aeronautic

9 ms·

31.
by aeronautic 9y ago
Been an avid HN reader for ages, but been seriously heads down doing the startup thing for about a year with zero time for blog or posting. Insane hours. Started surfacing a month ago so I can do more than just code and wanted to share a bi
32.
by aeronautic 9y ago
Thanks so much for clarifying. We use your service - would recommend in a heartbeat.
33.
by aeronautic 9y ago
That is the cloud icon. Make it gray and it is just a DNS. i.e. DOS protection armed and ready, but not active until you need it. That is how we use it.
34.
by aeronautic 9y ago
Could you highlight what you think are the important items in a web security checklist?
35.
by aeronautic 9y ago
Thanks for the tips. Can you say which SQL tip is bad, someone has already picked up the Stored procedure comment -- really meant prepared statements. Regarding regexp. You can do very precise regexp for many patterns. I agree some are hard
36.
by aeronautic 9y ago
Sorry, not true. Spent many years doing full stack web dev and security. Please offer some constructive criticism - gladly received.
37.
by aeronautic 9y ago
If the hacker gets access to the database due to a network config error, then they will be able to query the database, but only get records with some sensitive fields encrypted. Given the number of email addresses that have been hacked and
38.
by aeronautic 9y ago
Yes it does that and that will rule it out for some apps. An option for many sites is to configure CloudFlare in pass-through mode (no MITM) and then just switch it on when you are being DOS'd.
39.
by aeronautic 9y ago
This can probably explain more succinctly than I can. https://aws.amazon.com/about-aws/whats-new/2015/12/amazon-au...
40.
by aeronautic 9y ago
Agree with the point, but remember normal HTTP/1.1 /2 keep alive should close that connection in 15-30 seconds for all modern browsers. It will give rise to a DOS vulnerability as you point out.
41.
by aeronautic 9y ago
Thanks perfect.
42.
by aeronautic 9y ago
Ah, node. That is a whole post for itself and a really good idea. Perhaps I'll tackle that next. Coupled with async wait issues -- there is plenty to talk about there. But good point. How would you describe this item on error handling?
43.
by aeronautic 9y ago
When I post the implementation notes for Node, feel free to speak up with the RoR speak for that item and I'll add it in. Thank you.
44.
by aeronautic 9y ago
No problem, all feedback is good. Lucky I've got my asbestos pants on ;-)
45.
by aeronautic 9y ago
Good point. I did say: "This checklist is simple, and by no means complete. It is a list of some of the more important issues you should consider when creating a web application." But I'll try to make that clearer. I'm l
46.
by aeronautic 9y ago
I take your point that this could be explained a lot better. In the next revision when I fold in the feedback, I'll make this clearer. One suggestion, that I'll do is pair each checklist item with an implementation note that expla
47.
by aeronautic 9y ago
No much at all.
48.
by aeronautic 9y ago
I did a post on that here: https://simplesecurity.sensedeep.com/immutable-infrastructur... but the originator was: Chad Fowler http://chadfowler.com/2013/06/23/immutable-deployments.html
49.
by aeronautic 9y ago
The cost of full encryption is minimal on platforms like AWS Aurora. If the platform supports it - this is a good way to go. The incremental cost of encryption with Aurora is very low (< 3%). At rest, means that the data on disk is encry
50.
by aeronautic 9y ago
I don't want to take the focus off the post and discussion which was about the web checklist. You could dm me twitter @SenseDeepSec or email mob. But briefly, we hit some of the PCI compliance objectives but not all. We expect to cover
51.
by aeronautic 9y ago
We're just in beta. SenseDeep is part host-IDS and part cloud-side. The key is real-time. We want to detect attacks in real-time on the server or on the cloud-side. It has a GUI on top to unify and give a cloud complete view. The focus
52.
by aeronautic 9y ago
I know node better and would be a bit light on other frameworks. Do you have suggestions?
53.
by aeronautic 9y ago
Do both. I'm a big believer in having dev learn and own a part of the security process. You learn an enormous amount by hacking yourself. But you are right, you definitely need other eyes to pen test as well.
54.
by aeronautic 9y ago
Great idea for a follow on post. I'll do that.
55.
Web Developer Security Checklist(simplesecurity.sensedeep.com)
548 points by aeronautic 9y ago|244 comments
56.
Immutable infrastructure can be dramatically more secure(simplesecurity.sensedeep.com)
2 points by aeronautic 9y ago|0 comments
57.
Show HN: Real-Time Cloud Security for AWS (Beta)(sensedeep.com)
1 points by aeronautic 9y ago|0 comments
58.
The FBI called and said I'd been hacked(medium.com)
3 points by aeronautic 9y ago|0 comments