Captcha Considerations

Risks Lack of captchas are a risk, but so are captchas themselves... Let's look at the problem here? What are we trying to stop with captchas? Bots submitting. What ever it is, whether: Advertising Creating an unfair advantage over real humans Link creation in attempt to increase … Continue reading →

Lack of Visibility in Web Applications

Risks I see this as an indirect risk to the asset of web application ownership (That's the assumption that you will always own your web application). Not being able to introspect your application at any given time or being able to know how the health status is, is not a comfortable place to be … Continue reading →

Consuming Free and Open Source

Risks This is where A9 (Using Components with Known Vulnerabilities) of the 2013 OWASP Top 10 comes in. We are consuming far more free and open source libraries than we have ever before. Much of the code we are pulling into our projects is never intentionally used, but is still adding surface … Continue reading →

Risks and Countermeasures to the Management of Application Secrets

Risks Passwords and other secrets for things like data-stores, syslog servers, monitoring services, email accounts and so on can be useful to an attacker to compromise data-stores, obtain further secrets from email accounts, file servers, system logs, services being monitored, etc, and may … Continue reading →

Node.js Asynchronicity and Callback Nesting

Just a heads up before we get started on this... Chrome DevTools (v35) now has the ability to show the full call stack of asynchronous JavaScript callbacks. As of writing this, if you develop on Linux you'll want the dev channel. Currently my Linux Mint 13 is 3 versions behind. So I had to update … Continue reading →

Design a site like this with WordPress.com

Get started