David Albone - possiblyNothing()

Talisman

Talisman [https://thoughtworks.github.io/talisman/] is an open-source tool written in Go [https://golang.org/] by the technology consultancy ThoughtWorks [https://www.thoughtworks.com] (home of the well-known Martin Fowler [https://martinfowler.com/]). It's essentially a tool that can hook into the git [https://git-scm.com/] version control system

How integers are stored in python

When looking at a hex representation of an integer in python, the following appears: >>> hex(7651) '0x1de3' How does this storage system work? 1. Convert the integer into its binary representation: 7651 = 0x1110111100011 2. Split the binary into 4-bit blocks: 1 1101 1110 0011 3. Convert each of these 4-bit

Google Cloud Architecture - Secure Service Deployment

Notes from https://cloud.google.com/security/security-design/resources/google_infrastructure_whitepaper_fa.pdf . "Service" = An application binary that a developer wants to deploy to the infrastructure. * Services are controlled by a cluster orchestration service called "Borg". * Infrastructure does not assume trust between any services. Service identity, integrity and isolation

ZAP - automated testing notes

Notes from Simon Bennetts' talk [https://www.youtube.com/watch?v=3vVnMh6AUkk] and slides [http://www.slideshare.net/psiinon/automating-owasp-zap-devcseccon-talk]. Starting a headless scan in ZAP docker pull owasp/zap2docker-weekly docker run -t owasp/zap2docker-weekly zap-baseline.py -t http://xxx.xxx.xxx.xxx Using the ZAP API From a browser

Basic sqlmap

sqlmap website [http://sqlmap.org/] Running sqlmap against GET parameters Finding injection points and the database type > sqlmap -u "target_url" -b e.g. > sqlmap -u "http://test.com/index.php?user=abcd" -b -b = Retrieve DBMS banner: tries to get infomation about the underlying database. Returns a list of

Web Application Hacker's Handbook - Securing Session Management

Generate strong tokens Objective: > It should be extremely unlikely that an attacker with large amounts of bandwidth and processing resources should be able to guess a single valid token within the lifetime of its validity. * Tokens should use a large set of possible values * Should contain a strong source of

2016-03-18 Weekly security stories

General Ransomware being distributed on major websites via malvertising [http://arstechnica.co.uk/security/2016/03/big-name-sites-hit-by-rash-of-malicious-ads-spreading-crypto-ransomware/] Boards of UK businesses aren’t dealing with cybersecurity properly [http://www.infosecurity-magazine.com/news/uk-boards-fail-to-handle-cyberrisk/] 13m people in America were affected by identity theft last year [https://www.finextra.com/blogposting/12362/

admin

We're now secure!

I've now set this blog up to auto-redirect to the HTTPS version and fixed all the issues that were causing Firefox to block the mixed content. Well, that was easy.

knockoutjs

KnockoutJS - observing checkboxes

I've recently been having some trouble understanding how to make checkboxes update within KnockoutJS [https://knockoutjs.com/]. I was trying to make a list dynamically update on the screen based on a tickbox...here's an example of what I was trying to do: Before clicking the invisible book "visible" checkbox:

admin

Some more work on the theme

I've improved the theme a little bit: * The fonts didn't work terribly well together, so I've changed them. * I've improved the layout of some elements so that the sidebars don't crash into the main text and the text doesn't stretch further than the menu when viewed at >1024px. The code

admin

A bit of a spruce-up

After a few years of my site being sat in limbo, I've decded to give it a bit of a spruce-up. As part of this I've moved the blog to the Ghost platform [http://ghost.org] and created a new minimalist, responsive theme. There are still a few things that

photography

Photography - Raspberry Pi

Taken using Nikon D50 at F/5 with a shutter speed of 15s. A torch was used to paint the light on the Raspberry Pi.

projects

Quarter to Seven - a simple RSS reader

I've just completed my second webapp and this one is a little more adventurous than the password generator. It's a simple, easy-to-use RSS reader that allows you to add new feeds, delete old feeds and define the feed that is loaded by default. All your feeds and preferences are held

webfaction

Webfaction customer service

I stupidly managed to lock myself out of my webfaction [http://www.webfaction.com] SSH account yesterday. It took two minutes from raising a support ticket to having it unlocked. That's great customer service!

projects

Password generator

I've just completed my first web project using a combination of python, Flask and jQuery. It's a simple password generator that supports three different methods of password generation. You can find it here [http://passgen.dpauk.webfactional.com/].

Flask

Flaskr: Tutorial with extra comments

Flaskr {% if not session.logged_in %} log in [{{ url_for('login') }}]{% else %} log out [{{ url_for('logout') }}]{% endif %} {% for message in get_flashed_messages() %} {{ message }}{% endfor %} {% block body %}{% endblock %}

python

Python: "with" statement

with EXPRESSION [as VARIABLE]: BLOCK OF CODE The with statement always calls two methods on the EXPRESSION, regardless of what happens inside the BLOCK OF CODE: 1. __enter__() method - before method is run 2. __exit__() method - after method is run This is useful when you want to ensure

python

Decorators

To request database connections, flaskr uses decorators. For example: @app.before_request def before_request(): g.db = connect_db() From http://stackoverflow.com/questions/739654/understanding-python-decorators: Functions are objects in python and can be assigned to a variable.Functions can be embedded inside other functions, but the inner function is

iPad

iPad test

This is a test post from the Wordpress app on the iPad.

Flask

Feeling 'appy...

Just a placeholder... http://f.souza.cc/2010/08/flying-with-flask-on-google-app-engine/

SixWebAppQuestions

Templating: the first attempt at an answer

Back in the first post, I posed a question to myself: > There's something called templating. My IDE (PyCharm) seems to support this. No idea what it's for. Perhaps it'll be important. After having a play with templating, it appears that it's used for creating a template for a webpage that

CherryPy

Bye bye CherryPy

Well, after struggling and failing to work out how to get static content to load in CherryPy, I gave up with it. Basically, I couldn't get on with the lack of advanced tutorials. After a search for other python web frameworks, I found Flask [http://flask.pocoo.org/]. The documentation

CherryPy

CherryPy: Hello world...with numbers

Hello world! " number = 1 stringToDisplay += "The number is {0} ".format(number) number = 14 stringToDisplay += "The number is {0} ".format(number) stringToDisplay += "

SixWebAppQuestions

LittleNotes: Day 1

I've decided to try and build a web app. To do this, I've chosen a combination of python (because I already know it) and cherryPy (as it seems the simplest framework available). This is mostly new as the things I don't know far outweigh the things I do know: 1.