Viewing profile — aeronautic

Agree. While I love rust and think it (should) replace C for web servers and the like, the majority of the issues with IOT devices are just basic security oversights and design err…

Very good point. Even requiring the user to specify a maintenance window can ruin the experience. Some patches should be able to be made "hot", but that takes extra ram which is of…

Still true when I tested last year. The core protocol does not have a defined way to get the browser to forget the login. You have to resort to different fudges on different browse…

True point. The difference is that enterprise apps understand the need to patch and update. IOT devices and device builders largely do not. IOT devices today look pretty much like …

Love it.

I know! Why do device manufacturers need to be pushed for this? We consumers keep buying stuff that has been put on the internet with little to no thought about security today or t…

If the device does not listen, i.e. it calls out, then it is inherently much more secure. However, many devices use an embedded web server and do listen for requests. If the device…

Do you mean basic & digest http auth built into the browsers? If so, yes, they are bad. The issue is you cannot reliably implement log off on all browsers.

I know, it is a very sad state of affairs. In doing IOT for 2 decades, this is probably one of the biggest issues. At best, most devices have a "download firmware" option that 99% …

Thanks everyone for some great comments and discussion. Really appreciate your time and feedback on the article. I'll fold in the feedback and the ideas and go forward with it. Tha…

No argument on that (except the horseshit ;-)

Coding is easy, writing is just darn hard!! Thanks for the ideas. I'll check those out.

Sorry that is not quite what was intended. I've revised the text to say: If your database supports low cost encryption at rest (like AWS Aurora), then enable that to secure data on…

I agree with you, but I understand his wish though. Security sometimes is just hard and it is unrealistic to hope that all developers, everywhere, all the time will get it right. T…

As the author, I should clarify that I am a developer - full time and have been for years. If my english seems to imply a lack of depth of understanding - I'm sorry. The purpose of…

Try this to get you started: https://www.troyhunt.com/understanding-csp-the-video-tutoria...

Thanks for your well structured comments. The purpose of the checklist was to get people to think. It is really hard to do much more without going very long. A number of people hav…

I think we can all agree that developers can get better educated about security and can participate building security into the product from the very start. It is hard to engineer s…

That is right. The key point is to reduce exposure to SQL injection by not formatting queries. Prepared statements help solve a whole class of bugs at a lower level.