Jamie Tanna | Software Engineer

Post details

I see folks making fun of the CVE issued for the default password on Raspberry Pi I personally want to see CVEs for EVERY _static_ default credential. I want it to show up in searches for the vendor name or product, CVE counts for a vendor, and in risk ratings for the product.
Tom Sellers (@TomSellers)Wed, 08 Dec 2021 16:54 GMT

Fri, 10 Dec 2021 07:36 by Jamie Tanna . #security.

Liked https://github.com/42crunch/resources .

Thu, 09 Dec 2021 09:52 by Jamie Tanna . #security #api.

Should That (Secret) Thing Be In Your Querystring? (2 mins read).

Why you should be very cautious about putting potentially sensitive values into the querystring of web APIs.

Wed, 08 Dec 2021 16:34 by Jamie Tanna . #api #security.

Liked https://shkspr.mobi/blog/2021/12/responsible-disclosure-chrome-security-bug-lets-tabs-draw-over-each-other/ .

Bookmarked https://snyk.io/blog/java-json-deserialization-problems-jackson-objectmapper/ .

Tue, 07 Dec 2021 12:10 by Jamie Tanna . #java #security #json #jackson.

Sat, 04 Dec 2021 13:46 by Jamie Tanna . #security #google.

Reducing Risk of Supply Chain Attacks with Reproducible Builds in Gradle (1 mins read).

How to enable Gradle's reproducible builds functionality to allow others to verify your released libraries don't contain uncommitted, malicious code.

Thu, 02 Dec 2021 17:05 by Jamie Tanna . #blogumentation #java #gradle #security.

Post details

I'm a tech guy and I can say with confidence I've lost every private key I've ever held within three years or so. Excited to see this important technology go mainstream with no recourse and tied to real assets. Please share your own stories in the comments!
Post details
One of the most significant side-effects of the rise of crypto is we're *finally* giving everyone a public/private key pair What cypherpunks had tried unsuccessfully to do for yrs w/ ideology is happening w/ crypto incentives This has *far* reaching consequences warning long🧵
brantly.eth (@BrantlyMillegan)Mon, 03 May 2021 17:26 +0000
Pinboard (@Pinboard)Sun, 28 Nov 2021 01:32 GMT

Sun, 28 Nov 2021 09:42 by Jamie Tanna . #cryptocurrency #security #secret-management.

Post details

What attackers don't want you to know
Brains93 (@Brains933)Fri, 26 Nov 2021 09:25 GMT

Sat, 27 Nov 2021 20:51 by Jamie Tanna . #security #csv.

Liked https://thecrow.uk/A-Gov.uk-site-dedicated-to-porn-Absolutely/ .

Sat, 27 Nov 2021 11:50 by Jamie Tanna . #security.

Bookmarked https://monzo.com/blog/2021/11/18/protecting-our-most-sensitive-secrets/ .

A very interesting read about physical and virtual security required to protect the keys to the castle

Fri, 19 Nov 2021 10:08 by Jamie Tanna . #security #pki #certificates.

Liked https://www.wired.com/story/encrypted-messaging-privacy-security-metadata/ .

Bookmarked https://github.blog/2021-11-15-githubs-commitment-to-npm-ecosystem-security/ .

Tue, 16 Nov 2021 09:09 by Jamie Tanna . #security #github #npm.

Tue, 16 Nov 2021 07:48 by Jamie Tanna . #privacy #security #metadata.

Liked https://www.darkreading.com/vulnerabilities-threats/api-security-issues-hinder-application-delivery .

Mon, 15 Nov 2021 17:40 by Jamie Tanna . #api #security.

Bookmarked https://certitude.consulting/blog/en/invisible-backdoor/ .

A very interesting attack - having tested a few editors with colleagues, none of us could've caught it without spotting that there's a slightly wider character in a couple of places!

Wed, 10 Nov 2021 10:30 by Jamie Tanna . #security #nodejs #javascript.

Bookmarked https://trufflesecurity.com/blog/driftwood .

Wed, 10 Nov 2021 08:16 by Jamie Tanna . #security #secret-management.

Why You Should Avoid using Client Secret Authentication for OAuth2 Client Credentials (7 mins read).

Why I recommend against using client secret authentication for OAuth2 and OpenID Connect APIs.

Tue, 09 Nov 2021 11:45 by Jamie Tanna . #oauth #oauth2 #oidc #security.

Liked https://btao.org/2021/09/09/npm-install-is-curl-bash/ .

Sun, 07 Nov 2021 09:40 by Jamie Tanna . #nodejs #npm #security #package-management.

Bookmarked https://asylum.madhouse-project.org/blog/2021/10/23/peeking-through-logs/ .

Very interesting read, I can empathise with being the "logs person" 😂

Fri, 05 Nov 2021 08:33 by Jamie Tanna . #logs #social-engineering #security.

Bookmarked https://ericwbailey.design/writing/spear-phishing-with-slackbot-for-fun-and-profit/ .

Tue, 26 Oct 2021 18:21 by Jamie Tanna . #security #slack.

Liked https://github.com/Yelp/detect-secrets .

Thu, 21 Oct 2021 12:37 by Jamie Tanna . #security.

Bookmarked https://medium.com/cider-sec/bypassing-required-reviews-using-github-actions-6e1b29135cc7 .

