Viewing profile — nupark

I'm not offering a "pointed critique of Rails" ([edit] although your framing it as such seems to encourage downvotes into the negatives). I'm demonstrating how the use of non-param…

A "vast number of issues"? Huh? Citation needed. The last time I researched this, I started here: http://www.google.com/search?sourceid=chrome&ie=UTF-8&#3... ... would up and sourc…

It is not unreasonable to assert that SQLI defense is a framework concern, not a database issue. The database is the normative reference on what is and is not a special cased chara…

Could you expand a bit on how parameterized queries are not sufficient for defense against SQL injection (assuming, of course, that developers use the escaping and do not concatena…

> You don't need parameterized queries or stored procedures for protection against injection ... There's no need for the database's native wire protocol to explicitly support param…

I honestly have no idea what you're talking about or advocating, if anything. If you switch to the JVM, a buffer overflow triggers determinate behavior -- it throws an exception ra…

The fix IS that simple. Stop using non-sanitizing APIs. Your equated that with saying "stop making mistakes," which is what I objected to. The original poster was right: people nee…

For example, lots of programs written today still have buffer overflow vulnerabilities. Those are even older. The fix is also very simple: "Check the bounds of your arrays before y…

How many NEW desktop apps have you installed recently? I don't install new desktop apps very often because my needs are already solved. I do nearly all my work in: - Mail.app - Xco…

Your boss wasn't far off base. A web application is not a replacement for a native application, even if you bundle it up in a UIWebView and sell it through the app store. My organi…

"Lux Living" is a satirically named blog focused on the huge Stuy Town ( http://www.stuytown.com/ ) complex in the East Village. The full set of articles: http://stuytownluxliving.…

do you know how many web/ISP hosting providers are out there that give out non-root SSH access to their customers? or how many do shared PHP hosting that make it easy to run local …

Work on it how? Acquiring root locally is easy because local exploits are a dime a dozen, and once you have local access you can simply piggyback on valid authentication: alias sud…

Why not? My servers have no passwords at all -- they either use SSH keys or kerberos. Once you have access to a local shell, the game is over. Acquiring root is easy, between local…

Given where Core OS sits in the software stack (kernel, libc, file systems, etc), being "academic" and "by the book" shouldn't be surprising. :) As to the rest; my point was that B…

Speaking as a former Apple engineer in Core OS, this is a bit too glowing. Serlet wrote quite a bit of code in the NeXT days, much of which does not meet what you would call modern…

Figuring out a way around the standardized admissions process is the admissions process for nonstandard applicants. This is no different than anything else in life, from job applic…

Providing a poor quality application doesn't necessarily tell you anything about the audience a proper port would have, it can be significantly damaging to your brand, and is a was…

Yes, this applies to the original article -- and the minority use of this vernacular in general. People (like myself, and I believe the original poster) take issue with the use of …

Your definition of 'hustler' is both valley-centric as well as seemingly predicated on a wink and a nod denial of the sleazy origins of the term. http://www.google.com/search?sourc…