Best of Security — March 2024

  1. 1
    Article
    Avatar of communityCommunity Picks·2y

    The Programming Language of the Future?

    Rust is a high-performance and statistically typed programming language that is adored by developers for its speed, security, and memory efficiency. It is a general-purpose language with the potential to influence the future development of websites. Despite its advantages, learning Rust and its ownership of values philosophy may take some time. However, it offers better performance and control over the code. Rust's sluggish compilation speed can be improved with existing guidelines. Reputable companies are already embracing Rust, and it is expected to be one of the most utilized and well-liked programming languages in 2023.

  2. 2
    Article
    Avatar of hnHacker News·2y

    Captchas don't have to be boring

    A fun and nostalgic Doom Captcha project has gained popularity and received positive feedback. It allows users to complete captchas by killing enemies in a game-like interface. The source code is available on GitHub for contribution and customization.

  3. 3
    Article
    Avatar of strongdmstrongdm·2y

    13 API Security Best Practices to Know in 2024

    Learn 13 API security best practices to protect your application and user data, including strong authentication mechanisms, least privilege access control, data encryption, rate limiting, and more.

  4. 4
    Article
    Avatar of bitBits and Pieces·2y

    10 Challenges In Implementing Microservices

    Implementing microservices can be challenging, but there are solutions to overcome the common challenges. Domain-Driven Design (DDD) and Event-Driven Architecture (EDA) can help manage complexity. Proper service discovery and communication mechanisms are important for large-scale applications. Data management and consistency can be addressed through strategies like CQRS and the Saga pattern. Deployment and DevOps automation can streamline the process. Monitoring and observability are essential for performance insights. Service resilience and fault tolerance can be achieved through circuit breakers and health checks. Security measures like authentication, secure communication, input validation, data encryption are crucial. Effective team organization and communication are necessary for collaboration. Versioning and compatibility can be managed using semantic versioning and API versioning. Scalability can be achieved through horizontal scaling and container orchestration.

  5. 5
    Article
    Avatar of hnHacker News·2y

    900 Sites, 125 million accounts, 1 vulnerability

    A misconfiguration in Firebase has led to hundreds of sites exposing around 125 million user records, including plaintext passwords and sensitive billing information.

  6. 6
    Article
    Avatar of bytebytegoByteByteGo·2y

    EP102: Encoding vs Encryption vs Tokenization

    This post discusses the differences between encoding, encryption, and tokenization, and how they are used in system design to handle sensitive information.

  7. 7
    Article
    Avatar of freecodecampfreeCodeCamp·2y

    How to Build a Custom API Gateway with Node.js

    Learn how to build a custom API gateway with Node.js. Understand the role and benefits of an API gateway in a microservices architecture. Explore security measures and features in API gateways. Build a basic API gateway with rate limiting and timeouts using the http-proxy-middleware package.

  8. 8
    Article
    Avatar of watercoolerWatercooler·2y

    Props to the dev who discovered the xz backdoor exploit

    The xz backdoor exploit has been discovered by a developer.

  9. 9
    Article
    Avatar of communityCommunity Picks·2y

    Wasn't Nginx Free?

    Maxim Dounin announces his departure from Nginx and the creation of a new fork called Freenginx due to interference with Nginx's security policy and corporate control. The post discusses the nuances of the situation and the open core model.

  10. 10
    Article
    Avatar of appwrite_sourceAppwrite·2y

    Rethinking password security: say goodbye to plaintext passwords

    Storing passwords in plaintext poses significant security risks and vulnerabilities. Alternatives to plaintext passwords include password hashing and passwordless authentication. Appwrite provides multiple authentication methods to combat plaintext passwords.

  11. 11
    Article
    Avatar of awegoAwesome Go·2y

    Preventing SQL Injection with Golang

    This post discusses the concept of SQL injection and how to prevent it in Go. It explains the vulnerabilities associated with SQL injection and demonstrates ways to fix them using prepared statements and parameterized queries.

  12. 12
    Article
    Avatar of communityCommunity Picks·2y

    Introduction to Cybersecurity

    Learn about cybersecurity and the importance of network security in protecting against cyber attacks. Discover common types of cyber attacks such as malware, phishing, and ransomware. Explore best practices in cybersecurity including identity management, mobile and endpoint security, and end-user and cloud security. Find out how to learn more about network security through online resources and professional certifications.

  13. 13
    Video
    Avatar of fireshipFireship·2y

    7 Tech Bros who went to Prison

    This post highlights the stories of seven tech bros who ended up in prison for various crimes such as fraud, insider trading, and hacking.

  14. 14
    Article
    Avatar of webtoolsweeklyWeb Tools Weekly·2y

    CSS/HTML Tools, Git/CLI, ChatGPT

    The post discusses the security concerns regarding the use of Element.innerHTML in JavaScript and suggests using the alternative Element.setHTML, although it is not currently supported by most modern browsers. It also provides a neat little script for creating a 'view source' button for web pages. Additionally, the post highlights various CSS and HTML tools, Git, GitHub, and CLI tools, and ChatGPT and AI tools.

