Signs of Triviality

Soft skills are hard, and everybody's career path different.

A rather unstructured look at one of the older and infuriatingly trivial internet protocols: WHOIS

A quick look at a common mistake made when using strncat(3), and how strlcat(3) prevents a possible buffer overflow here.

A list of resources and ideas that I wish Open Source projects followed in their handling of security vulnerabilities.

An illustration of how uninitialized stack variables can lead to undefined behavior.

A look at the different buffer sizes used for various IPC methods, including pipes, fifos, socketpairs, and sockets.

For historical reasons, inet_aton(3) accepts IPv4 addresses in several silly formats.

The common definition of a 'valid hostname' is often reduced to a simple regular expression, but as the saying goes: 'Now you have two problems.'

In C, 'main' returns an int.

Everybody knows the small number of top-level domains in the DNS: .com, .org, .net, .gov, .vermögensberatung, and .香港.

How to add DuckDuckGo Tor OpenSearch as the default search in Firefox.

Just how many weird Resource Records can you stuff into a zone file?

Let's play silly games with URLs...

An incomplete list of things just about anybody working in Information Security would benefit from knowing.

A discussion of why most information security efforts do not make economic sense.

This document is intended to help you decide how to share confidential information with others.

Nope, you don't know how to validate an email address.

Sure, we all pretend to know them, but rarely do we think they apply to us.

The Zen of Python tells us that Readability Counts.

A summary of how to confine processes to individual CPUs, using Processor Affinity (aka 'CPU Pinning') and CPU sets on NetBSD.

The Secret Language of Coders

7 battles #infosec has lost but we keep wasting efforts on trying to fight again and again nonetheless.

A quick summary of what 'Zero Trust' actually means.

Post-election mood.

A quick summary of the AWS EC2 resources needed to create an IPv6-enabled or dualstack instance.

A former Twitter thread / rant on responsible ticket management, born out of years of frustration.

A look at what places your browser phones home to upon startup.

ops is hard. what have we learned so far?

An adventure debugging a wrongly invoked execl(3) leading to a better understanding of how variadic functions work in C.

A list of things (not only) computer science students tend to erroneously and at times surprisingly believe even though they (probably) should know better.

A brief post on how OKRs can work against senior ICs efforts.

A (not quite so) brief look at DNSSEC, DNS-over-TLS, and DNS-over-HTTPS from a threat modeling point of view.

If you don't stand for something, you'll fall for anything.

Wouldn't it be nice if we could trust the DNS?

'import this', aka 'The Zen of Python' is well known and holds across other programming languages as well.

An annoyingly lengthy tcpdump filter expression to capture only SSLv2, SSLv3, and TLS below 1.2 packets.

A set of simple guidelines to write consistent unix tools.

If you're working in tech, you should read these two books, regardless of your career path or level.

'Twas the night of the moratorium, and all through the cloud not a pager was beeping: no deploys were allowed...

A summary of means to restrict Unix processes and the different approaches ultimately leading to containers.

A former Twitter thread / rant on basic ticket skills, covering how to submit a useful ticket.

A list of animal threads created and collected by #NotAnActualRealLifeScientist @jschauma.

A detailed explanation of a DNS lookup as observed via tcpdump on a resolver.

An intentionally short list of core security principles that are worth reminding yourself of.

A brief summary of the attack life cycle and how that drives the defenses we should focus on.

A quick rundown of my personal iPhone settings as far as they're relevant to security and privacy.

A quick rundown of my personal browser setup, highlighting the security and privacy relevant settings.

Write-up of my talk from O'Reilly Security 2017 on effecting change across a large organization by example of TLS.

Deploying software patches and updates is critical for your infrastructure's security, but let's not pretend that this task is trivial or a panacea.

Too many tools and scripts utilize temporary files in an unsafe manner.