All blog posts

  • Development

Loud subshells

  • icon Jun 21, 2018
  • icon 6 minutes read
  • icon 1103
Default shells usually end in $. Unless you’re root and it’s #. That tradition has been around forever: people recognized the need to highlight you’re not just some random shmoe. These days we have lots of snazzy shell magic. You might still su, but …
Read more
  • Architecture

A Child’s Garden of Inter-Service Authentication Schemes

  • icon Jun 12, 2018
  • icon 17 minutes read
  • icon 3515
Modern applications tend to be composed from relationships between smaller applications. Secure modern applications thus need a way to express and enforce security policies that span multiple services. This is the “server-to-server” (S2S) …
Read more
  • Infrastructure security

Gripes with Google Groups

  • icon May 29, 2018
  • icon 4 minutes read
  • icon 820
If you’re like me, you think of Google Groups as the Usenet client turned mailing list manager. If you’re a GCP (Google Cloud Platform) user or maybe one of a handful of SAML (Security Assertion Markup Language) users you probably know …
Read more
  • Cryptography

There will be WireGuard

  • icon May 16, 2018
  • icon 2 minutes read
  • icon 412
Amidst the hubbub of the Efail PGP/SMIME debacle yesterday, the WireGuard project made a pretty momentous announcement: a MacOS command line version of the WireGuard VPN is now available for testing, and should stabilize in the coming few months. I’m …
Read more
  • Sales enablement

Dumb security questionnaires

  • icon May 04, 2018
  • icon 4 minutes read
  • icon 757
It’s weird to say this but a significant part of the value we provide clients is filling out Dumb Security Questionnaires (hereafter DSQs, since the only thing more irritating than a questionnaire is spelling “questionnaire”). Daniel Meiessler …
Read more
  • Cryptography
  • Development

Cryptographic right answers

  • icon Apr 03, 2018
  • icon 12 minutes read
  • icon 2453
We’re less interested in empowering developers and a lot more pessimistic about the prospects of getting this stuff right. There are, in the literature and in the most sophisticated modern systems, “better” answers for many of these items. If you’re …
Read more