Top all-time · #13140
Tim Starling
Personal blog · tstarling.com/blogprogrammingsecurityweb
Tim Starling's personal blog at tstarling.com covers programming, security and web. Since 2009, 6 different Hacker News readers have linked it 6 times, most often “SSL implementations compared”. The last post was in 2024, but the archive is still widely read.
Too few sampled comments (3) to say how often HN recommends it.?
Why HN links it
HN readers link Tim Starling's posts on web security: a review of SSL library coding style, hosting user uploads safely, and a Compose key reference page for en and em dashes. Commenters cite them as sources.
Summarised by Claude from a sample of 3 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- SSL implementations compared2 people · 2 mentions · first linked 2014-04-15
- Secure web uploads (getting around insecurities in IE)2 people · 2 mentions · first linked 2009-01-21
What Hacker News says?
This might help: > I reviewed several SSL implementations for coding style: OpenSSL, NSS, GnuTLS, JSSE, Botan, MatrixSSL and PolarSSL. I looked at how buffers are handled in parsers and writers. Of all of them, I think only JSSE, i.e. pure Java, can be trusted to be free of buffer overflows. It suggests that a good webserver for security-critical applications would be Tomcat, without native extensions. http://tstarl…
Comment linking /blog/2014/04/ssl-implementations-compared/
on “Tptacek's Review of "Practical Cryptography With Go"”Submitted SSL implementations compared as a story · 4 points
HN discussionIt's really hard to harden yourself against code getting interpreted by the browser (and thus allowing someone to steal cookies and impersonate other users). Here's a long article on exactly how complex it is (as known today): http://tstarling.com/blog/2008/12/secure-web-uploads/ Personally, I just don't trust web uploads on the same domain. Put them on a subdomain or better yet a completely separate domain, prefera…
Comment linking /blog/2008/12/secure-web-uploads/
on “Ask HN: Have you ever had one of your sites get hacked?”Submitted Secure web uploads (getting around insecurities in IE) as a story · 3 points
HN discussionOr in Linux, En dash (–): Compose - - . Em dash (—): Compose - - - https://tstarling.com/stuff/ComposeKeys.html https://www.x.org/releases/current/doc/libX11/i18n/compose/e...
Comment linking /stuff/ComposeKeys.html
on “Punctuation Matters: How to use the en dash, em dash and hyphen”Submitted Using Polyspace Code Prover to verify server software as a story · 1 points
HN discussion