10 ms·
Cybersecurity Humble Book Bundle
- gergles 9y ago"Pay what you want^" ^As long as it's at least $15. It bothers me that Humble Bundle has so heavily embraced this type of marketing.
- ineedtosleep 9y agoThe first tier is not $15, it's $1.
- Jackalopiate 9y agoand it's only $1 to prevent shills from buying in $0.1 increments and defeating the whole purpose of the service.
- holdontourarch 9y agoIf I recall correctly, it's a holdover from the video game bundles they offer. Initially you could just plug in $0.01 and get their bundles for a penny each. They naturally would have trouble because of card processing fees, but they allowed it until shortly after they started giving out steam keys for games. A "security" mechanism that steam has in place is they don't allow users who haven't purchased any games to participate in trading items/playing the steam marketplace. Scammers were using humble bundles as a super cheap way of getting tons of keys they could use on fresh accounts so they could be used to scam items from legitimate steam users.
- deleted 9y ago[deleted]
- EnFinlay 9y agoIs there a legal / not crazy expensive way to buy humble bundle books and get them printed on standard 8.5x11, bound in a series of binders / duotangs / twine? I'm going to buy the bundle, but greatly prefer physical pages to reading on a screen.
- AntonyGarand 9y agoEreaders are my solution, have a look at Kobo's
- unethical_ban 9y agoThe OP said he wants physical, and I understand. For fiction or news, I am fine with my Kindle, but for tech manuals where I want to rapidly bookmark, highlight and reference, paper is really handy.
- komali2 9y agoFunny, the three reasons you listed are exactly why I prefer an ereader :P
- busterarm 9y agoEver since I got an iPad Pro 12", my requirement for physical copies of technical books has gone down a bit. Often times it's the more convenient option. I read technical information slower and in shorter blocks of time, so being easy on the eyes like my Kindle isn't a requirement.
- CameronBanga 9y agoI would also love to know an answer to this.
- dublinben 9y agoAny print shop / office supply store will print and bind a provided PDF for pennies per page.
- mr_overalls 9y agoSchneier's "Applied Cryptography" by itself justifies the $15 bundle, IMHO. This is a great deal.
- chubot 9y agoMandatory: https://www.schneier.com/blog/archives/2009/09/the_cult_of_sch.html https://www.schneier.com/blog/archives/2009/09/the_cult_of_s... But in the introduction to Bruce Schneier's book, Practical Cryptography, he himself says that the world is filled with broken systems built from his earlier book. In fact, he wrote Practical Cryptography in hopes of rectifying the problem. https://blog.cryptographyengineering.com/2011/11/07/in-defense-of-applied-cryptography/ https://blog.cryptographyengineering.com/2011/11/07/in-defen...
- mr_overalls 9y agoAs someone learning crypto (and slowly joining the Cult of Schneier), this is a valuable caution. Thank you!
- dsacco 9y agoApplied Cryptography is outdated and made obsolete by Schneier's more recent, Cryptography Engineering. You should just read that instead. For more information, 'tptacek explains this more succinctly that I could: https://sockpuppet.org/blog/2013/07/22/applied-practical-cryptography/ https://sockpuppet.org/blog/2013/07/22/applied-practical-cry...
- nonamechicken 9y agoI am interested in learning more about securing web servers (nginx, nodejs). Is there a book in this bundle that could help me? If you know any good books, please recommend me one.
- lghh 9y agoI'm in the same boat as you and have been reading The Web Application Hacker's Handbook that comes in the $1 tier and have been liking it. Bummed I bought it a few weeks ago when it showed up in this.
- CameronBanga 9y agoI don't think you'll find a better group of books for $15, if your goal is to learn about security in general. Most of the stuff here is general crypto, which is very helpful with respect to just learning about computer security, though not necessarily focused on securing something like nginx specifically. You'll learn a lot more about security in general though, which will make it easier to learn about security specific platforms. I can't recommend this collection enough. I'd make the purchase, then dive into a couple and read whatever you find most interesting. I don't believe any will have the top keys of security technology X, Y, or Z. But you'll learn a lot in general, and it will be much easier to read other security how-tos and tutorials on locking down specific platforms.
- dsacco 9y agoRead The Tangled Web. It's an excellent book for developers that covers defensive tactics for securing web resources. The beauty is that it approaches the subject with developers in mind, not developers looking to become penetration testers (which is why I wouldn't recommend The Web Application Hacker's Handbook for your use case).
