1
I Went to SQL Injection Court
Chicago argued that answering a FOIA request with a database query means creating a new record. Matt Chapman sued, I wound up on the stand explaining SQL, and now there's a bill to fix it.
Thomas Ptacek
Thomas and Erin Ptacek on software, security, cryptography, hiring, and the occasional cocktail.
- Popular posts
- 15
- Total points
- 5,286
- HN comments
- 3,322
- Rank
- #197 personal
Visit sockpuppet.org → RSS feedOn Hacker News Jul 2013 – Sep 2026
Security & Privacy 7Software Engineering 7Systems & Performance 3Tools & Productivity 2Society, Policy & Culture 2Life, Learning & Writing 2
2
Vulnerability research is cooked
Vulnerability discovery has always been gated by elite attention. Elite attention is now abundant. What happens next?
3
Against DNSSEC
10 years later and still unrebutted: DNSSEC is pageantry, it's not security, which is why so few security teams deploy it.
4
Is Extended Random a Malicious NSA Plot?
Dual_EC was almost certainly an NSA backdoor. Extended Random is the TLS extension that would have made it practical to exploit. Did NSA plant that one too? A look at the evidence.
5
Applied Cryptography Engineering
Applied Cryptography taught two generations of developers what they know about crypto, and it is a dreadful instruction manual. The book to replace it with, and what you still have to learn after.
6
You Don't Want XTS
XTS is the de-facto standard disk encryption mode, which makes it look like a good general-purpose one. It isn't. What disk encryption actually promises, and why XTS's guarantees don't travel.
7
How To Safely Generate A Random Number
Use urandom. That is the whole answer. Why the entropy-depletion story is a myth, and why userspace CSPRNGs are behind most of the last decade's randomness disasters.