Collaborate Disseminate
I have discovered a HUGE issue in my code, and I have literally no idea what is causing this.
SO, when I send requests to my server I hash a string thats in the request. This is sometimes user input.
My app is multi langua… Continue reading Swift HMAC doesn’t match NodeJS HMAC, but only sometimes!
Eight vulnerabilities in the HTTP/2 server implementations were found in vendors Amazon, Apple, Microsoft and Apache. Continue reading HTTP Bugs Open Websites to DoS Attacks
As a programmer, I have typically worked on projects where a lot of the security was baked in or it was not as crucial as the software was for private use. However, I am working on a project that takes users’ answers and calc… Continue reading What are some things to consider when making a secure assessment system?
I am setting up a private home management system containing several daemons/servers and a few clients to connect from.
I am trying to achieve end-to-end encryption with the most monitoring and health check processes I can in… Continue reading End-2-End and server to server encryption over home network
I am hashing all requests to my server with a secret token known by only the server and my mobile app to prevent malicious apps from using my servers.
Should I also do this on the responses from the server, to validate the s… Continue reading Should I hash responses from server?
I am looking for a encryption algorithm for my app server. Data will be encrypted on server and decrypted on a ios application.
I tried aes256ctr, but it is clearly not suitable for this, as the encryption key needs to be th… Continue reading Best encryption algorithm server to mobile app client?
I have been successfully using openssl to encrypt a large file. I’m trying to develop the equivalent nodejs crypto API code for the following openssl commands:
openssl rand -hex 64 -out {keyfile}
openssl enc -aes-256… Continue reading How to translate "openssl enc" command to nodejs crypto api
the npm advisories site lists quite a lot of malicious packages which – in my understanding – are not packages with vulnerabilities but malicious per se. These packages were removed from the npm repo for good reason, but is t… Continue reading Can I get hold of malicious npm packages?
If you have the seeds for Math.random() using mwc1616, are the random numbers generated in the same order every time / are they repeating? Basically wondering if, given a seed, can I predict past outputs of Math.random()?
(G… Continue reading Predicting Math.random() sequence using V8’s MWC1616 algorithm
you probably know the npm-audit tool which informs you about vulns in your node.js projects dependencies. I’d like to know what database npm-audit is using and how I get access to this data.
Thank you 🙂