Tasty » Adam Sampson's security bookmarks

How We Learned to Cheat at Online Poker: A Study in Software Security

Why you want to use a good RNG and a proper shuffle algorithm.

to ag0803 games random security shuffle ... on 07 June 2015

Not A Number - Painless IPSec setup for a home network.

A script to automate ipsec with static keys. Neat -- it takes surprisingly little code.

to crypto ipsec network security ... on 23 March 2015

Security/Projects/Bandit - OpenStack

A security scanner for Python code.

to python security static-analysis ... on 23 March 2015

Secure Secure Shell

Some recommendations for modern SSH configuration. (Note that we've had another major rev of SSH since this was written...)

to openssh security ssh ... on 22 March 2015

Mirage OS

"Mirage OS is a library operating system that constructs unikernels for secure, high-performance network applications across a variety of cloud computing and mobile platforms." In OCaml. They've done some nice work around their safe TLS implementation.

to ocaml os security tls ... on 22 March 2015

The IX Multilevel-Secure UNIX System

"A collection of papers about the IX system, a simple but comprehensive multilevel-secure operating system with mandatory access control, based on the research v10 UNIX system."

to access-control mac os security unix ... on 22 March 2015

Karl Lunt's Home Page (revised)

Various little microcontroller projects, including a neat device to set or clear the lock bit on an SD card, and some Tandy Model 100 stuff.

to avr electronics microcontroller mmc retrocomputing sd security tandy ... on 17 March 2015

Kryptos Logic Research: OpenSSL's squaring bug, and opportunistic formal verification

Detecting an OpenSSL bug (after the fact) using formal verification. Interesting because the original formal proof was wrong...

to formal-methods openssl security ssl ... on 16 March 2015

David A. Wheeler's Personal Home Page

Includes several well-written, comprehensive postmortems on noteworthy security bugs (e.g. Heartbleed) -- probably of interest to security students.

to bugs security software ssl ... on 05 March 2015

Update on jQuery.com Compromises | Official jQuery Blog

"Today at 11:15AM EDT, the jQuery Infrastructure team received widespread reports and confirmed a compromise of jquery.com." Using upstream's URLs for your Javascript libraries is only a good idea if you trust that site to never, ever be compromised or MITMd... (and even then I don't think it's a good idea.)

to javascript jquery security ... on 18 January 2015