Thinking before you speak
The recent release of diplomatic cables by WikiLeaks has caused many to stop and think – which is always a good thing in my opinion. Of the many comments I’ve seen on this subject, one by Jeff Atwood seems to be the most relevant: WikiLeaks is preaching a message I've always practiced: there should be no difference between internal and external communication — Jeff Atwood (@codinghorror) November 30, 2010 Be it for a personal vendetta, political reasons, or perhaps just the love of chaos; there is always somebody that would love to take your secrets & thoughtless words and expose them to the world.
Read more…Christopher Adam Caudill – 6lbs, 7oz – Born 8/2/2010
On Monday, August 2nd 2010 at 11:16 PM, Christopher Adam Caudill was born. Weighing in at 6 pounds and 7 ounces and 19.25 inches, born just 24 minutes after our arrival at the hospital. He was born almost a month early, and was initially diagnosed with pneumonia, in addition to having issues maintaining his body temperature (as is common with babies born early). Thankfully, the next day the pneumonia diagnosis was withdrawn and his body temperature stabilized.
Read more…State of the (virus) art…
Imagine my surprise when one of my developers mentions he has a virus and I see this on his screen: No, the items listed aren’t the issue, it’s Security Tool that’s the virus. It’s vicious, plain and simple. It prevents almost all software from running (either by presenting a “virus warning” or simply killing the process), presents fake BSODs, and who knows what else that we didn’t notice. Only Explorer and Internet Explorer were operational, all other software was disabled.
Read more…Am I doing too much?
(Disclaimer: This is something of a rant, and was written at 3AM. My apologies if it doesn’t make sense. Feel free to ignore.) It’s 3AM, and I’m up reading, again. Is it the latest great novel or one of the classics that I enjoy so much? No, it’s research for my latest hobby. It’s lasers this time, but this pattern is far from new. I’m starting to think I just try to do too much, I go in too many different directions.
Read more…on Hiring
The company I work for is hiring several developers which marks my first significant hiring effort since being promoted to management. This had led to a few interesting observations* I would like to share that may benefit both those looking for a new job and those looking for the next star to add to their team. Immigration Law: I had no idea how complex this area of law gets; it’s a maddening maze of rules and policies that are more effective at confusing those involved than providing a reasonable solution to a problem.
Read more…Upgrading Windows 7 Pro VL
While performing some testing on a Windows 7 Professional workstation running a VL build from MSDN I found that a feature I needed was missing – the new Multi-Monitor RDP support. After a little research I found that only the Ultimate and Enterprise editions support this feature; which thanks to Windows 7’s Anytime Upgrade feature I assumed this would be no issue. But, it was an issue. It turns out that the build of Windows 7 I was using was missing WindowsAnytimeUpgradeUI.
Read more…Android & Windows 7 64bit
Setting up the Android SDK on Windows 7 64bit, with a 64bit JDK / JRE is a bit less straightforward than one would expect, thankfully though the solution is quite simple. There are two settings that need to be adjusted to make this work – otherwise you’ll get an error indicating that Java can’t be found. Step 1: Modify your PATH to include the bin folder of the JRE. Mine looks like this:
Read more…Secure Password Storage
Do you use MD5 or SHA1 to store passwords? Think they are secure? Think again. While generic hashing algorithms are certainly better than storing passwords in plain text, it’s still not as secure as it should be. Users place great trust in us to ensure that their credentials will be secure and treated with the utmost respect; it’s our responsibility to live up to these expectations. With the simplicity and speed of these general purpose algorithms, it’s possible to generate hashes looking for collisions (or even the original value) extremely quickly.
Read more…What’s your Code Legacy?
When you move on to your next challenge how will those that inherit your code think of you? Noble or notorious, innovator or insane? This is a question that all developers should ask themselves frequently; though too few ever do. You should always write with the assumption that someday a new developer will take over your code, and they will question every decision and assumption you’ve made. When this happens, what will they think of you?
Read more…bbPress: Is the end near?
I’ve been a fan of bbPress for quite some time; I’ve even contributed code to the project. For those that aren’t familiar with it, bbPress is an open-source forum system written in PHP. It’s fast, lightweight, easy to install and even easier to use. It also scales, quite well. bbPress was originally written to power the support forums WordPress.org, which get quite a bit of traffic. Later, it was released as a separate project.
Read more…
About Me
Security researcher, engineer and software developer with more than 20 years of experience.
Work: I primarily focus on application security, usable security, secure communications, and cryptography. I build and lead strong and dynamic teams, who cover all facets of security and privacy.
Writing: I write about my research, security in general, development and software design, and leadership through my blog, essays, and various publications. I also engage in some creating writing when I can.
Photography: I am a purist fine art photographer, working primarily in black & white, and focused on sharing new perspectives of the world. Limited edition prints of my work are available on my online gallery. I also have a background in photojournalism, and volunteer in this field when I can.