ramimac

14 ms·

1. 181.▲
   by ramimac 7y ago

   I agree that none of these reports could be considered "critical." I also agree that the tone is a bit unprofessional. I'd add that I generally find these publicity pushes using fairly bland findings to be distasteful. All th
2. 182.▲
   by ramimac 7y ago

   VSR (part of NCC Group) | Security Consultant / Penetration Tester | Boston, MA | ONSITE VSR is focused on providing quality information, network and application security consulting services. We work with clients in nearly every indus
3. 183.▲
   by ramimac 7y ago

   I'm surprised that IOActive backed him up on this, seems like it's treading a line that businesses normally are very conservative around. I very much expected him to be unaffiliated with a large organization after reading that.
4. 184.▲
   by ramimac 10y ago

   Here is the relevant French excerpt: "Enfin, j'ai découvert une horrible et cruelle méthode, que je ne conseille qu'aux hommes d'une excessive vigueur, à cheveux noir et durs, à peau mélangée d'ocre et de vermillon,
5. 185.▲
   by ramimac 10y ago

   I'm in no way an expert, so I don't know how qualified I am to comment. I'd say the issue isn't html_safe's functionality, but rather a common misunderstanding and misuse. In my experience this is steeped in the nam
6. 186.▲
   by ramimac 10y ago

   We really aren't; even discounting people who home-roll it, many companies just don't use existing security features of languages well. An example I've seen in action is Rails' html_safe, which I've seen multiple de
7. 187.▲
   by ramimac 10y ago

   An additional avenue I've seen frequently exploited that hasn't been mentioned yet is password reuse. It is cyclic, however with all of these database thefts, attackers are gaining access to large numbers of credentials which can
8. 188.▲
   by ramimac 10y ago

   I think this is misleading. I'm assuming your referring to the election related leaks, which as far as I've seen are significantly different than private sector database leaks.
9. 189.▲
   by ramimac 10y ago

   In the past I've used https://pythonhosted.org/Flask-Security/ for Python Flask password management (with bcrypt) and it fit my use case.