Tag Archives: security
sandbox(7)
Like a lot of people, most of my Unix knowledge comes from an early reading of Advanced Programming in the UNIX Environment. This is an excellent tome on the interfaces provided by the kernel to programs on a Unix system. … Continue reading
Cross Site Scripting, again
Twitter all clear after worm wave Twitter has been given the all clear after a worm infected “tens of thousands of users”. But experts say the attack could have been much worse. Another day, another XSS hole. It reminds me … Continue reading
Jasypt++
Once again, jasypt (“Java Simplified Encryption”) makes me smile. Java comes with a comprehensive set of encryption utilities: JCE. I had to do some decryption the other day and ended up with this code. public class Decryptor { private static … Continue reading
Postfix 2.5.1 TLS on FreeBSD
This is one of those things that I have to put up there in case anybody else has the same obscure setup that I do… I run postfix on FreeBSD, using the ports system. This means I have a tendency … Continue reading
Jasypt
One more little library that I’ve come to love: jasypt. It’s a simplified veneer over the top of the gargantuan java security apparatus. All I wanted to do was encrypt a String before putting it in a Cookie. BasicTextEncryptor encryptor … Continue reading
Cross Site Scripting
I’ve just been listening to Security Now about Cross-Site Scripting. It makes my blood boil. No, not all the ads and endless, aimless waffling. The talk about Cross-Site Scripting (aka XSS) being a problem because code and data can be … Continue reading
mod_security now switched off
Last night, I spent a long while trying to get mod_security working on this web server. Installation was simple, thanks to the FreeBSD ports system. Configuration was another matter entirely. Not having much experience of web application firewalls, I opted … Continue reading
System Keychain
This morning I was trying to add a new machine to my wireless network. Unfortunately, I’d forgotten the password… To the Keychain Access batcave! Unfortunately, the “Airport network password” is stored in the system keychain, instead of my login keychain. … Continue reading
Rails Security Hole
Working round the Rails showstopper. (pdcawley)++ (svk)++ I now have the fixed version of typo (soon to be 4.0.2), around an hour after it was committed. As to the whole “full disclosure” thing by the rails team? They handled it … Continue reading
Rails gets sane
Some time ago, I wrote about The Wrong Defaults, explaining how nearly all templating systems for the web default to “insecure”. Well, it looks like some rails people are paying attention: Auto sanitized templates with Erubis