World Wide Web Security
Following an earlier mostly successful experiment of vibe coding to build a simple JavaScript game, I decided to take it to the next level: see if I can use ChatGPT to assist me in discovering a new and improved algorithm for reversing JavaScript’s Math.rand( ) function. Specifically the research showed a new way to invert [ ]
CVE-2025-7783 is a very recent vulnerability affecting a lot of applications in the Node.js ecosystem including those which use axios or the deprecated request library. In all honesty, this vulnerability is really an edge case that is extremely unlikely to be exploited: it is dependent upon a number of events that are not normally present. [ ]
Professional programmers are pushing back about vibe programming, with good reason. But I am no professional programmer who gets paid to work full time on projects that need to meet customer requirements and high quality standards in collaboration with a development team. Instead, I am a busy parent with a full time job who once [ ]
This blog connects two of my favourite pastimes. It shows that solving the world s most popular puzzle, the Rubik s cube, has a perhaps surprsing relationship to the science of cracking secret codes, cryptology. To make it concrete, my cryptology focus will be on how the Polish cryptographers broke the Enigma cipher in World War II. [ ]
A recent post that showed up in reddit s /r/programming, What Happens To Developers Who Never Go Into Management?, got my mind buzzing on all the ways I had to re-invent myself to avoid going into management in the security industry. Being in my 50s, I do technical level work with people who are often half [ ]
Security code reviews is a task that I do on a daily basis, and have been doing for the last thirteen and a half years. In this time, I have reviewed several hundred code bases, and have come across cryptographic code many times. More often than not, there have been security issues in cryptography code [ ]
Committing secrets into source code repositories is one of the most frequent problems I see in application security code review, and has been so for at least 5 years. I m speaking as one who has reviewed numerous code repositories for a variety of different companies. It is a problem that never seems to go away. [ ]
If you ask Google, you will be brought to a fantasy land of fairies, unicorns, and Java being the quintessential example of a secure programming language. Whoever are writing these web pages clearly do not live in the same world as me an Application Security Specialist (there is no acronym for that title, BTW) [ ]
In 1999, Ari Juels and John Brainard came up with an elegant protection against denial of service attacks, known as the client-puzzle protocol. Their idea was patented (US patent 7197639), which might have inhibited its uptake. However that patent expired in early 2020, so it is now free for anybody to use. And it should [ ]
Certificate pinning ( cert pinning for short) is a technique used for mobile applications to add an extra layer of protection to secure communications. Some people additionally use the technique to prevent people from reverse engineering APIs via intercepting proxies, however this latter objective is hard to achieve against a determined hacker. Certificate pinning offers very [ ]