51–60 of 243 posts
I've once come across: if (!Boolean.FALSE.equals(aBoolean)) { // ... } I was pretty baffled.
case x is
when true => y;
when others => z;
end case;
Man. Reading posts like these has several effects on me. One is utter shock that anyone could be so stupid. Another is to remind me of how little I know (because I'm sure in the eyes of someone who actually knows anything about security, I'd probably provoke the same reaction). I'm also amazed that some of the people responsible for these things can still find work. Here's my own personal story. The other day, I had…
Not necessarily. They may be using a reversible hash. Not much more secure, but it beats plaintext.
1.) Prevent typos etc. Regex or Mailgun or Kicksend is enough. 2.) Prevent bounces, prevent wrong signups one needs to do double opt in.
Man. Reading posts like these has several effects on me. One is utter shock that anyone could be so stupid. Another is to remind me of how little I know (because I'm sure in the eyes of someone who actually knows anything about security, I'd probably provoke the same reaction). I'm also amazed that some of the people responsible for these things can still find work. Here's my own personal story. The other day, I had…
[1]: https://www.pcisecuritystandards.org/documents/pci_dss_v2.pd...
†Requirement 8 (part 4):
> Render all passwords unreadable during transmission and storage on all system components using strong cryptography.
‡Introduction and PCI Data Security Standard Overview:
> PCI DSS applies to all entities involved in payment card processing–including merchants, processors, acquirers, issuers, and service providers, as well as all other entities that store, process or transmit cardholder data.
(It appears this does not include cardholders.)
If not I may be compelled to create one.
In college I was hired to build an auction site. I was billing my client $20 / hour and subcontracting out the work to some of my fellow classmates at $10 / hour. I was swamped with other work and didn't have much time to review the code. I just made sure it satisfied the specifications and shipped it. We launched the site and did a few hundred thousands dollars worth of transactions in the first 24 hours. Then somet…
In college I was hired to build an auction site. I was billing my client $20 / hour and subcontracting out the work to some of my fellow classmates at $10 / hour. I was swamped with other work and didn't have much time to review the code. I just made sure it satisfied the specifications and shipped it. We launched the site and did a few hundred thousands dollars worth of transactions in the first 24 hours. Then somet…
How did GoogleBot get access to the (presumably) private admin panel to crawl the links in the first place? Also, these sort of things require server-side authentication, not just JS. Just because GoogleBot won't crawl your PUT requests doesn't mean others won't -- including users (malicious or otherwise)! Just sayin'.
if (!admin())
echo "window.location = '/signin';";
?>
I've once come across: if (!Boolean.FALSE.equals(aBoolean)) { // ... } I was pretty baffled.
if (aBoolean == true) {
....
}Earlier quoted context omitted.
How did GoogleBot get access to the (presumably) private admin panel to crawl the links in the first place? Also, these sort of things require server-side authentication, not just JS. Just because GoogleBot won't crawl your PUT requests doesn't mean others won't -- including users (malicious or otherwise)! Just sayin'.
If I recall correctly the code looked something like this: if (!admin()) echo " window.location = '/signin'; "; delete_bid($_GET['bid_id']); ?>
Somewhat unrelated, but out of curiosity, does anyone know of a site that lists — for all popular languages — various libraries/code snippets/routines which one can use to correctly (according to the RFCs) check the validity of e-mail addresses? If not I may be compelled to create one.