Thoughts and experiments on software, security and better coding practises.
This is a story of how I exploited local travel companies’ IT systems to score free airline tickets, bus passes and ferry rides. It all started out with an accidental discovery of a bug in an airline’s booking system and just spiraled from there. Disclaimer: All the bugs were discovered, verified, and reported. Any issued tickets were canceled and not used. Part One: The Plane The accidental…
This is the first part in a series about building the web security scanner WebSecurity.is . The scanner is implemented as a web service in Go and is designed to test web apps in 4 categories of security - HTTP, HTML5, connection (SSL/TLS) and Google Safe Browsing . I’ve previously written how it can help secure web apps . HTTP requests with Go We start off with the most basic part, how to scan web…
I recently launched WebSecurity.is to help developers and operations people secure web apps. It’s designed to test web apps in 4 categories of security - HTTP, HTML5, connection (SSL/TLS) and Google’s Safe Browsing. Previously known as “HTTP Security Report”, the tool was renamed since the focus wasn’t just on HTTP anymore. The scanner performs 27 checks and tests and presents the results as a…
During my twelve years as a developer I have gone through more crunch times than I can remember. Those that I remember, I have good memories from; late night pizzas, bonding with team members, solving big and small problems (and creating others at the same time), high fives and laughs. These memories comes at the cost of occasional all nighters, long weeks, longer weekends, months of every sprint…
Content security policy (CSP) is an immensely powerful tool for protecting our websites by providing browsers with the expected type, behavior and origin of its content. A good CSP is based on a white-listing approach, disallowing everything except explicitly allowed content. CSP is not without some pitfalls, and requires careful deliberation before deployment. Tl;dr - Be careful what you…
The solution, according to the Internet <script src="//code.jquery.com/jquery-1.11.3.min.js"></script> <script>window.jQuery || document.write('<script src="path/to/your/jquery"><\/script>')</script> Short and sweet, and totally fails for my site which is using CSP (without “ unsafe-inline ”) and therefore disallows inline scripts. How about moving it to a separate js file - the main app.js file…
Regional content unblocking is the act of bypassing restrictions and accessing content which is not meant for your geographic area. In the past, such unblocking typically involved a screwdriver and soldering iron. Bricked hardware was the worst potential result. Today, unblocking is done by configuring your Internet settings or router. Doing so could put your entire Internet traffic in the hands…
I once was a part of a team of five developers, three senior developers, me and one other developer who was not as experienced or didn’t have the same skillset as the rest of the team. Faced with a major architectural decision, one of the senior developers spent some time designing a solution before the whole team spent an entire day iterating on it. At the end of the day we had reached a point…
HTTP Public Key Pinning (HPKP) is a brand new standard for a new HTTP header from IETF. It’s an instrument for websites to tell browsers which SSL/TLS certificates they should accept, or limit the accepted certificates to those issued by specific certificate authorities (CAs). The purpose is to prevent against man-in-the-middle attacks due to compromised or misbehaving CAs. For more details…
When we talk about refactoring we’re usually talking about small code changes that don’t affect the external behaviour of the code but improve readability and/or maintainability of the code. These two things often go hand in hand and by focusing on improving readability we often end up with code that is more maintainable. Why should I refactor my code? When I am refactoring I usually start by…
