security

A user reported a bug in Slava, a bot that syncs Strava activities to Slack, where they couldn’t subscribe to the paid version because their Slack team name contained a quote. T...

The OpenSearch API specification is authored in OpenAPI and used to auto-generate OpenSearch language clients. I wanted to know how much of the API was described in it vs. the a...

OpenSearch ships with a pretty comprehensive doc on getting started, along with a comprehensive reference to its vast security configuration. This can be a bit overwhelming. Her...

Amazon OpenSearch and Amazon OpenSearch Serverless use AWS SigV4 for authentication. We’ve made it dead easy to make authenticated requests across all OpenSearch clients in open...

Last week I joined the OpenSearch Team at AWS, a community-driven, open source fork of Elasticsearch and Kibana (read more about it here).

Strava has recently announced changes to the Strava OAuth flow. On October 15, 2019 all applications using the old flow will stop working.

Last week I wrote a tool to find a Github user’s e-mail address from their commits. One of the annoyances of the original implementation was the need to manually generate a pers...

The future of communication is signed and sources are trusted. You can find me at keybase.io/dblock.

Nice job from @gschrader.

You should take a serious look at your application and write some tests, first thing Monday.

Waffle is a native C# and Java library that does everything Windows authentication (Negotiate, NTLM and Kerberos), on Windows - https://github.com/dblock/waffle/.

Devise has a :trackable _strategy which updates the user’s last sign-in time, remote IP and increments a counter in the _User model upon successful logon. This is implemented in...

I’ve released DNI 2.0 today. It’s a major release with a new HTML bootstrapper, better elevation support, Windows 8, etc. It has been stable for quite a while now and a few peop...

Sorting tables in Rails is a common problem. It must have been done before, right? In fact it has been done so many times that it’s really hard to find anything that “just works...

I just came back from Mongo Boston and I am really excited for 10gen. Once again I met actual human beings that were really happy about using a database and wanted to share that...

Now that we have dealt with exceptions in our API we need to provide various methods of authentication. We’re going to be talking grape and devise.

A Waffle user is asking how to get the groups for a currently logged-in user. You don’t need Waffle to do this, just JNA. The 3.2.7 release has an Advapi32Util class that implem...

Following a much pleasing trend of developers contributing major functionality to my open-source projects, @nsleightholm (Neil Sleightholm who works for a company called X2Syste...

A user has recently tried to integrate Tomcat’s manager application with Waffle and got puzzling results. It took me a while to figure it out, revealing some creative thinking i...

I recently wrote an article for TeamSHATTER.com that is a shameless plug for WAFFLE, aka a short introduction to implementing Windows single-sign-on in Java. It takes an interes...

I struggled with this one. Here’s how to get JNA and Waffle to work under a Java security manager. In my case I have a Tomcat 5.5 which is launched with -security. Here’s the co...

TeamSHATTER.com went live yesterday. SHATTER is the AppSecInc team that researches database security vulnerabilities and publishes advisories that have been trusted by the indus...

This is a pretty common problem with NTEventLogAppender (both log4j and log4jna versions) on Windows Vista, 7 or 2008.

One of our servers was upgraded to VMWare ESXi 4.1.0 and automation that uses RemoteInstall (and VMWareTasks) broke. The first part was easy, we needed to download and install t...

Jamais deux sans trois.

Prologue

I’ve been working on porting WAFFLE to Java/ JNA. As usual I have modest and practical goals with that project: to provide a working example for everything InitializeSecurityCon...

Lately I’ve been working on a native Java implementation of Waffle and contributing an increasing amount of code to the java.net JNA project. Waffle has several goals that provi...

In the past years at Application Security Inc. I’ve learned a lot about selling software to the US governement, including very secretive organizations such as the CIA, DOJ, IRS,...

I rarely blog about my real job. But this is way cool if you’re a nerd in the database security and vulnerability assessment field - you know, the software that helps protect yo...

I’ve posted a long overdue article describing an ACL-based authorization model with NHibernate 2.0. This is the next level of evolution from ACL-based implementations that I’ve ...

I posted a CodeProject article entitled “Rotating Passwords in Active Directory”, or how to “change” your password to the same one when those annoying IT guys force you to. It’s...