Recent content on Joe M.
Cast your mind back to the early 2000s… Dating was very different. For those living pre-iPhone there was no Tinder (2012), Hinge (2013), or Bumble (2014). Primarily desktop-driven apps like OKCupid (2004), eHarmony (2000), and the original, venerable, Match.com (1995) dominated. Swiping as a fundamental dating U/X didn't exist yet. Instead people specialized in long-form essays about why…
“We need to integrate with a SOAP API that's been deprecated for 3 years” said the Engineering Manager. And the Developer wept. A Senior Developer wanted to choose the best Node framework for his project, so he asked the Master. “Deno” said the Master. “Teacher” asked the Junior Developer, “Why doesn't my feature work in Firefox?” “All features…
A while ago my friends and I were brainstorming names for our then as-yet-untitled-form-side-project #1. We had a few considerations in mind that, in light of recent discussions around naming, could be fun to share. So I'll share them. We wanted our name 1) to be simple, 2) possible to register as a .com or .io domain, 3) have a positive association, and 4) to explain the service had something to…
Over the years of avidly collecting my niche (New Age science fiction from the 60s and 70s), I've picked up a few germs of knowledge about book collecting, preservation, and general enthusiasm. It is an addicting hobby, and like any pursuit, something you can improve at with just a tiny bit of perfectly normal, not-clinical, garden-variety obsession. Buy your Bible Before anything else, buy the…
🍰 Formcake was made to solve a simple but common problem: You have a contact form, lead page, or survey, but you don't want to spin up an entire server just to field that one form's submissions. Enter Formcake - you sign up, create a form, and get an endpoint that looks like formcake.com/api/forms/<YOUR_FORM_ID/submissions that you can put into your <form> tag's action endpoint. You can then…
Today I'm going to discuss implementing a loading icon like you see in a lot of SPAs within the context of a Nuxt project I'm working on - Form Cast, a simple form backend-as-a-service. The Icon My project at the moment is pretty spartanly designed, with a plain white background. For my loading icon, I wanted something with a flash of both activity and color. After surfing around, I decided on…
The form market is huge. Everyone wants to make drag-n-drop, marketing and growth hacker-friendly forms that can do everything from lead capture to payment processing. And so naturally, I asked … maybe there's room for me? But seriously, with a lot you get less-than-stellar design, clunky widgets, and unwieldy WYSIWYGs. That's why a few friends and I decided to dream up an MVP based on…
“Generate a react app without scaffolding” instructed the Master. The student could not. The old man told the young: “Python has seen 3 versions in my day”. The young man responded: “Node has 12.” “Teacher”, the student inquired, “What's the best Javascript MVC?” The teacher replied. “It's not JQuery.” A Junior Developer…
Introduction Last year I published my first book with a publisher, Hands on Bug Hunting For Penetration Testers. Going in, I was determined to set up a workflow that would allow me to: Keep a backup of the book. Allow me to easily track my writing progress. Work on the book offline. Keep my own copy of the book. What set of tools could possibly control the versioning, backup, access control, and…
Seven weeks ago, a friend and I started writing a newsletter for junior devs and strategizing about stuff like open rates and content strategies. But if you've followed any of this before now - or seen those link titles, you'll notice we go from 100 subscribers in two weeks to 250 in three all the way up to… 300 users after almost two months. What happened? Why We Hit a Plateau There are a…
Scanners have a tricky reputation. Their point-and-click simplicity and utility as automated reconnassiance tools means they get love from script kiddies and professionals alike. They also have compelling use cases for flushing out certain vulnerabilities, like XSS, where there may be too many input vectors or payload varities to feasibly go through the application by hand. The problem is a lot of…
Landing your first “Software Developer” or “Web Developer” position is a big get. More than a designer-who-programs or a writer-who-markups, taking on a role where your principal responsibility is coding is a big step in any technology career. You could be thinking about a career transition or graduating a bootcamp or computer science program - this article has five tips,…
At three-weeks, the ongoing experiement in writing a newsletter for junior devs and open strategizing is in full swing. Quick recap: Three weeks ago a friend and I launched jobletter a job newsletter targeted early career devs looking for quality listings and career information. Writing about this experience provides an opportunity to chronicle our efforts. If it grows this will be a fun account…
Three weeks ago we launched jobletter. Since then, we've been promoting the site, collecting feedback from friends, and experimenting with with a more open approach to writing about our process. All that culminated in us reaching a milestone this past Friday - our first email. Over the past week we'd worked with a freelancer to deliver an email template, as well as winnow down the jobs we'd been…
