Since almost nobody uses DNSSEC and mail is delivered anywhere. No need to mention it in the articles.
69,558 karma · joined January 13, 2008
Formerly at kCura/Relativity, security. I do application penetration testing for hire these days. Happy to chat about application security, programming, and ham radio. My conversations about agriculture are not that interesting.
Security: https://ciexinc.com/ Of particular interest are the solarwinds articles at https://ciexinc.com/blog/solarwinds/index.html Old very fun projects: https://ciex-software.com
“Eventually, all things merge into one, and a river runs through it. The river was cut by the world's great flood and runs over rocks from the basement of time. On some of the rocks are timeless raindrops. Under the rocks are the words, and some of the words are theirs.
I am haunted by waters.”
Beware the anxiety industrial complex.
For additional info, see https://sockpuppet.org/stuff/dnssec-qa.html and https://sockpuppet.org/blog/2015/01/15/against-dnssec/
So it is simply not humanly possible.
That is good. I have long believed that "if it is not tested, it is broken"
Have you had anyone do a penetration test on it?
1=1
1=0
There are MANY other tricks that don't involve ''.
Besides, consider the number of valid queries done by the application that involve '*'. You are not going to turn that off.
Blind SQL injection is a type where no error is produced, but some subtle signal can indicate success or failure. The most interesting one that I know about is where the presence of a successful injection was a normal looking response that was one byte longer than an unsuccessful injection. This was used to not only figure out the schema, but to fully exfiltrate the entire database.
There is nothing in the log on the server that indicates an error.
Most of the relatively introductory SQL injection exercises that I taught proceed without any knowledge of the schema.
This is why SQL injection is so insidious.
For another example of what defenders are up against, see https://users.ece.cmu.edu/~adrian/731-sp04/readings/Ptacek-N.... This paper all but caused an upheaval in the WAF industry.
The architecture of Concurrent Programs, Per Brinch Hansen
Literate programming--see http://www.literateprogramming.com/
I don't recommend Design Patterns, as these are elements needed if your programming language is inadequate.
There are many more.
This is not presuming good faith, as he guidelines ask that we do.
I've been programming for 60 years in many different fields. I was programming long before he was. It is possible that I have written more code than he has in more languages (36 at last count), so my criticism of his are based on real-world experience.
From what I can deduce, his major coding work was long in the past, and maybe in C++.
This is what it is about. All the other things that have been invented need to be in service of this goal.
It should be the best solution to the problem direct whether or not use of OO is best, not the language.