geal

15 ms·

91.
A summary of January's Ruby-related vulnerabilities(ruby-security.com)
2 points by geal 14y ago|0 comments
92.
by geal 14y ago
Totally true. People will never reach the decision making circle until they learn about the money side. And often, they will not have this opportunity until they quit employment to go freelance, or launch their own company. And here is the
93.
Going the extra mile(pilotssh.com)
4 points by geal 14y ago|0 comments
94.
by geal 14y ago
Yes, I am sorry if that seemed misleading to you. I didn't want to get into too much details for a small post like that. I will write more on the subject later, with more data to help my points. SSL Labs is a great tool that I use regularly
95.
by geal 14y ago
Yes, that will come in a future article :)
96.
by geal 14y ago
Most of the CSS, JS and pictures don't contain private data, and should be cached.
97.
by geal 14y ago
You're right, I forgot the honor cipher directive. According to http://www.carbonwind.net/blog/post/A-quick-look-over-some-b... RC4+RSA is supported nearly everywhere, but it was not tested on mobile browsers. As part of my researches on
98.
by geal 14y ago
You're right, it looks like this was changed in Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=531801
99.
by geal 14y ago
EDIT: it is done, I added the nginx configuration to the article Just wait a bit, I'm updating the post for that :)
100.
Tips to accelerate SSL(unhandledexpression.com)
158 points by geal 14y ago|37 comments
101.
DevOps: manage servers from your iPhone in a few touches(pilotssh.com)
10 points by geal 14y ago|0 comments
102.
by geal 14y ago
Not necessarily. The screenshot indicates the bytes pointed by the IP, so it would still be possible to find them a binary you just built, and debug it from there.
103.
Warning your users about a vulnerability(unhandledexpression.com)
3 points by geal 14y ago|0 comments
104.
by geal 14y ago
You're assuming that you can write what you want and get away with it, now and in the future. But Histoy has shown that anyone can be in danger because of something they wrote long ago. The easy rule of thumb: if you have opinions and want
105.
by geal 14y ago
That attack is far from trivial. There were other attacks against EMV in the past, but they're fixed as they come. Magnetic stripes stay vulnerable, and ATMs in the US are not that secure either (seriously, some of them can be stolen and ta
106.
Software security is like medicine(unhandledexpression.com)
2 points by geal 14y ago|0 comments
107.
by geal 15y ago
This looks nice, but it has a few problems: -first, relying on DNS for certificate distribution might not be a good idea. It adds complexity, would not be secure without stuff like DNSSEC, and places too much responsibility on DNS. -second,
108.
by geal 15y ago
No need for a mailing list: I was able to reach you directly on Twitter for a bug report and patch :)
109.
by geal 15y ago
Courses are a good way to get started, because they will introduce you to the topic, and give you the vocabulary (that you will use to search afterwards). Learning to program, as in "from scratch", not "learn another language once I know wh
110.
by geal 15y ago
it shouldn't be a feature, but a prerequisite. But that's a hopeful dream... Defining for whom it is easy to use looks more like a feature
111.
by geal 16y ago
And it was developed during a startup weekend! Kudos to camilleroux!
112.
Extending the Joel test - 8 more questions for employers(unhandledexpression.com)
1 points by geal 16y ago|0 comments
113.
by geal 16y ago
Very useful and easy to use. It can uncover really weird bugs in your parsing code, the kind you don't believe is possible :)
114.
by geal 16y ago
Unpaid internships are common in the career beginning: companies won't employ you if you have no prior experience (they always look for 3 to 5 years of experience). That's very annoying to study 5 to 8 years and being told that you're not q
115.
Facebook Messages is a gift to spammers(unhandledexpression.com)
3 points by geal 16y ago|0 comments
116.
by geal 16y ago
well, this guid says that you must sanitize user input, but at input time, you may not know where it will come out. So, the solution proposed by this guide is to escape the output. It is another layer of defense: you don't know if you have
117.
by geal 16y ago
XSS isn't only about SCRIPT tags. What about javascript URIs, IMG and IFRAME tags, flash elements that you can add in a page by XSS? Filtering what is shown to the user is still the best solution IMHO.
118.
by geal 16y ago
It's a vulnerability exploitation framework. It is used by security experts for vulnerability development and penetration testing.
119.
by geal 16y ago
I agree, Mac OS did it right. But I'm not a fan of packaging two different architectures in one installer. It makes the package bloated (which is also a problem with Windows installers).
120.
by geal 16y ago
Well, in the article, I especially told to forget about making money with toolbars. But I'm not confident one can easily teach this kind of good manners to developers...

More ›