Question Overflow

less info
477 reputation
312
bio website google.com
location Sin City (no, not Las Vegas)
age 42
visits member for 2 years, 4 months
seen Aug 24 at 7:28

I don't have any formal education on programming. I guess it is the passion that gets me started and keeps me going. Thanks everybody for sharing your knowledge. Don't worry, I am no critic. I see no wrong answer, only good and not so good answers. All are welcome to learn and to share.


Aug
24
comment Someone is trying to hack my PHP server
Log rotation is your good friend.
Aug
24
comment Why is “www.” considered unsafe in this HTTPS URL?
As David pointed out, SoundCloud is redirecting requests at https://www.soundcloud.com to http://soundcloud.com. Since https is dropped, your browser will complain of insecure content.
Aug
17
comment What are the security reasons for disallowing the plus sign in email addresses?
@MaciejPiechotka, when talking about disposable email address, I am referring to one that is temporary and needs no registration, such as mailinator or guerrilla mail. Obviously, nobody in the right mind is going to block gmail, yahoo and hotmail. No system is perfect.
Aug
16
awarded  Nice Answer
Aug
16
asked How do you find out if a phone is secretly sending private data to a remote server?
Aug
16
comment What are the security reasons for disallowing the plus sign in email addresses?
@MaciejPiechotka, yes, you are right. That's why if business rule dictates, those free disposable email domains would be blocked as well. Although it is impossible to block all, a list of top 100 email domains would be good enough to deter most people from abusing the system.
Aug
14
comment What are the security reasons for disallowing the plus sign in email addresses?
@Matt, as the RFC standard did not restrict the usage of + symbol to aliases, there is no way for website owners to have their cake and eat it too. Users with uncommon email address are going to be left once a decision is made to exclude aliases for registration. And I am not suggesting that you are able to add back your alias subsequently after registration as I believe the same validation rules would apply for email change.
Aug
13
awarded  Yearling
Aug
13
answered What are the security reasons for disallowing the plus sign in email addresses?
Aug
4
accepted How should I defend against zero-day attack on SSH?
Aug
3
comment How should I defend against zero-day attack on SSH?
Not feasible because my ISP has many IP blocks that are scattered around the full spectrum.
Aug
3
comment How should I defend against zero-day attack on SSH?
Those are actually the basic things to do. I am talking about the discovery of a major security flaw in SSH implementation that allows user to gain a root shell even without a key or password.
Aug
3
comment How should I defend against zero-day attack on SSH?
Thank you. I think this is worth considering.
Aug
3
comment How should I defend against zero-day attack on SSH?
I have thought about that too, but it doesn't work for my case as I don't have a fixed IP address.
Aug
3
asked How should I defend against zero-day attack on SSH?
Jul
29
comment Apache logs, suspicious logging apach0day
It would also be helpful if you have egress logging to check if there is any outgoing traffic to proxypipe IP 31.220.14.3.
Jul
29
comment Apache logs, suspicious logging apach0day
Do you have the log IO and the run time for the attack? If the output file size is larger than normal index page, and the timing takes longer than 1s, probably something got executed on server side and the output is returned to the hacker. Can anyone verify this?
Jul
18
comment Is my service provider hacked and what can I do to protect myself?
@Ángel, its happens to Firefox, but not on Chrome and on two separate computers. So, I have to assume that it is a browser issue.
Jul
17
comment Is my service provider hacked and what can I do to protect myself?
@Ángel, the extra .com is appended during DNS resolution, so you wouldn't see it on the address bar.
Jul
10
comment Should I disable http HEAD requests?
In any case, some web servers like Apache don't allow you to disable HEAD request without disabling GET.