Recently my business partner and I launched a new service, jobletter.io with a simple premise: We deliver Junior Developer jobs to your inbox. Breaking into development to get those all-important first two years of production experience is long, exhausting work, filled with pouring through a lot of “Software Developer - 5+ years req” posts and keyword salads where your prospective…
A few days ago, David Broadlick and I launched Jobletter into beta, as a way for developers at the beginning of their careers to get a concentrated dose of high-quality jobs targeting their skillset and experience level. Right now we're still building out some of our customization features: We'd like to add location and specific skill targeting, more customized sending schedules, and more content…
Seed apps are great. They can be the test-bed for new devops features, mini onboarding exercises, or just “batteries-included” starter kits for greenfield applications. Especially in the web application (and Python) world, almost everything comes with extra considerations - testing, linting, containerization - wouldn't it be great if we could make a Python seed that came with all of…
Hunting for XSS XSS / Cross-site scripting (which is just another form of Code Injection) can be a severe vulnerability. It's also very common. That potent combination - profitability and ubiquity - marks it as a worthy target for penetration testers interested in public bounties.But because of a high rate of false-positives (and inevitably imperfect detection logic) the process of ferreting out…
Hands-On Bug Hunting for Penetration Testers is now available. The book covers how to detect, validate, and write submission reports for XSS, SQLi and NoSQLi, XXE, CSRF, and more vulnerabilities, including sections on detecting hidden content, crowdsourcing code injection snippets and other malicious inputs, writing quality submission reports, and more. It uses Burp Suite as a principal tool and…
When I was setting out to revamp my personal blog and create a new site for my book, I had a couple of considerations in mind. I wanted both sites to be highly-available (I don't get much traffic, but also don't want a hug of death), simple (with as few moving parts as possible), and easy-to-update and generally extend. All of that led me to a static workflow. Settling on (but not for) Static I…
All writers have their own workflows for writing: Many people use Word, Google Docs, or Libre Office - George R.R. Martin famously uses WordStar, a DOS-based text-processing system from the mid-80s. As long as your personal productivity is juiced and you're comfortable, you can be as idiosyncratic as you want. Somewhere a hardcore cypherpunk is writing the next cryptographic epic in vim. In that…
One of the most helpful tools in learning the fundamentals of penetration testing is the ability to test your analysis against deliberately-vulnerable applications - sites and/or apps with consciously introduced flaws, catalogued for easy reference. Beyond a great introductory exercise, testing against deliberately vulnerable apps can also be a great way to calibrate new scanners or automated…
Update: The book has since been released. See how to purchase it at handsonbughunting.com or use the Amazon link included in the article below. This October I'll be releasing my first book with Packt publishing, Hands-On Bug Hunting for Penetration Testers. The book covers: Preparing for pentesting engagements Building an automated pentesting workflow Detecting and reporting OWASP's Top 10 most…
If you're a freelance security researcher, chances are you've heard of — or use — Burp Suite, a program commonly considered the gold standard for penetration testing software. But if you're only using the stock version, as great as it is, you're missing out! Both the free and paid versions of Burp support helpful extensions that add extra functionality to the main client — whether it's a separate…
Functional Programming is a powerful programming paradigm that tries to reduce bugs and make it easier to reason about an application by avoiding state changes and the mutation of global values, generally. In software coded using functional programming patterns, all functions can be understood by the arguments passed to them as parameters. There is no reliance on the instance variables of the…
What's Markdown? Markdown is punctuation for the web. It enables authors to easily write documents that feature common online staples like links, images, as well as italicized, bold, and other types of rich text, using a simple, lightweight set of symbols that can easily be converted to HTML, doc, pdf, or rtf files. Since markdown files are just plain text, they're an ultra-portable way to write…
Two jugglers walked around a small track, practicing their craft. The first one, Sync, wasn't really what you'd call a juggler, so much as an apprentice juggler or (less charitably) a juggler-wannabe - a straight up ball tossin’ poseur. Sync could only keep one ball in the air at a time. In fact, he only owned one ball. As he traced the circle of the track with his steps, his bouncy red ball…