Dave Elkins

If you're new here, you may want to subscribe to my RSS feed. Thanks for visiting!

Here is an article about input parameters validation framework.  It is just a couple of functions but it works very well and is easy to use.

Enjoy.

P.S.  I will be writing something original soon…stay tuned.

The Ruby on Rails Security Blog has a post about a potential XSS issue with to_json.

Enjoy.

The Ruby on Rails Security blog has a good article about SQL Injection and Ruby on Rails.  Check out the SQL Injection article.

Enjoy.

It has taken a lot of hard work but I have finally finished the latest version of MyBooksmarts.com.  It is hard to believe one year and four versions.

Please check it out and let me know what you think.

http://mybooksmarts.com/

Thank you and enjoy.

Here is an interesting article by Bruce Schneier about the benefits and issues with penetration testing - “Is Penetration Testing Worth It?”.

I think it makes a lot of sense.  I have been researching what types security testing tools are out there and wondering what is the best way to test for security flaws.

Is it better to take outside approach where you look at the system from an attackers perspective?  Or is it better to look from the inside and use all the information available to identify areas where you may be venerable?

I would think the latter would be better because you have more information to work with.  I think it is better to restrict your attack surface, make a security plan and focus on the top venerabilities like Bruce Schneier suggests.

This is a really great post about the usefulness of Message Bus Architecture and, in particular, SQS.

http://aws.typepad.com/aws/2007/05/sqs_super_queue.html 

http://www.rorsecurity.info/2007/05/04/dom-injection-attacks/

http://www.rorsecurity.info/2007/05/04/defeating-input-filters-for-injection/

enjoy!