vulnerability?
If you include unfiltered user content as the input, you're enabling XSS. Taint has to be removed.
Oct
8
comment How do I encrypt the source and destination IP address, along with various parts of an email?
Encrypting TCP/IP addresses, heh, how's transport supposed to work? Black felt marker to redact after printing out with headers included, put in sealed envelope and send by registered mail.
Sep
30
comment Passwords in plaintext?
You've basically compromised your own device. Yes, you can see the login credentials, this is what happens when you decrypt SSL traffic. A packet sniff of what went over the wire would show encrypted traffic.
Sep
30
answered Virus/Malware: Force Java Download
Sep
30
comment htaccess hacked
All FTP logins send login credentials as plaintext. Use SCP/SFTP instead. And as the article notes, don't store login credentials in the client, it's just waiting to be scraped.
Sep
28
comment Is it noticeable when you take a copy of a website?
For those who actively fight scraping, usually, it just gets you a sand trap ban where you get molasses response or an outright IP ban that may be temporary or permanent. In the old days of email scraping, some website owners would send you to a honeytrap that spewed garbage. And yep, it's all logged...
Sep
27
comment Is replacing bash with another shell a prudent step?
planet should be plane. Basically all the planes coming back had not been hit in the fuel tanks, engine nacelles, bomb bay, aft near the empennage controls, or cockpit area. Statistical shadow shows vulnerability, eh? It was the opposite of what could be visibly measured.
Sep
27
comment Someone keeps using my email address. What to do?
Who did you tick off? Pretty common tactic... and nothing you can do about it. At least they didn't sign up enough trial subscriptions and free catalogs to need a mail truck to deliver the payload.
Sep
27
comment How to decode this exploit scanner?
Remember looking at an early ecommerce software package written for webservers that didn't have php installed. Kind of gave me the willies at the time that it would install php where it could be publicly accessible. Violates security on so many levels.
Sep
24
awarded  Autobiographer
Sep
23
comment Why is security through obscurity not a good option for encryption?
To quote Schneier's observation: Anyone, from the most clueless amateur to the best cryptographer, can create an algorithm that he himself can't break. Often security by obscurity falls under this because with increasing use, things get noticed. And the underlying message traffic doesn't withstand statistical analysis, so it ends up being soul salve that bitterly proves to be useless.
Sep
14
comment Tiny USB sticks
Expecting a USB stick to be "too small for a virus" is a pretty far reach. A virus to steal your stuff will be pretty insignificant in size. This security ploy needs a rethink, I'm thinking.
Sep
7
comment How can I prevent my E-mail address from being used as the sender for fraudulent/scam messages?
Also, check Facebook for people who work at your company. You'll be surprised to find 20-50 Nigerians have a secret branch office there with all sorts of amazing work credentials. FB doesn't give a coprolite about this either. "The Internets" were never created to have factual integrity in mind.
Sep
7
comment How can I prevent my E-mail address from being used as the sender for fraudulent/scam messages?
When you find a means of preventing "Joe Jobbing" please let us know.
Sep
1
comment Nowadays, what is the difference between Cyber Security and IT Security?
Cyber Security prevents attack by the Cyber Men... Seriously, it's just one of those phrases that sounds good, invented by a think tank to help sell an idea. Till Cybernetics is fully implemented and we're all wearing implants, it's kind of meaningless.