- lawnchair_larry 9y agoWhich chapter(s) of The Tangled Web do you feel would benefit a web server administrator? It is a great book, but it is almost entirely focused on attacking browsers. It's not clear to me what changes someone might make to their nginx configuration (for example) in light of the information provided in the book.
- SadWebDeveloper 9y agoCEH v9 at 15 USD bundle-level is quite a joke, IMHO that should go to the 1 USD level but anyway as someone said Applied Cryptography might be the selling point here. Personally speaking the only books valuable in this bundle are "Practical Reverse Engineering: x86, x64, ARM, Windows Kernel, Reversing Tools, and Obfuscation" and "Applied Cryptography: Protocols, Algorithms and Source Code in C, 20th Anniversary Edition" the other are either quite outdated, too oversimplified or script-kiddie level stuff.
- ianai 9y agoWhat do you have against CEH v9?
- PeterisP 9y agoNot the original commenter, but just skimmed that book - it's really, really shallow. It seems well written, and covers a lot of ground, but it's literally introductory in the sense of "hey, ianai, let's introduce you to the concepts. Concepts, this is ianai; ianai, these are the concepts, now wave them goodbye and let's move on to the next topic". Answering the test questions included (indicative of the actual certification questions?) generally requires being aware of all the concepts - it doesn't require understanding how/why they work; it doesn't require being able to apply them; simply knowing that they exist and how they're named. It might be a good starter book from someone coming in to the domain, since it would list all the key things that you'd need to know and introduce you to most of the terminology, but in order to actually learn any of these things (and IMHO to be able to pass certification related to any one of these things) you'd need to go much more in depth than this book will allow.
- ianai 9y agoAye, good to know!
- ryanlol 9y agohttp://attrition.org/errata/charlatan/ec-council/ http://attrition.org/errata/charlatan/ec-council/
- dsacco 9y agoSo, I've read most of these. Here's a tour of what is definitely useful and what you should probably avoid. _________________ Do Read: 1. The Web Application Hacker's Handbook - It's beginning to show its age, but this is still absolutely the first book I'd point anyone to for learning practical application security. 2. Practical Reverse Engineering - Yep, this is great. As the title implies, it's a good practical guide and will teach many of the "heavy" skills instead of just a platform-specific book targeted to something like iOS. Maybe supplement with a tool-specific book like The IDA Pro Book. 3. Security Engineering - You can probably read either this or The Art of Software Security Assessment. Both of these are old books, but the core principles are timeless. You absolutely should read one of these, because they are like The Art of Computer Programming for security. Everyone says they have read them, they definitely should read them, and it's evident that almost no one has actually read them. 4. Shellcoder's Handbook - If exploit development if your thing, this will be useful. Use it as a follow-on from a good reverse engineering book. 5. Cryptography Engineering - The first and only book you'll really need to understand how cryptography works if you're a developer. If you want to make cryptography a career, you'll need more; this is still the first book basically anyone should pick up to understand a wide breadth of modern crypto. _________________ You Can Skip: 1. Social Engineering: The Art of Human Hacking - It was okay. I am biased against books that don't have a great deal of technical depth. You can learn a lot of this book by reading online resources and by honestly having common sense. A lot of this book is infosec porn, i.e. "Wow I can't believe that happened." It's not a bad book, per se, it's just not particularly helpful for a lot of technical security. If it interests you, read it; if it doesn't, skip it. 2. The Art of Memory Forensics - Instead of reading this, consider reading The Art of Software Security Assessment (a more rigorous coverage) or Practical Malware Analysis. 3. The Art of Deception - See above for Social Engineering. 4. Applied Cryptography - Cryptography Engineering supersedes this and makes it obsolete, full stop. _________________ What's Not Listed That You Should Consider: 1. Gray Hat Python - In which you are taught to write debuggers, a skill which is a rite of passage for reverse engineering and much of blackbox security analysis. 2. The Art of Software Security Assessment - In which you are taught to find CVEs in rigorous depth. Supplement with resources from the 2010s era. 3. The IDA Pro Book - If you do any significant amount of reverse engineering, you will most likely use IDA Pro (although tools like Hopper are maturing fast). This is the book you'll want to pick up after getting your IDA Pro license. 4. Practical Malware Analysis - Probably the best single book on malware analysis outside of dedicated reverse engineering manuals. This one will take you about as far as any book reasonably can; beyond that you'll need to practice and read walkthroughs from e.g. The Project Zero team and HackerOne Internet Bug Bounty reports. 5. The Tangled Web - Written by Michal Zalewski, Director of Security at Google and author of afl-fuzz. This is the book to read alongside The Web Application Hacker's Handbook. Unlike many of the other books listed here it is a practical defensive book, and it's very actionable. Web developers who want to protect their applications without learning enough to become security consultants should start here. 6. The Mobile Application Hacker's Handbook - The book you'll read after The Web Application Hacker's Handbook to learn about the application security nuances of iOS and Android as opposed to web applications.
