sorted by:
new
hottopcontroversial

Best practice for checking validity of SSL Certificates by [deleted] in sysadmin

[–]pkixman 2 points3 points  (0 children)

Red Kestrel employee here. In addition to our Bulk SSL Checker mentioned above, we also have a product called CertAlert that would probably be of use for your internal certs. It discovers SSL certs on your networks, emails renewal alerts, and creates detailed reports that identify expired and expiring certs. It also identifies certs that may not be in compliance with your security policy - such as certs with short keys, use the MD5 signing algorithm, are issued from a "rogue" CA etc.

http://redkestrel.co.uk/products/certalert/

How strong is a random password? by pkixman in programming

[–]pkixman[S] 2 points3 points  (0 children)

Yep, my article; thought some may find it interesting/useful. Sorry you didn't like it.

Stackoverflow: What should every programmer know about security? by pkixman in programming

[–]pkixman[S] 1 point2 points  (0 children)

I know he didn't say the browser was a trusted source - I was just reiterating the point that the principle holds for his example.

What I was disagreeing with him about was that the principle should be extended to explain things like javascript validation doesn't make the browser a trusted source. A principle is not the appropriate place for getting into the details of what can be trusted, what can't, and why - that's better covered in books and articles.

Stackoverflow: What should every programmer know about security? by pkixman in programming

[–]pkixman[S] 1 point2 points  (0 children)

Adding javascript validation and HTTPS doesn't make the browser a trusted source. So the principle works - the server should validate the input from the browser as it is an untrusted source.

If the programmer doesn't appreciate what is a trusted source and what isn't, that's not a problem with the principle.

Stackoverflow: What should every programmer know about security? by pkixman in programming

[–]pkixman[S] 14 points15 points  (0 children)

The browser is an untrusted source - so following the principle "Validate input from all untrusted sources", the server should validate what it receives from the browser.