John Cox

Blogs · @wyome · Now · Shelf

Tagged security · everything

Interesting

Queness

17 Useful Htaccess Tricks and Tips

This article presents 17 practical .htaccess techniques divided into general optimization methods and security hardening measures. The general section covers tasks like setting timezone, implementing SEO-friendly redirects, file compression, and caching strategies, while the security section focuses on preventing malicious attacks through hotlink protection, blocking suspicious URL patterns, restricting access to sensitive files, and filtering unwanted bots and referrers. The author claims to have tested these methods and presents them as both essential security protections and efficiency improvements for web server management.

Permalink performancesecuritydevelopmenttutorial

perishablepress.com

2010 User-Agent Blacklist • Perishable Press

The 2010 User-Agent Blacklist is a set of .htaccess rules that blocks hundreds of malicious bots while allowing legitimate search engines through, improving site performance and SEO by preventing bad bots from consuming server resources and bandwidth. The blacklist identifies problematic user-agents through careful server-log analysis and prevents them from accessing your site, which is especially important during search engine crawls when poor performance could harm rankings. However, the author emphasizes this requires active monitoring and isn't a set-and-forget solution, as false positives are possible and the list needs regular updating to remain effective.

Permalink performancesecurityseotutorial

www.serverdensity.com

Easy server monitoring with e-mail, SMS, iPhone alerts - Server Density

Zarpra is a managed IT services company that takes over application support and infrastructure management for organizations with neglected or undocumented tech stacks, providing documentation, stabilization, and ongoing support rather than piecemeal fixes. The company emphasizes establishing clear ownership and responsibility for systems, managing access controls and user administration, and handling daily IT operations without downtime—positioning itself as the missing "foreman" for companies whose technical infrastructure has grown chaotic through lack of coordination.

Permalink securitybusinesstools

code.google.com

A List Apart

A List Apart: Articles: The Problem with Passwords

Jakob Nielsen proposes revealing passwords in clear text as users type them to reduce frustration and errors, but this creates tension between security, usability, and user expectations. The article presents two JavaScript-based middle-ground solutions: a toggle checkbox that lets users voluntarily switch between masked and unmasked views, and a progressive masking technique that displays only the most recently typed character in clear text for two seconds before masking it. Both approaches aim to improve usability and reduce typing errors without undermining the security perception that makes password fields feel like a trusted "black box."

Permalink securityusability

Jason Kolb dot Com

Sarbanes-Oxley IT Security Compliance Checklist from JasonKolb.com - The life of a technology entrepreneur.

Kolb provides a practical security checklist for Web 2.0 applications organized into front-end, back-end, and network layers, designed to help companies meet Sarbanes-Oxley compliance requirements without expensive consultants. The guide covers protecting sensitive user information through encryption, password policies, and secure authentication methods; preventing common attacks like SQL injection and man-in-the-middle exploitation; and restricting database access and logging security violations. While not exhaustive, the checklist aims to serve as a starting point for entrepreneurs building secure web applications and a cost-saving reference for companies navigating SOX audit requirements.

Permalink securitybusiness

SANS Institute

Asterisk

Asterisk :: The Open Source Telephony Platform |

This is the Asterisk project's landing page rather than an article with a single argument: it promotes the open source communications framework and its 2027 AstriCon call for speakers (Pasadena, April 1–2, alongside SCALE), then lists three security advisories dated June 25, 2026. The advisories cover a privilege-escalation and remote code execution flaw in ast_loggrabber via a world-writable /tmp path, an unauthenticated LDAP filter injection in res_config_ldap triggered by a SIP username, and SQL injection in the cel_pgsql and cel_tds modules through the CELGenUserEvent eventtype field. Saved for the advisories, the page is most useful as a record of those three vulnerabilities and their GHSA identifiers.

Permalink communicationsecurityinternetopensource

OpenDNS

OpenDNS | Providing A Safer And Faster DNS

OpenDNS is a DNS service that improves home internet speed through optimized routing and data centers, while providing content filtering and parental controls to protect against malware, phishing, and inappropriate content across all household devices. The service emphasizes ease of setup and reliability as core features for consumer users.

Permalink privacysecuritysmart homewindows

www.crossloop.com

CrossLoop - Secure Screen Sharing

This is a marketing page for Avast One antivirus software, not a saved article or reportage. It promotes the free antivirus app and its features—including AI-powered scam protection, device optimization, and dark web monitoring—while listing industry awards from AV-Comparatives, AVLab, and other testing organizations. The page contains product descriptions, award citations, and a download prompt rather than analytical or informational content.

Permalink aiprivacysoftwaresecurity

HowtoForge

Mirror Your Web Site With rsync

This tutorial explains how to set up automated file mirroring from a main web server to a backup server using rsync over SSH, with password-less authentication via SSH keys so the sync can run unattended via cron. The setup tunnels rsync through SSH (securing the connection and avoiding firewall configuration), uses public key authentication to eliminate password prompts, and restricts the backup server's SSH access to only execute rsync commands through a validation script on the main server.

Permalink securityautomationtutorialinternet

www.buzzsurf.com

the Guardian

tracking my girlfriend via her cell phone

This article demonstrates how easily anyone with brief physical access to a mobile phone can install location-tracking software that works invisibly—the phone shows no alerts or traces of the tracking, yet the tracker can pinpoint the device's location within 150 yards and monitor movements continuously. The author, a journalist, installed such tracking on his girlfriend's phone (with her permission "in principle") by simply registering her phone on a commercial GSM tracking website, paying £5, and deleting the warning text messages that appeared on her phone. The piece serves as a warning that mobile phone companies could monetize location data through these services, and anyone—not just authorities—might already be secretly tracking you if they've had five minutes alone with your phone.

Permalink technologyprivacysecurityinternet

OpenID Foundation - Helping people assert their identity wherever they choose

news.com.com

shiflett.org

Chris Shiflett: Security Corner: Cross-Site Request Forgeries

This foundational 2004 article introduces cross-site request forgeries (CSRF) as a web security vulnerability where attackers exploit a website's trust in an authenticated user to perform unauthorized actions on their behalf, contrasting it with XSS which exploits a user's trust in a website. The piece explains how CSRF attacks work through simple mechanisms like image tags that trigger unintended requests, and establishes the CSRF token—a unique per-session identifier embedded in forms and verified server-side—as the standard defense that prevents attackers from forging valid requests. The article demonstrates implementation with PHP code examples and notes that while this defense was manual in 2004, modern frameworks now build CSRF protection into their core functionality.

Permalink securitytutorial