Hacker News Reader

1690von Vulnerability Spotlight: Python.org certificate parsing denial-of-service

Is the advisory page loading for others?

https://www.talosintelligence.com/reports/TALOS-2018-0758 404s

1690von Panerabread.com leaks millions of customer records

That is a terrible idea. Imagine sentencing programmers to jail for security issues in their code.

1690von The Tangled Web: A Guide to Securing Modern Web Applications (2011)

I finally got around to reading lcamtuf's other book, Silence on the Wire (2005) this wekk.

If you have even a small amount of interest in passive recon, it is excellent- http://lcamtuf.coredump.cx/silence.shtml

1690von [dead]

This post is a weird mix of advertisement and stating the obvious.

1690von Reverse-engineering the Starbucks ordering API

It also expands the total attack surface of a system, which can lead to security problems. If you read some of the public disclosures from various bug bounty programs, neglected APIs have led to some serious vulnerabilities.

"Underprotected APIs" is actually number 10 on the OWASP Top 10 for 2017.