You are not your job
Work can be a big part of your life, but it can be incredibly stressful. Have hobbies, invest in relationships, find your own fresh air to breathe.
flawed.net.nz
Hacking, hardware, software, and general curiosities of computing machinery! Docendo discumus.
Latest posts
The Attackers Dilemma
The common quip “Attackers Advantage, Defender’s Dilemma” describes how an attacker must only find one way in, and the defender must plug every hole - and it gets one thing majorly wrong.
This blog is still alive
Between work and parenting and usual life distractions, things have been fairly busy. That said, I do have plenty of things to share and thoughts to write down for my future self.
LoRaHam: data over amateur 70cm bands
TL;DR: Data over ham radio using LoRa published to github
Security is remarkably unevenly distributed
Overview
Language Agnostic Security Code Review
Hunting through code for potential security issues generally requires having a very in-depth understanding of the language being reviewed. Most competent code reviewers will have some kind of background or ability to write complex programs in their chosen lanuages.
Notes on the current security of PyPI/pip
What follows is a few key considerations about the security of the Python Package Index (PyPI) ecosystem, commonly used when you pip install <thing>. I’d like to make it very clear that I love and use pip on a regular basis, and I believe the team running it is doing a good job. Using open-source code to leverage other peoples work and prevent reinventing the wheel is an absolutely good thing, but…
Pentest Skills To Land a Job in 2019
I regularly get asked the best path toward a job in infosec, specifically in pentesting or security-assessment type work. What follows is a collection of my personal thoughts on the topic.
WebApp Testing With AutoRepeater
With the modern web moving toward API-based single-page JavaScript applications, a lot of vulnerability classes are in theory on the decline. At the same time, the breaking up of functionality into microservice APIs has increased risk of various Authorization problems when the entire system isn’t viewed in broad context.
Mongoose Heap Overflow
Sometimes when stuck with some time to burn in an airport I like to poke around C code to learn new tricks and go bugspotting as a type of “sudoku for computer nerds”. This post describes a heap overflow I found in the popular Mongoose HTTP Server for embedded systems.