  15. 15
    Article
    Avatar of cerbosCerbos·2y

    How to add authorization in a Node.js application

    Learn how to add authorization to a Node.js application using Cerbos. Create roles and permissions for different users and ensure secure access control. Integration with Cerbos provides greater security, scalability, easy compliance, and flexibility for your Node.js app.

  16. 16
    Article
    Avatar of hnHacker News·2y

    TracecatHQ/tracecat: 😼 The AI-native, open source alternative to Tines / Splunk SOAR.

    Tracecat is an open source automation platform for security teams, with features similar to Tines / Splunk SOAR. It offers enterprise-grade open source tools, open source AI infrastructure and GPT models, and a practitioner-obsessed UI/UX. Tracecat is cloud agnostic and can be deployed anywhere that supports Docker.

  17. 17
    Article
    Avatar of itnextITNEXT·2y

    All about CORS — Prequel to a Battle with Browser!

    Learn all about CORS, the security mechanism embedded in modern browsers. Understand how it works, its purpose, and how to deal with CORS-related issues. Find out strategies to bypass CORS restrictions and secure your web application.

  18. 18
    Article
    Avatar of medium_jsMedium·2y

    Hunting JavaScript File for Bug Hunters

    This post discusses the significance of JavaScript in web development, its uses in penetration testing, and methods for manually and automatically finding vulnerabilities in JavaScript files. It provides tips for manual checking of JavaScript code and introduces tools like Burp Suite, Mantra, Secret Finder, and JSFScan.sh for automating the extraction and scanning of JavaScript files.

  19. 19
    Article
    Avatar of rpythonReal Python·2y

    Python News: What's New From February 2024 – Real Python

    Python 3.12 and 3.11 received security fixes. SBOM documents were introduced for CPython to improve security vulnerability management. Astral unveiled uv, a new Rust-based tool for Python packaging. PyCon US 2024 schedule was announced. The PSF introduced Grants Program Office Hours.

  20. 20
    Article
    Avatar of strongdmstrongdm·2y

    13 Password Management Best Practices to Know in 2024

    Learn 13 password management best practices to protect your organization's systems and data from password-related attacks.

  21. 21
    Article
    Avatar of cerbosCerbos·2y

    The importance of stateless architecture in authorization systems

    Stateless architecture in authorization systems simplifies system deployment, maintenance, and integration. It offers benefits such as scalability, fault tolerance, and simplicity. By using stateless authorization, the application can fetch the necessary state upfront and present it as a token, eliminating the need for external dependencies. Implementing a basic stateless authorization system is straightforward, but best practices for token management, expiration, revocation, and encryption should be followed. Centralized authorization servers and established protocols like OAuth and SAML can enhance security and interoperability.

  22. 22
    Article
    Avatar of cloudflareCloudflare·2y

    Protecting APIs with JWT Validation

    Cloudflare customers can now protect their APIs from broken authentication attacks by validating incoming JSON Web Tokens (JWTs) with API Gateway's JWT Validation. The release addresses feature requests for supporting the Bearer token format, creating multiple JWKS configs, validating JWTs sent in cookies, and excluding managed endpoints in a JWT validation rule. Broken authentication is a major threat in API security, and JWT validation helps enforce a positive security model for authenticated API users. JWTs provide short-lived sessions and enhanced security compared to other authentication methods. API attacks like missing or broken authentication, expired token reuse, and Broken Function Level Authorization attacks can be prevented with proper authentication and authorization. API Gateway's JWT Validation checks JWT signatures, expiration times, and the presence of authentication tokens to protect against these attacks. Cloudflare Access and custom Cloudflare Workers are other options for JWT validation, but API Gateway provides an easier and more manageable experience. Future releases will expand the capabilities of API Gateway, including generating and enforcing authorization policies and enhancing API management with Cloudflare.

  23. 23
    Article
    Avatar of cerbosCerbos·2y

    From the ground up podcast: Reshaping the landscape of DevOps through innovative authorization solutions

    Cerbos is a company that empowers developers to implement and manage fine-grained access control in software applications. They provide a solution that simplifies the implementation of roles and permissions, allowing developers to focus on their core products. Cerbos aims to solve the problem of having to build complex authorization layers from scratch, saving developers time and effort.

  24. 24
    Article
    Avatar of medium_jsMedium·2y

    Announcing Docketeer 18.0: A Whale of An Improvement

    Docketeer 18.0 introduces enhanced image vulnerability scanning, data visualization graphs, rescan and historical comparison functionality, and an updated UI. Future plans include optimizing performance, improving UI styling, and refining Kubernetes metrics and configuration.

  25. 25
    Article
    Avatar of asayerasayer·2y

    Implementing Password Policies in React

    Learn about the key components of a password policy, how to implement password policies in React, and best practices for implementing password policies in React applications.

See all Security archives