Some time ago, I wanted to encrypt a bunch of data in an application I was writing in Rust, mostly to be stored in a database, but also session cookies and sensitive configuration variables. Since Rust is widely known as a secure-yet-high-performance programming language, I was expecting that there would be a widely-used crate that gave me a secure, high-level interface to strong, safe…
When I recently announced that I was starting an open source crowd-funding experiment , I wasn’t sure what would happen. Perhaps there’d be radio silence, or a huge out-pouring of interest from people who wanted to see more open source code in the world. What’s happened so far has been… interesting. I chose to focus on action-validator because it’s got a number of open feature requests, and it…
As I’m currently somewhat underemployed, and could do with some extra income, I’m starting an open source crowd-funding experiment . My hypothesis is that the open source community, and perhaps a community-minded company or two, really wants more open source code in the world, and is willing to put a few dollars my way to make that happen. To begin with, I’m asking for contributions to implement a…
tl;dr: there is an attack in the wild which is triggering dangerous-but-seemingly-intended behaviour in the Oj JSON parser when used in the default and recommended manner, which can lead to everyone’s favourite kind of security problem: object deserialization bugs! If you have the oj gem anywhere in your Gemfile.lock , the quickest mitigation is to make sure you have Oj.default_options = { mode:…
For the past decade-plus, every piece of software I write has had one of two release processes. Software that gets deployed directly onto servers (websites, mostly, but also the infrastructure that runs Pwnedkeys , for example) is deployed with nothing more than git push prod main . I’ll talk more about that some other day. Today is about the release process for everything else I maintain – Rust /…
In my companion article , I made the bold claim that your release process should consist of no more than two steps: Create an annotated Git tag; Run a single command to trigger the release pipeline. As I have been on the Internet for more than five minutes, I’m aware that a great many people will have a great many objections to this simple and straightforward idea. In the interests of saving them…
It’s not often that a company is willing to make a sworn statement to a court about how its IT practices are incompatible with the needs of the Internet , but when they do… it’s popcorn time. The Combatants In the red corner, weighing in at… nah, I’m not going to do that schtick. The plaintiff in the case is Alegeus Technologies, LLC , a Delaware Corporation that, according to their filings, “is a…
As regular readers would know, since I never stop banging on about it, I run Pwnedkeys , a service which finds and collates private keys which have been disclosed or are otherwise compromised. Until now, the only way to check if a key is compromised has been to use the Pwnedkeys API , which is not necessarily trivial for everyone. Starting today, that’s changing. The next phase of Pwnedkeys is to…
Whenever a large corporation disgorges the personal information of millions of people onto the Internet, there is a standard playbook that is followed. “Security is our top priority”. “Passwords were hashed”. “No credit card numbers were disclosed”. record scratch Let’s talk about that last one a bit. A Case Study This post could have been written any time in the past… well, decade or so, really.…
Visit any GitHub project page, and the first thing you see is something that looks like this: “Code”, that’s fairly innocuous, and it’s what we came here for. The “Issues” and “Pull Requests” tabs, with their count of open issues, might give us some sense of “how active” the project is, or perhaps “ how maintained ”. Useful information for the casual visitor, undoubtedly. However, there’s another…