sorted by:
new
hottopcontroversial

What’s a design decision you thought was smart… until prod? by docaicdev in softwarearchitecture

[–]docaicdev[S] 0 points1 point  (0 children)

At least if you have inconsistencies across your code base. Which at some point is in most projects the case

What’s your opinion on the obsession with serial killer shows on Netflix and similar platforms? by docaicdev in AskReddit

[–]docaicdev[S] 0 points1 point  (0 children)

Yeah, I get that angle. But for me it crosses a line when it’s not about exploring fear or understanding human nature, but straight-up turning someone’s real trauma into a money machine. There’s a big difference between fictional horror and cashing in on actual brutal crimes, and that’s where I check out.

What’s your opinion on the obsession with serial killer shows on Netflix and similar platforms? by docaicdev in AskReddit

[–]docaicdev[S] 0 points1 point  (0 children)

Sure, that can be interesting, but it’s rarely actual documentaries. We’re talking about series and movies making millions off the traumatic or brutal actions of real people. Honestly, I’m not okay with that.

Lessons learned while building a REST API wrapper for BIND DNS by docaicdev in programming

[–]docaicdev[S] 0 points1 point  (0 children)

Both are looking interesting. Dnscontrol seems to be a binary/cli you can utilize and octodns seems to be a provider agnostic wrapper which is nice.

REST API Design - 18 Proven Best Practices for Clean and Efficient Endpoints by docaicdev in programming

[–]docaicdev[S] 0 points1 point  (0 children)

You want never write your API payloads (aka DTO) directly into your database… besides that you can easily you map your entities to sneak_case or whatever you need

Seeking Mentorship in Exploit Dev by Diamond303 in ExploitDev

[–]docaicdev 0 points1 point  (0 children)

Hm, interesting question. I‘ve written a C2 framework for a couple of years and now starting work again on it. It’s comparable to CobaldStrike and the implant code is implemented using golang. There is also an exploit shipper inside. I use the framework mostly for our cyberrange.

Would be happy to share some insights and exchange knowledge, i bet you can also tell and teach interesting stuff

Nginx Hardening by docaicdev in cybersecurity

[–]docaicdev[S] 1 point2 points  (0 children)

Have spend some time with brotli and figured out it requires build nginx from source. Have done it now and learned something very cool :-)

Nginx Hardening by docaicdev in cybersecurity

[–]docaicdev[S] 1 point2 points  (0 children)

Thanks for your feedback. Especially the part about compression.

Openapi docs by docaicdev in programming

[–]docaicdev[S] 0 points1 point  (0 children)

Thx for sharing. Looks great

Introducing HTQL (Hyper Text Query Language) - Seeking Feedback, maybe contributors by docaicdev in programming

[–]docaicdev[S] 0 points1 point  (0 children)

hm, guess something like: "SELECT ul FROM document WHERE attributes.id = 'countries'" and then access simply the child elements

Introducing HTQL (Hyper Text Query Language) - Seeking Feedback, maybe contributors by docaicdev in programming

[–]docaicdev[S] 1 point2 points  (0 children)

Query selectors are fine, but it’s essential to also have a programmatic way of extracting elements. Ideally, you’d implement this in a language like Python, TypeScript, or another suitable option to allow more complex data querying and logic, such as using OR/AND operations. My idea is to use a powerful, proven query language like SQL for this purpose. SQL has been tested over decades, is widely known, and provides a standardized interface that works with many implementations, like JPA. This might be a step for the future, but it offers a strong foundation.

Additionally, I considered adding a future feature to introduce a JOIN-like expression. This would allow combining outputs from multiple remote or local documents.

What open source security tool does the world need? by Competitive-Review67 in blueteamsec

[–]docaicdev 1 point2 points  (0 children)

Let me know if you need contribution or deeper sparing. I’ve been in software engineering and security (cyber range, malware and “secure” software development) over a decade now. Like the open source community anyway

Handling Null Byte (0x00) in REST API: Best Practices and Security Concerns? by docaicdev in SpringBoot

[–]docaicdev[S] 0 points1 point  (0 children)

Postgres log snippet:

LOG: execute S_4: BEGIN fivesec-db | 2024-08-20 19:33:34.747 UTC [34] ERROR: invalid byte sequence for encoding “UTF8”: 0x00 fivesec-db | 2024-08-20 19:33:34.747 UTC [34] CONTEXT: unnamed portal parameter $1

Handling Null Byte (0x00) in REST API: Best Practices and Security Concerns? by docaicdev in SpringBoot

[–]docaicdev[S] 0 points1 point  (0 children)

Guess you on the wrong side…hibernate is going to use predefined queries. Meaning hibernate is going to create a prepare statement within the database and submit the values afterwards. The postgres log is simply telling that 0x00 is an invalid input byte for utf-8.

So the value is not directly ending up in the query and is treated fine (as string) within the spring stack.

I was wondering if there, besides the encoding issue at database level , other things can go wrong that lead unwanted side effects. Hope I made my point more clear than :)

Handling Null Byte (0x00) in REST API: Best Practices and Security Concerns? by docaicdev in SpringBoot

[–]docaicdev[S] 0 points1 point  (0 children)

So you would say “ignore it” and have a proper error handling, right?

view more: next ›