mwpmaybe

26 ms·

271.
by mwpmaybe 10y ago
Ideally, you do both: bind your services to the correct interfaces and ports, and set firewall rules as a safety net. This prevents users (or exploits yielding forked processes) from listening on other ports (well, they can listen, but it w
272.
by mwpmaybe 10y ago
sudo passwd -l
273.
by mwpmaybe 10y ago
I read this wrong the first time. That makes sense. Thank you.
274.
by mwpmaybe 10y ago
I never said it was.
275.
by mwpmaybe 10y ago
CSP isn't a silver bullet.
276.
by mwpmaybe 10y ago
Invalidating the site secret is my go-to strategy right now, but I have wondered how to sign out a single user across all their logged-in devices. Anyway, this idea is interesting and would be pretty straightforward to implement. Thanks!
277.
by mwpmaybe 10y ago
I asked this question below, but how do you use the payload to select the correct salt from the database in order to verify the signature before verifying the signature and confirming that the payload is valid?
278.
by mwpmaybe 10y ago
What does the revocation list look like? "Reject all tokens for user X issued before timestamp Y?" Or do you assign UUIDs to your tokens?
279.
by mwpmaybe 10y ago
Hrrm, now you're in a situation where you're using part of the unverified payload to look up part of the secret before validating the signature and hence the payload. This is a neat idea but it introduces a whole class of potent
280.
by mwpmaybe 10y ago
> Using javascript to manage your sessions only the client side in any way is NOT secure. And yet it's common practice, at least in the SPA communities with which I engage on a regular basis.
281.
by mwpmaybe 10y ago
> In my opinion, it is MUCH easier to get a CSRF vulnerability It's simple (though perhaps non-trivial) to protect against XSRF these days, especially if you're securing a JSON API, with: 1. the SameSite cookie option (Chrome-o
282.
by mwpmaybe 10y ago
For those of you saying, "just use EC2 like any other VPS, it's not that complicated," you're missing the point. You can find better-performing VPS offerings for the same money at other providers. AWS isn't the best
283.
by mwpmaybe 10y ago
I feel as though you may be trolling me. > > > Doesn't that seem a little overkill just for controlling logs? > > Someone spamming your SSH listener is bad for other reasons, and blacklisting obvious ne'er-do-wells
284.
by mwpmaybe 10y ago
> Doesn't that seem a little overkill just for controlling logs? Someone spamming your SSH listener is bad for other reasons, and blacklisting obvious ne'er-do-wells is never overkill. > unless it's in a shared hosting
285.
by mwpmaybe 10y ago
I mean, I'm sure a 16-bit integer for the port number didn't seem ridiculous when TCP was invented in 1974 or whenever.
286.
by mwpmaybe 10y ago
A few years ago I started installing fail2ban on all my server instances, which comes with sane defaults and the SSH filter enabled out of the box (on Debian/Ubuntu, at least).
287.
by mwpmaybe 10y ago
> Linus replied that mixing low quality sources have good entropy Hopefully this research yields a wonderful new algorithm for combining the sources and makes it a simple kernel patch away.
288.
by mwpmaybe 10y ago
> At one point, a team I was working with had to code their own RNG replacement for OpenSSL's I recently released a RubyGem that does just that. It's unfortunate.
289.
by mwpmaybe 10y ago
And TLS False Start, which reduces the average time of an SSL handshake by 30%, and can be enabled independently of SPDY and HTTP/2. Fortunately, it was pretty easy to redeploy my HAproxy config to Xenial and enable ALPN.
290.
by mwpmaybe 10y ago
Kudos to CocoaPods for integrating (from what I can tell) all of GitHub's recommendations in a relatively short period of time!
291.
by mwpmaybe 10y ago
Just a heads up that this is about thread-local storage, not transport layer security.
292.
by mwpmaybe 10y ago
The 2016 Chicago Cubs!
293.
The Road to Sinatra 2.0(zzak.io)
3 points by mwpmaybe 11y ago|0 comments
294.
by mwpmaybe 11y ago
> Java 1.0 was released in 1995 and we haven’t had the need for another general-purpose programming language ever since. Riiiiiiight...
295.
by mwpmaybe 11y ago
X-Hacker-News-Please-Stop
296.
by mwpmaybe 11y ago
...and "conventionalizing app boot" just means making it a few simple commands to implement for any given Ember.js application (instead of each application needing its own bespoke solution).
297.
by mwpmaybe 11y ago
Perhaps doing this in DNS with DANE-EE TLSA records is a much better solution for all the reasons discussed here.
298.
by mwpmaybe 11y ago
I would be interested in hearing someone smarter and more knowledgeable address this, but I will say that the public keys are sticky ("pinned"), so if an attacker was able to change it, it would only affect virgin clients during t
299.
by mwpmaybe 11y ago
I QR'd my two backup private keys and corresponding CSRs, printed them out, and gave one set each to my two partners to keep safe. I agree that it seems a little overkill, but it doesn't have to be terribly complicated.
300.
by mwpmaybe 11y ago
Especially those pesky XML and JSON payloads!

More ›