Viewing profile — jamessocol

I'd love to hear—maybe I missed another blog post—why they went with the single release manager, where only one person can merge and deploy. What happens if Doug is sick or on vaca…

Check out OpenHatch http://openhatch.org/ . Connecting people with time to projects with need is a big part of what they do.

Consider it? Definitely. But semver doesn't make a distinction, either, so it's a hard problem. If you don't mind, we'd love to get your thoughts more via email--don't want to hija…

(Disclaimer: I'm the other guy behind BundleScout.) The Django project does a fantastic job with announcements. (So does Rails.) And if every open source project had the infrastruc…

Thanks for the feedback! We'll definitely look at the right way to surface more info before signing up. (For the record, it's $5/month.)

Thanks!

I agree with all of your advice about hardening most servers, but a couple of things... > In the case of PHP, there is no security concern by it just sitting on your hard drive. It…

>> Are directories only writeable by the web server user? NB: The next point is "Do all of them even need to be? Are you sure?" > A blisteringly common one not mentioned is databas…

Honestly, "easy to overlook" is why I wrote a checklist for basics. CYA, then get to the advanced stuff.

We keep making more junior devs. It's important to drown out the w3schools and bad practices with good practices, so when they look up how to do it, they learn the right way.

Like I said elsewhere, that's a major cost/benefit calculation in terms of both real cost and user experience/conversion rate cost. If it makes sense for your app, do it, but it's …

For click-jacking, the easiest thing to do is to set the X-Frame-Options header, but I'll get to that. And it doesn't help IE And we'll get to session hijacking and why your sessio…

I updated the post to point this out.

Hopefully you're taking steps to prevent both. But yes, closing the CSRF window and leaving the XSS door open would largely defeat the purpose of CSRF protections.

Ugh, I really need to create a lighter-weight theme. Sorry about that.

> In order to issue a POST request to siteA from the evil page, the attacker only has to submit a crafted POST form using an iframe. Yes, but requiring POST for anything that chang…

Maybe we come from different backgrounds. Using open source code that's been subject to lots of eyes and lots of use, e.g. a framework like Django, reduces the surface area, to me,…

> Relying on tools or, in fact, any code you've not written yourself makes your system vulnerable. Writing everything yourself, as opposed to widely, community tested open-source a…

It's the weird combination of gettext, HTML, and user-supplied data that causes problems. But yeah, kind of surprising there isn't already something. That's why we moved the |fe fi…