Argues that memory unsafety is a widespread, unnamed vulnerability causing thousands of bugs, and advocates for adopting memory-safe languages like Rust.
A technical guide on creating a Hashicorp Vault authentication token with permissions only to seal the vault, including policy creation and token generation.
A quick guide on using PowerShell to change the friendly name of a certificate, highlighting a simple command for system administrators.
Five practical security and usability improvements for the Django Admin interface, including URL changes, environment indicators, and 2FA.
A guide to building a dedicated homelab server for running development VMs, covering the benefits of isolation and hardware selection.
Explains why forward secrecy is crucial for modern encryption, contrasting GPG's long-term key model with the Signal Protocol's ephemeral keys.
A developer tracks HTTP vs HTTPS requests for a year, highlighting major websites still using insecure HTTP and advocating for HTTPS adoption.
A reflection on teaching basic cryptography to children, highlighting the importance of usable security through historical ciphers like the rail fence and Caesar cipher.
Discusses the importance of cryptographic safety factors, using SHA1's vulnerabilities and Feynman's Challenger report as analogies.
A guide on protecting API keys in Python applications by storing them in a separate config file and using .gitignore to prevent exposure on GitHub.
A guide to implementing HTTP Public Key Pinning (HPKP) for enhanced security in ASP.NET Core applications, covering benefits and risks.
Explains how to implement HTTP Strict Transport Security (HSTS) in ASP.NET Core to enforce secure HTTPS connections.
A tutorial on creating custom middleware in ASP.NET Core to automatically redirect HTTP requests to HTTPS for improved security.
A technical guide on using PowerShell to read, analyze, and validate certificates within PFX files, including trust chain inspection.
Explains why protocol-relative URLs (//example.com) are harmful for security and compatibility, advocating for absolute HTTPS URLs instead.
Urgent warning to replace StartCom or WoSign SSL certificates before Chrome 56 and Firefox 51 mark sites as insecure in early 2017.
Explores the $500 security guarantee for finding vulnerabilities in qmail, highlighting principles for secure open-source software development.
A developer's initial experience using Google's OSS-Fuzz project to perform large-scale fuzz testing on the open-source libyaml library.
A developer creates a Chrome extension and Android app for generating secure, service-specific passwords from a master passphrase, inspired by existing tools.
A guide to using an AWS CloudFormation template for standardizing the configuration of new linked accounts, including security and administrative roles.
