A tutorial on creating custom middleware in ASP.NET Core to automatically redirect HTTP requests to HTTPS for improved security.
A technical guide on using PowerShell to read, analyze, and validate certificates within PFX files, including trust chain inspection.
Explains why protocol-relative URLs (//example.com) are harmful for security and compatibility, advocating for absolute HTTPS URLs instead.
Urgent warning to replace StartCom or WoSign SSL certificates before Chrome 56 and Firefox 51 mark sites as insecure in early 2017.
Explores the $500 security guarantee for finding vulnerabilities in qmail, highlighting principles for secure open-source software development.
A developer's initial experience using Google's OSS-Fuzz project to perform large-scale fuzz testing on the open-source libyaml library.
A developer creates a Chrome extension and Android app for generating secure, service-specific passwords from a master passphrase, inspired by existing tools.
A guide to using an AWS CloudFormation template for standardizing the configuration of new linked accounts, including security and administrative roles.
Argues that web browsers should actively warn against and eventually block performance-harming and inaccessible web development practices.
Dropbox's latest update adds a non-removable Finder toolbar, sparking criticism for poor UX and ignoring user control.
A developer explains building a security-focused static code analysis tool for Gulp by extending an existing plugin, following open source philosophy.
An introduction to threat modeling, a security technique for identifying assets, attack vectors, and attackers to build better system defenses.
Analyzes global network latency, highlighting the worst ping delay between Dagupan, Philippines and Alblasserdam, Netherlands.
Critique of the role="password" ARIA attribute, arguing it undermines security, accessibility, and user experience by enabling poorly implemented custom password fields.
Argues for using plain text emails over HTML, citing tracking, security, and usability issues with HTML email.
A technical critique of Sucuri Security's flawed analysis of TLS certificate verification, focusing on errors in their assessment of Python's Requests library.
Analysis of a cryptographic vulnerability in the Beaker Python library's session encryption due to nonce reuse in AES-CTR mode.
A technical guide on implementing a Subresource Integrity (SRI) TagHelper for ASP.NET Core, covering hash calculation, caching, and browser security.
Explores the new Protect/Unprotect-CmsMessage cmdlets in PowerShell V5 for DSC credential encryption, detailing upgrade challenges.
A guide to implementing Subresource Integrity (SRI) security for CDN resources using a custom ASP.NET Core TagHelper.
