2014
-
Self-Hosted VPN
Jul 10
I’m a stickler for security, so how can I in good conscience connect to a network I don’t trust?
-
SHA and Length Extension Attacks
Jun 3
Developers keep raising a concern about a particular type of attack that might be related to my Secure XML-RPC proposal. Let me explain why it’s not a concern.
-
WordPress and Password Hashing
Apr 21
WordPress’ password creation/verification system is pluggable (meaning you can replace it with your own implementation). Before you do so, though, you should understand what’s already implemented and why.
-
Dynamic CDN: PHP and Checksums
Mar 21
The general gist of Dynamic CDN is to scan page content before returning it to the browser and dynamically replace locally-hosted assets (images, scripts, styles, etc) with their CDN-hosted equivalents. The trick is returning consistent CDN urls for hosted assets – the plugin uses PHP to generate a checksum for asset references so it can…
-
Democratizing SSL Certificates
Feb 28
I have an easier time trusting individuals and corporations I personally know than large companies with whom my only relationship is as a certificate vendor. I’m also a huge proponent of democratizing both publishing on the Internet and the Internet itself.
-
Web Requests and Data Leakage
Jan 18
Even if your site is browsed over HTTPS, it can be insecure if any assets (images, scripts, styles) are transferred over an HTTP connection. This will trigger a “mixed content” warning in the browser that many will brush off as unimportant. The warning can be a major issue for some sites, though, and I want…
-
Ethics in Software Development
Jan 14
Where do we, as software developers, draw the line with releasing new software? Do we build software with the common good in mind and ignore the potential consequences of releasing such tools to the world? Do we hold back potentially groundbreaking achievements because they could be misused by the wrong hands?