geal

It's nice to see they support Python now :)

It is already really nice for Scala apps.

Well, that article was for french people at the beginning, and cool kids don't look for work on job boards, because they are occupied by some horrible consulting companies (that is VERY specific to France).

But it still applies in the rest of the world. You don't want to appear in a list with 100 other companies. The good idea is to reach developers beforehand, meet them, and then use these connections to recruit them or ask for referrals.

Again, applying the basic ideas of marketing to recruiting :)

Totally true. People will never reach the decision making circle until they learn about the money side. And often, they will not have this opportunity until they quit employment to go freelance, or launch their own company.

And here is the fun part: learning about marketing, business models, commercial relations is not that hard for programmers. It just requires a different mindset. For problem solvers like the average geek, that's just another system to hack.

I have only begun recently on this path, but I find it exhilarating! Making my own decisions, talking directly with the clients and -oh, surprise- getting paid for my work, not for sitting at a desk... This is what developers should do!

Yes, I am sorry if that seemed misleading to you. I didn't want to get into too much details for a small post like that. I will write more on the subject later, with more data to help my points.

SSL Labs is a great tool that I use regularly, it is very helpful :)

Yes, that will come in a future article :)

Most of the CSS, JS and pictures don't contain private data, and should be cached.

You're right, I forgot the honor cipher directive.

According to http://www.carbonwind.net/blog/post/A-quick-look-over-some-b... RC4+RSA is supported nearly everywhere, but it was not tested on mobile browsers.

As part of my researches on SSL tuning, I'll do a benchmark of all browsers, for cipher suites and TLS versions support.

You're right, it looks like this was changed in Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=531801

EDIT: it is done, I added the nginx configuration to the article

Just wait a bit, I'm updating the post for that :)

Not necessarily. The screenshot indicates the bytes pointed by the IP, so it would still be possible to find them a binary you just built, and debug it from there.

You're assuming that you can write what you want and get away with it, now and in the future.

But Histoy has shown that anyone can be in danger because of something they wrote long ago.

The easy rule of thumb: if you have opinions and want to post them online, be prepared to lose friends, miss job opportunities and go to prison for them, even if they're not illegal or controversial right now.

That attack is far from trivial. There were other attacks against EMV in the past, but they're fixed as they come. Magnetic stripes stay vulnerable, and ATMs in the US are not that secure either (seriously, some of them can be stolen and taken home by one man alone). Securing chips is hard, but a lot of the process has already been figured out. What you should fear is the new RFID cards coming up soon. Those are even more vulnerable than magnetic stripes.

This looks nice, but it has a few problems:

-first, relying on DNS for certificate distribution might not be a good idea. It adds complexity, would not be secure without stuff like DNSSEC, and places too much responsibility on DNS.

-second, you could have gained a lot of CPU time in 1995 when static pages were the norm, but right now, for apps using AJAX heavily, you will not gain much.

-third, it does not prevent MITM. I can mount a server between you and the website, and keep serving you outdated content with its valid signature. Or serve you prepared content that I received earlier.

-last but not least, TLS certificates are cheaper and cheaper these days (not necessarily a good thing, though), and encryption doesn't cost much anymore.

Apart from that, I agree that would have been a cool idea :)

No need for a mailing list: I was able to reach you directly on Twitter for a bug report and patch :)

Courses are a good way to get started, because they will introduce you to the topic, and give you the vocabulary (that you will use to search afterwards). Learning to program, as in "from scratch", not "learn another language once I know what if and for are, is really hard to do with only a search engine, and will take a lot of time. The fastest way I know to start programming is mentoring: a good mentor can give you directly the meat of the subject, point out your mistakes and tell you how to correct them.

it shouldn't be a feature, but a prerequisite. But that's a hopeful dream... Defining for whom it is easy to use looks more like a feature

And it was developed during a startup weekend! Kudos to camilleroux!

Very useful and easy to use. It can uncover really weird bugs in your parsing code, the kind you don't believe is possible :)

Unpaid internships are common in the career beginning: companies won't employ you if you have no prior experience (they always look for 3 to 5 years of experience). That's very annoying to study 5 to 8 years and being told that you're not qualified. And about going abroad: speaking 5 languages can help, but I doubt that an italian law degree will give a job.

well, this guid says that you must sanitize user input, but at input time, you may not know where it will come out. So, the solution proposed by this guide is to escape the output. It is another layer of defense: you don't know if you have properly verified the input, but everything you will send to the output will be clean.

XSS isn't only about SCRIPT tags. What about javascript URIs, IMG and IFRAME tags, flash elements that you can add in a page by XSS? Filtering what is shown to the user is still the best solution IMHO.

It's a vulnerability exploitation framework. It is used by security experts for vulnerability development and penetration testing.

I agree, Mac OS did it right. But I'm not a fan of packaging two different architectures in one installer. It makes the package bloated (which is also a problem with Windows installers).

Well, in the article, I especially told to forget about making money with toolbars. But I'm not confident one can easily teach this kind of good manners to developers...