Technical page 2 - Dave's Blog


Search

Web Security Contest - Stripe CTF

2012 Aug 27, 4:18

Stripe is running a web security capture the flag - a series of increasingly difficult web security exploit challenges. I've finished it and had a lot of fun. Working on a web browser I knew the theory of these various web based attacks, but this was my first chance to put theory into practice with:

  • No adverse consequences
  • Knowledge that there is a fun security exploit to find
  • Access to the server side source code

Here's a blog post on the CTF behind the scenes setup which has many impressive features including phantom users that can be XSS/CSRF'ed.

I'll have another post on my difficulties and answers for the CTF levels after the contest is over on Wed, but if you're looking for hints, try out the CTF chatroom or the level specific CTF chatroom.

PermalinkCommentscontest technical security

Brainfuck beware: JavaScript is after you! | Patricio Palladino

2012 Aug 10, 10:18

“tl;dr I just made a tool to transform any javascript code into an equivalent sequence of ()[]{}!+ characters. You can try it here, or grab it from github or npm. Keep on reading if you want to know how it works.”

JavaScript has some crazy implicit casts.

PermalinkCommentstechnical humor programming javascript obfuscation

Decrypt.py: Act like a decrypting hacker on tv (github.com)

2012 Aug 8, 3:34

A python script that d3crypt5 the input pipe’s ASCII content from ASCII garbage slowly into the correct output.

PermalinkCommentstechnical humor hack decrypt

(via HTTPSTER T-Shirt) Maybe for Eric?

2012 Aug 8, 3:14


(via HTTPSTER T-Shirt)

Maybe for Eric?

PermalinkCommentshumor tshirt shirt gift http technical

Nanex ~ 03-Aug-2012 ~ The Knightmare Explained

2012 Aug 6, 4:29

We believe Knight accidentally released the test software they used to verify that their market making software functioned properly, into NYSE’s live system.

I get chills breaking the build at work.  I can’t imagine how much worse it would feel to deploy your test suite and destroy the company you work for.

PermalinkCommentsmoney stock knight software trading technical

(via Pareidoloop) “Phil McCarthy’s Pareidoloop...

2012 Aug 6, 4:11


(via Pareidoloop)

“Phil McCarthy’s Pareidoloop overlays randomly generated polygons on top of one another until facial recognition software recognizes a human face. Can’t sleep, at SIGGRAPH! [via @Brandonn]”

PermalinkCommentstechnical images facial-recognition siggraph

The Netflix Tech Blog: Chaos Monkey released into the wild

2012 Jul 30, 3:49

Chaos Monkey randomly kills your Amazon Web Service VMs increasing the failure rate forcing your web service to deal with it.

PermalinkCommentstechnical programming web amazon netflix

Newsroom: Miscellaneous: New Online Tool Gives Public Wider Access to Key U.S. Statistics

2012 Jul 28, 2:35

The U.S. Census Bureau today released a new online service that makes key demographic, socio-economic and housing statistics more accessible than ever before. The Census Bureau’s first-ever public Application Programming Interface (API) allows developers to design Web and mobile apps to explore or learn more about America’s changing population and economy.

PermalinkCommentstechnical api census statistics stats web restful rest

Living with HTTPS (imperialviolet.org)

2012 Jul 19, 6:03

Notes on practical HTTPS security issues.

PermalinkCommentsnetwork technical https security

Windows Executable Walkthrough Graphic (corkami.com)

2012 Jul 19, 5:58

Breakdown of the bytes of a Windows executable in a big old chart!

PermalinkCommentstechnical windows programming

Everybody hates Firefox updates - Evil Brain Jono's Natural Log

2012 Jul 16, 1:59

Former FireFox developer on the switch to their continuous update cycle. 

Oh no, Chrome is doing such-and-such; we’d better do something equivalent or we’ll fall behind! We thought we needed a rapid update process like Chrome. We were jealous of their rapid update capability, which let them deploy improvements to users continuously. We had to “catch up” with Chrome’s updating capability.

Dealing with servicing on IE for years had led me to some of the same thoughts when I heard FireFox was switching to continuous updates.

PermalinkCommentsfirefox via:ericlaw web-browser technical web browser servicing update software

Indicating Details of Problems to Machines in HTTP

2012 Jul 3, 2:28

This specification defines a “Problem Detail” as an extensible way to carry machine-readable details of errors in a response, to avoid the need to invent new response formats.

PermalinkCommentstechnical http ietf standard

TLDRLegal - Software Licenses Summarized in Plain English

2012 Jul 3, 6:39

Lookup any software license shortly summarized in plain English.

PermalinkCommentstechnical legal law license software

JSON Hypermedia API Language

2012 Jul 1, 1:52

The JSON Hypermedia API Language (HAL) is a standard which establishes conventions for expressing hypermedia controls, such as links, with JSON.

PermalinkCommentsjson uri url link technical standard ietf

The "acct" URI Scheme

2012 Jun 30, 3:09

During formalization of the WebFinger protocol [I-D.jones-appsawg-webfinger], much discussion occurred regarding the appropriate URI scheme to include when specifying a user’s account as a web link [RFC5988].

acctURI      =  “acct:” userpart “@” domainpart

PermalinkCommentstechnical uri uri-scheme acct ietf

Kim Dotcom image macros?

2012 Jun 26, 6:58PermalinkCommentshumor legal technical kim-dotcom mega megaupload politics twitter

“Fuck You, Pay Me” is a talk on contracts, payments,...

2012 Jun 25, 2:06


Fuck You, Pay Me” is a talk on contracts, payments, etc. for free-lance designers.

PermalinkCommentsbusiness web-desgin video technical

Why Your Links Should Never Say “Click Here” - UX Movement

2012 Jun 25, 1:06

I’ve been following this advice for many years now to the extent that I find myself rewriting text to make linking my nouns easier and shorter.

The one I wasn’t following that seems obvious only after I read it is to keep links towards the end of your text to allow users to follow the link once they’re done reading.

links at the end of the sentence allow users to take action faster

PermalinkCommentsweb technical ux html

Microsoft Surface: a gentle kick in the teeth of the OEMs | Ars Technica

2012 Jun 25, 12:59

But if Surface is aimed at the OEMs—telling them “we can do this just as well as you can, if we have to”—and setting them a challenge—”your tablets have to be at least this good”—then the limited availability isn’t necessarily such a big deal. As long as the OEMs heed the warning and raise their game, so that Redmond can be assured that bad hardware won’t jeopardized Windows 8’s success, Microsoft could safely keep Surface operating as a small-scale operation, playing the Nexus role without upsetting the PC market.

PermalinkCommentstechnical surface win8 windows windows8 business

The Fiddler Book: "Debugging with Fiddler: The official reference from the developer of Fiddler"

2012 Jun 23, 9:19

THE Fiddler Book straight from the source, EricLaw - the developer of Fiddler!

Fiddler is a wonderful tool with never ending extensibility. With this book I shall master it!

PermalinkCommentstechnical programming book ericlaw fiddler http
Older EntriesNewer Entries Creative Commons License Some rights reserved.