- kirian 9y agoI find this ironic this offering - "Bitcoin payments have been disabled for the Humble Book Bundle"
- znpy 9y agoRemember to choose a charity entity for your donation! ProTip: entities like the FSF, the EFF, Wikimedia and many others can be helped via the humble bundle!!
- twoquestions 9y agoGreat, now there's another collection of books which I'll want to read which I'll feel bad about missing the deal for, then kick myself for never actually reading them in-depth. I think I've bought 50 books from Humble Bundle (spending about $1/book), but I've only cracked open a few of them. Also thank you dsacco for the recommendations!
- komali2 9y agoFantastic, glad to have more reading to prep for defcon!
- Tepix 9y agoI use 2FA on Humble Bundle. In order to log in, I have to solve several captchas. I then have to solve more to buy stuff. All in all I have to solve the captcha 5 times or so, each time involves marking multiple images. What sense does this make? Either they trust the captchas (then they only need one), or they don't (then they should remove them). I've complained about this to them in the past but they haven't changed it.
- lqdc13 9y agoYou need a captcha to log in so that it's hard to make multiple fake accounts. You need captchas to buy stuff because otherwise one could make all accounts manually and then use them to quickly buy products to spend some bank account before it's banned. I think each smallish site would benefit from designing their own captchas because that way the effort to solve for machines would be harder than solving the Google captchas. The effort to solve for humans would be a lot lower. This is perhaps one of the few areas where rolling your own security solution is beneficial by virtue of it being different.
- kbenson 9y agoI think perhaps you underestimate how hard it is to make a good captcha, that is one that is hard to solve programatically but not too hard to solve for a real person (this second part is often overlooked as easy). I suspect you'll find a lot of the prior techniques work well when applied to someone's hand-rolled version, given that coming up with something unique enough to not have prior work put into solving it (and have enough variation to make learning the entire data-set infeasible) is likely much harder than you think.
- lqdc13 9y agoI don't know.. It seems stupid easy to me. Try something like "Type the third and fifth letters of the word elephant into the box below" with instagram filter applied. A bunch of variations for the first part like "the following word" and "the word in parenthesis". Basically, I can't think of a way to come up with something ez that defeats it. You would have to train a neural net specifically on these images because normally neural nets are bad at instagram filter removal unless trained on it. Plus you can slow down/ban/mess with requests based on cookies. There are basically infinite solutions. Would take a couple of days to implement and would be really fun. I guarantee you: if your site gets maybe 30k visitors a week, nobody would bother spending a month cracking your captcha when there are much easier targets out there. Finally, you can make it super annoying to actually find where the image is by converting to svg and messing with html structure/compose image in JS. Now they're going to be forced to run a headless browser, take screenshots of the captcha page and finding the image within the page. If they take the pay-per-captcha approach, I don't think anti-captcha and the like would make it too ez. Still days of work to set up something really brittle.
- dronemallone 9y agoSecurity Engineering is free on the author's website :) http://www.cl.cam.ac.uk/~rja14/book.html http://www.cl.cam.ac.uk/~rja14/book.html
- _coldfire 9y agoShhh, plenty of humble books are easily found, but they do good work and provide quality content.
- _coldfire 9y agoTo download all books at once: https://gist.github.com/graymouser/a33fbb75f94f08af7e36 https://gist.github.com/graymouser/a33fbb75f94f08af7e36 Improved *nix version further down the thread Change "MOBI" to "PDF"/"EPUB" if desired
- deleted 9y ago[deleted]
- b100w11 9y agoIronically the Malware Analysts cookbook epub seems to be infected by a trojan. And the Web application hacker handbook also in epub by another one
- weinzierl 9y agoMy first thought was: "Not surprising for a book on malware, probably triggered by an example in the book". I uploaded the file to virustotal.com and malwr.com. VirusTotal has reports from several scanners, so this is not just misreporting from a single scanner. malwr.com opens the file in a sandbox and it says that it makes HTTP connections and installs itself for autorun at Windows startup. The Web Application Hacker's Handbook is reported by my local ClamAV 0.99.2 with current sigs but not by VirusTotal. malwr.com also reports HTTP connections and autorun. I uploaded several other EPUB files and none of them was reported to show such behaviour. Strange...