VirtualTam's bookmarks

1. h2c Smuggling: Request Smuggling Via HTTP/2 Cleartext (h2c) 2024-11-04

   tags: network/http, network/reverse-proxy, programming/go, security, websocket

   [ permalink ]

   • BishopFox/h2csmuggler
2. SSHFP - Secure SHell FingerPrint DNS Records 2024-10-27

   tags: cryptography/elliptic-curve, network/dns, network/dnssec, network/ssh

   [ permalink ]

   • IANA - DNS SSHFP Resource Record Parameters
   • ssh - How do I generate SSHFP records?
   • Oh SSH-it, What’s My Fingerprint? A Large-Scale Analysis of SSH Host Key Fingerprint Verification Records in the DNS
     • gehaxelt/sshfp-dns-measurement
     • APNIC - Improving SSH’s security with SSHFP DNS records

   RFCs:

   • RFC 4251 - The Secure Shell (SSH) Protocol Architecture
   • RFC 4255 - Using DNS to Securely Publish Secure Shell (SSH) Key Fingerprints
3. smallstep/certificates - A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management 2024-05-27

   tags: cryptography/certificate, cryptography/certificate-authority, network/http, network/http-server/traefik, network/reverse-proxy, network/transport-layer-security, programming/go

   [ permalink ]

   • Run a private online TLS certificate authority in a Docker container
   • Configure popular ACME clients to use a private CA with the ACME protocol
   • Run your own private CA & ACME server using step-ca
   • Build a Tiny Certificate Authority For Your Homelab
4. PostgreSQL Anonymizer 2024-05-23

   tags: database/postgresql, privacy/gdpr, programming/rust, security/anonymization

   [ permalink ]

   • dalibo/postgresql_anonymizer
   • Introducing PostgreSQL Anonymizer
   • 8 Anonymization Strategies with PostgreSQL
   • Data anonymization with Postgres
5. gittuf - A security layer for Git, with key management and permissions for branches and tags 2024-05-13

   tags: automotive, embedded, security, source-code-management/git, trust

   [ permalink ]

   • gittuf/gittuf
   • ossf/wg-supply-chain-integrity
   • OpenSSF - Introducing gittuf: A Security Layer for Git Repositories
   • LWN - Securing Git repositories with gittuf
   • TUF - The Update Framework
   • Uptane - A Secure Software Update Framework for Automobiles
6. stalwartlabs/mail-server - Secure & Modern All-in-One Mail Server (IMAP, JMAP, SMTP) 2024-04-26

   tags: email, email/dkim, email/spf, network/imap, network/jmap, network/smtp, programming/rust

   [ permalink ]

   • Stalwart Mail Server
   • NLNet Foundation - Stalwart Mail Server
   • /r/selfhosted - Announcement: All-in-one JMAP, IMAP and SMTP server
   • /r/selfhosted - Announcement: Open source JMAP / IMAP server written in Rust
7. The Copenhagen Book - General guidelines on implementing authentication and authorization in web applications 2024-04-05

   tags: cryptography/hash, memory/cache, network/http, network/http/cookie, programming/go, security/authentication, security/authorization, security/oauth, security/password

   [ permalink ]

   • pilcrowOnPaper/copenhagen
8. OWASP CycloneDX - A full-stack Bill of Materials (BOM) standard 2024-04-02

   tags: programming/go, programming/python, programming/rust, security, software-engineering/bill-of-materials

   [ permalink ]

   • CycloneDX
   • CycloneDX/cyclonedx-gomod
   • CycloneDX/cyclonedx-python
   • cyclonedx-rust-cargo
9. facebookexperimental/kperf - TCP and TLS performance testing tool 2024-03-31

   tags: network/tcp, network/transport-layer-security, performance/benchmark, programming/c

   [ permalink ]
10. OpenGFW - A flexible, easy-to-use, open source implementation of GFW (Great Firewall of China) on Linux 2024-03-31

    tags: linux, network/firewall, network/ipv4, network/ipv6, programming/go, reverse-engineering, wireshark

    [ permalink ]

    • USENIX Security Symposium 2023 - How the Great Firewall of China Detects and Blocks Fully Encrypted Traffic
11. oss-security - backdoor in upstream xz/liblzma leading to ssh server compromise 2024-03-31

    tags: compression/lzma, compression/xz, linux, programming/c, programming/shell/bash, security, security/backdoor

    [ permalink ]

    • XZ Utils backdoor
    • xz/liblzma: Bash-stage Obfuscation Explained
    • /r/Linux - XZ Utils backdoor
    • Debian Bug report logs - #1068024 revert to version that does not contain changes by bad actor
    • FAQ on the xz-utils backdoor
    • LWN - A backdoor in xz
    • Everything I Know About the Xz Backdoor
12. Comprehensive Rust 🦀 - a free Rust course developed by the Android team at Google 2024-03-28

    tags: embedded, google, mobile/android, programming/rust

    [ permalink ]

    • Rust in Android
    • Rust in Chromium
    • Bare Metal Rust
    • Concurrency in Rust
    • google/comprehensive-rust
    • Scaling Rust Adoption Through Training
13. The Family of Safe Golang Libraries is Growing! 2024-03-25

    tags: compression, programming/go, security, text/formatting

    [ permalink ]

    • google/safetext
    • google/safeopen
    • google/safearchive
14. Standard Webhooks - Open source tools and guidelines to send webhooks easily, securely and reliably 2024-02-28

    tags: network/http, programming/json

    [ permalink ]

    • standard-webhooks/standard-webhooks
    • Specification
15. Have I Been Pwned - Pwned Passwords 2024-02-28

    tags: programming/go, programming/python, programming/ruby, programming/rust, security/credentials, security/password

    [ permalink ]

    • HaveIBeenPwned/PwnedPasswordsDownloader
    • API Clients:
      • mattevans/pwned-passwords - Go API Client
      • lionheart/pwnedpasswords - Python API Client
      • philnash/pwned - Ruby API Client
      • wisespace-io/pwned-rs - Rust API Client
16. AWS Access Key Format 2024-02-28

    tags: cloud/aws, programming/go, programming/python, security, security/credentials, security/token

    [ permalink ]

    • AWS Security Credentials Formats
    • A short note on AWS KEY ID
    • Research Uncovers AWS Account Numbers Hidden in Access Keys
    • TruffleHog Now Detects AWS Canaries without setting them off
17. SOC - System and Organization Controls 2024-02-17

    tags: code-review, infrastructure/automation, observability, security, security/audit, security/authentication, security/authorization, single-sign-on, source-code-management/git, source-code-management/github

    [ permalink ]

    • The SOC2 Starting Seven
    • SOC2: The Screenshots Will Continue Until Security Improves
18. Vulnerability Management for Go 2024-01-15

    tags: programming/go, security, static-analysis

    [ permalink ]

    • Go Vulnerability Database (Go Blog)
    • Go Vulnerability Database
    • govulncheck command
19. Sequoia-PGP - OpenPGP Implementation in Rust 2023-11-09

    tags: command-line, cryptography/encryption, cryptography/pgp, cryptography/pgp/gnupg, linux/debian, linux/fedora, programming/rust, security

    [ permalink ]

    • Talk about OpenPGP interop testing at the IETF 110
    • sequoia-pgp/sequoia - APIs for dealing with OpenPGP data
    • sequoia-pgp/sequoia-sq - the Sequoia-PGP command line tool
    • RpmSequoia
20. Rust Safety Dance - Auditing crates for unsafe code which can be safely replaced 2023-10-01

    tags: memory, programming/assembly, programming/rust, security/audit

    [ permalink ]