Top all-time · #14401
Dadario's Blog
Personal blog · dadario.com.br · on HN as andersonmvdsecurityprogramming
Dadario's Blog is a personal blog at dadario.com.br about security and programming. Since 2014, 5 different Hacker News readers have linked it 51 times, most often “Docker for Automating Honeypots or Malware Sandboxes”. The last post was in 2024, but the archive is still widely read.
Too few sampled comments (3) to say how often HN recommends it.?
Why HN links it
HN commenters cite Dadario's posts on cryptographic versus non-cryptographic hash functions and on preventing Docker escaping attacks when answering security and hashing questions.
Summarised by Claude from a sample of 3 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- /2 people · 2 mentions · first linked 2017-04-11
- Docker for Automating Honeypots or Malware Sandboxes2 people · 2 mentions · first linked 2017-01-15
- Cryptographic and Non-Cryptographic Hash Functions2 people · 2 mentions · first linked 2017-02-28
- Preventing Docker Escaping Attacks2 people · 2 mentions · first linked 2017-01-23
What Hacker News says?
The problem with checklists, including this one, is that we tend to limit ourselves to what's in the list. Furthermore the list doesn't explain 'why' you should do things. They help, but nothing is a replacement for education. And when it comes to education, there's a decent write up I did and is still accessed in a daily basis [0]. I also recommend you to check OWASP [1] and read their "Testing Guide" to know many…
Comment linking /security-for-building-modern-web-apps/
on “A practical security guide for web developers”Submitted Docker for Automating Honeypots or Malware Sandboxes as a story · 4 points
HN discussionJust use stateful tokens because if you are dealing with sessions and you are doing it right, you WILL want to revoke them at the user's will or at some suspect activity in a session. I've wrote how to revoke a JWT ( https://dadario.com.br/revoking-json-web-tokens/ - caveat: requires a db lookup), but if you are going through the trouble of revoking a JWT, just use a stateful session instead. It's way easier. You ca…
Comment linking /revoking-json-web-tokens/
on “Ask HN: What's the current sentiment on JWT for stateless auth tokens?”Submitted Free Docker Security Fundamentals Course as a story · 4 points
HN discussionIn a nutshell with my comments: Benefits - Easier to (horizontally) scale: that's true. My previous company shut down a few servers thanks to JWT - If it has a vulnerability, just update to patch it ... instead of fixing your customized algorithm. It's way better, but you need to use the most popular / battle-tested / maintained library for your language and keep track of its CVEs as any another dependency. Drawback…
Comment linking /revoking-json-web-tokens/
on “API Security Checklist for developers”Submitted Sales 101 for Startups as a story · 4 points
HN discussionJust the links from comments: http://hndigest.com/ http://ambassadors.thehustle.co/ http://androidweekly.net/ http://ben-evans.com/newsletter http://delanceyplace.com/ http://eepurl.com/cE6e9H http://fair.org/ http://fermatslibrary.com/ http://flowingdata.com/ http://fortune.com/tag/term-sheet/ http://freshpatents.com http://frontendfocus.co/ http://growthhackingidea.com/ http://hackaday.com http://hackernewsbooks.c…
Comment linking /
on “Ask HN: Mailing lists that HN readers ought to know about?”Submitted Security for building modern web apps as a story · 4 points
HN discussionMy application security newsletter ( https://dadario.com.br )
Comment linking /
on “Ask HN: Mailing lists that HN readers ought to know about?”Submitted Is OWASP Top 10 No Longer Relevant? as a story · 3 points
HN discussionNot supported in most browsers as said in this thread, but there many other mitigation strategies that do work. Here's a complete writeup: https://dadario.com.br/what-is-csrf/
Comment linking /what-is-csrf/
on “Cross-Site Request Forgery is dead”Submitted Setting Up HTTPS Is Child Play Now as a story · 3 points
HN discussionIt's very delicate to talk about financial burden, given the following references: "Two months after damaging data breach, Target stock has its best day in 5 years" http://blogs.marketwatch.com/behindthestorefront/2014/02/26/... "Sad reality: It's cheaper to get hacked than build strong IT defenses" http://www.theregister.co.uk/2016/09/23/if_your_company_has_... "The Cost of Cyberattacks Is Less than You Might Think…
Comment linking /is-it-really-cheaper-to-get-hacked/
on “Shopify has paid over $300k in security exploit bounties”Submitted On Setting Up a WiFi Hacking Environment as a story · 3 points
HN discussionI'm surprised that he didn't mention CSSLP from (ISC)², the same organization that created CISSP. Certified Secure Software Lifecycle Professional (CSSLP) is a certification focused on all phases of software development lifecycle and is for those who want to add security to the whole development lifecycle instead of focusing on 'finding bugs'. It's great to find bugs, but application security is much more than that,…
Comment linking /what-it-takes-to-be-csslp/
on “Careers in security, ethical hacking and advice on where to get started”Submitted Most Secure Applications of B.I.B.I.F.I. Contest as a story · 3 points
HN discussionAllow me to enhance your list. "Owasp Testing Guide V4" is a must read for web hackers, at least for starters: https://www.owasp.org/index.php/OWASP_Testing_Guide_v4_Table... OWASP has vulnerable application projects for you to play with, such as WebGoat " https://www.owasp.org/index.php/Category:OWASP_WebGoat_Proje... , but there are many applications like these such as "DVWA - Damn Vulnerable Web Application" and…
Comment linking /courses/
on “Careers in security, ethical hacking and advice on where to get started”Submitted Building Data Breach Resistant Applications: Bring Your Own Database as a story · 2 points
HN discussionSome hashes are. There are non-cryptographic hashing functions. https://dadario.com.br/cryptographic-and-non-cryptographic-h...
Comment linking /cryptographic-and-non-cryptographic-hash-functions/
on “I am in favour of the term “Web4” to describe small, local, personal, private...”Submitted Docker for Automating Honeypots or Malware Sandboxes as a story · 2 points
HN discussionYou can do that using MiTM Proxy as well, as explained here: https://dadario.com.br/mitming-ssl-tls-connections/
Comment linking /mitming-ssl-tls-connections/
on “Making your own web debugging proxy”Submitted Getting ready for 2017 as a story · 2 points
HN discussionHere are two simple tips you should be able to implement right away (if you're not already doing this): https://dadario.com.br/preventing-docker-escaping-attacks/ > 1) Run the container as non-root user > 2) [Use] a read-only file system SELinux is probably your next step, which may be as simple as switching your host OS to RedHat/CentOS. I'm not sure if you'll be able to use a VM on your current host, and using onl…
Comment linking /preventing-docker-escaping-attacks/
on “Ask HN: Can tux.io rely on LXC's security?”Submitted Free Docker Security Fundamentals Course as a story · 2 points
HN discussionSubmitted Device fingerprint introduction as a story · 2 points
HN discussionSubmitted What is CSRF? as a story · 2 points
HN discussionSubmitted Why Privacy Debates Hardly Persuades People as a story · 2 points
HN discussionSubmitted Defending Your Wifi Network as a story · 2 points
HN discussionSubmitted On Setting Up a WiFi Hacking Environment as a story · 2 points
HN discussionSubmitted Security for later stage web apps as a story · 2 points
HN discussion
