Kristof is a software dev and works a consultant at Xebia XMS Belgium focussing on DevSecOps and empowering fellow developers through coaching and inspiring.
Introduction I am going to learn about ethical hacking, which means using hacking skills to protect systems and data. The importance of cybersecurity continues to grow as technology becomes more essential in our lives. Understanding cybersecurity wil...
Tamperproof HTTP Requests In this article we explore data integrity and authenticity when dealing with sensitive information. This section outlines the fundamental importance of making HTTP request bodies tamperproof, particularly when handling perso...
No signature validation using AddMicrosoftAccount() TLDR; Microsoft's AddMicrosoftAccount() method does not do signature validation for tokens, which poses potential security risks. This article explores the implications of this, using an analogy of ...
Previously on... In a previous blog post, I described LibMan or Npm for a new project. I explored how to manage the required scripts. I find it important to understand the history of things. This helps me to learn why we use this technology, and what...
Previously on... In my previous articles, I discussed DevOps, DotNet and Security. This article builds upon those three components and explores the role of package managers in managing server-side and client-side libraries in a .NET MVC project. Cont...
Previously On In my previous articles, I discussed the creation of a mocked OpenID Connect provider and the evolution of the HttpClient. Today, I want to discuss how user attributes (claims) are presented to the application using tokens. Context When...
Previously on... Change is inevitable! I often find myself diving into new codebases and projects, each with its own set of challenges. Previously I explored the IConfiguration of DotNet with references to Net Framework. I will explore now a scenario...
Previously on... In my previous blog posts, I wrote about the modularity of the configuration that Dotnet 6 offers. About sources and sections and how to register them. I mentioned how to manually build the configuration object and how to use the def...
Previously on... Previously, in my blog post, I discussed that Dotnet 6 Configuration allowes dynamic reloading of configuration data without application restarts and supported multiple sources such as environment variables, appsettings.json, user se...
Previously on... In my previous blogs, you may have noticed my growing interest in security and privacy topics. Of course, there is my already existing passion for DevOps. However, in my latest blog post, I outlined how DotNet 6 offers possibilities ...
Previously on... In my previous post, I described how I regained focus on my blogging. This time, let us focus on how we can configure our settings in the DotNet "core" world. Context It's not uncommon to come across projects with poorly managed conf...
Previously on... In my previous post, I shared my journey towards obtaining the AZ-204 Azure Developer Associate certification. I discussed the challenges I faced and shared my learning strategies. Context After obtaining my AZ-204 certification, I d...
Previously on... At the beginning of the year, I challenged myself to pass a tech exam called AZ-204. In this blog post, I'll talk about my experience that leads up to taking the exam and share my process of studying for it. Context As a consultant, ...
Previously on... In my previous blog post, I wrote about JSON RCE attacks. The possibility of such an attack exists, was brought to my attention in a report by CheckMarx. I heard about SAST scans from the product team that I worked with. Our team was...
Previously on... In the previous blog post in this series, I discuss the evolution of email identities. I state the history of using creative and unique nicknames in the early days of the internet to the increasing need for real names to establish cr...
Previously on... As mentioned in the initial article of this series, I've grown increasingly frustrated with phishing emails and fraudulent text messages. My objective is to regain control of my data, and writing these blog posts serves as a commitme...
Previously on... In my previous blog post, I wrote about deserialization attacks and how to prevent them. I ended the post with a section called Hunger. There I stated I still doubted the link between JSON inside a string property and when the valida...
Previously on... I will take a brief pause from my series on securing and reclaiming control of personal data. To give a little spoiler, it is about using the tool SimpleLogin | Open source anonymous email service. In previous posts, I mentioned that...
Previously on... I started this series when I got fed up with all those scam emails and sms. It is time to retake my digital data. In my previous post, I talked about 2FA and the weak link named "the user". Context Many websites require us to create ...
Previously on... In my previous post, I stated that I will begin a series that will give the reader insight into my journey of protecting my data. I summed up multiple subjects I want to explore. I already put my IoT devices on my guest network. But ...