Tue, 19 Oct 2021 13:48 by Jamie Tanna . #security #github.

Post details

This is (one of many reasons) why Government websites need proper vulnerability disclosure programmes. We (CDDO) are looking at security.txt github.com/alphagov/open-… It's already deployed on some .gov.uk websites.
Post details
A reporter at @stltoday discovered a flaw in a state website that risked exposure of teacher Social Security numbers. He notified the state of the problem and it was fixed. Today, @GovParsonMO labeled the reporter a 'hacker' & vowed criminal prosecution. missouriindependent.com/2021/10/14/mis…
Jason Hancock (@J_Hancock)Thu, 14 Oct 2021 15:32 +0000
Terence Eden (@edent)Thu, 14 Oct 2021 17:24 +0000

Thu, 14 Oct 2021 19:38 by Jamie Tanna . #security #cddo.

Post details

https://twitter.com/GovParsonMO/status/1448697775068229635
Nothing was "converted" or "decoded." You literally open a web page, right click, and select "view source code." The SSNs were plainly visible.
This Is Exhausting (@SHockeyfan)Thu, 14 Oct 2021 17:23 +0000

Thu, 14 Oct 2021 19:36 by Jamie Tanna . #security.

Post details

https://twitter.com/GovParsonMO/status/1448697775068229635
Accessing publicly available information is not hacking. By having the information so easily available, the website did implicitly grant permission to view it.
Ryan King (@rexaliquid)Thu, 14 Oct 2021 17:42 +0000

Thu, 14 Oct 2021 19:36 by Jamie Tanna . #security.

Liked https://www.pentestpartners.com/security-blog/free-brewdog-beer-with-a-side-order-of-shareholder-pii/ .

Post details

Oh word? Every time I've accidentally hit F12 I was hacking? I am a master hacker now. Bow before me.
Post details
https://twitter.com/GovParsonMO/status/1448697772799049730
A hacker is someone who gains unauthorized access to information or content. This individual did not have permission to do what they did. They had no authorization to convert and decode the code.
Governor Mike Parson (@GovParsonMO)Thu, 14 Oct 2021 17:10 +0000
High King Pilnokula, An Even Meaner Bisexual 🦇 (@Pilnok)Thu, 14 Oct 2021 17:29 +0000

Thu, 14 Oct 2021 19:36 by Jamie Tanna . #security.

Wed, 13 Oct 2021 16:38 by Jamie Tanna . #security.

Post details

Web developers, if you’d like iCloud Keychain, Google Chrome, or 1Password to take your users directly to your site’s change password page when their password manager encourages them to change their password, you can implement one simple URL redirect. web.dev/change-passwor…
Ricky Mondello (@rmondello)Fri, 08 Oct 2021 15:55 +0000

Sat, 09 Oct 2021 22:21 by Jamie Tanna . #security.

Liked https://github.com/mjg59/ssh_pki .

Thu, 30 Sep 2021 08:50 by Jamie Tanna . #security #ssh.

Tips for Reducing Dependency Upgrade Toil with Renovate (5 mins read).

Some tips I've picked up while working with Renovate to keep my projects up-to-date.

Sun, 26 Sep 2021 18:21 by Jamie Tanna . #blogumentation #renovate #open-source #security.

Liked https://shufflesharding.com/posts/aws-sigv4-and-sigv4a .

Fri, 24 Sep 2021 08:32 by Jamie Tanna . #aws #security.

Liked https://www.spotvirtual.com/blog/the-perils-of-an-xyz-domain/ .

Sun, 19 Sep 2021 12:53 by Jamie Tanna . #security #email.

Bookmarked https://curity.io/resources/learn/phantom-token-pattern/ .

Sun, 12 Sep 2021 08:34 by Jamie Tanna . #oauth #oauth2 #identity #security #api.

Post details

Site: Choose a password Me: oGUWi4!N^*5!y7MkiZnr Site: Must be under 13 letters Me: Pye8z#&9F2Ta Site: No symbols Me: TrbqhSVthFoP Site: No pasting Me: 123456
Jon Kuperman (@jkup)Sat, 17 Jul 2021 20:22 +0000

Sun, 18 Jul 2021 07:23 by Jamie Tanna . #security.

Post details

A telco injecting ads into 2FA SMSs feels… wrong (see thread)
Post details
I just received a two factor authentication SMS from Google that included an ad. Google's own Messages SMS app flagged it as spam. What a shameful money grab.
Chris Lacy (@chrismlacy)Tue, 29 Jun 2021 04:18 +0000
Troy Hunt (@troyhunt)Tue, 29 Jun 2021 20:05 +0000

Thu, 08 Jul 2021 12:58 by Jamie Tanna . #security.

Bookmarked https://www.wired.com/story/the-full-story-of-the-stunning-rsa-hack-can-finally-be-told/ .

Sun, 23 May 2021 19:37 by Jamie Tanna . #security.

Post details

New emojis in iOS 14.5 means that BILLIONS of security patches will be applied today. Incentives matter.
Ryan Naraine (@ryanaraine)Mon, 26 Apr 2021 15:44 +0000

Mon, 26 Apr 2021 22:27 by Jamie Tanna . #security.

Liked https://johnmathews.eu/i-leaked-credentials-onto-a-public-github-repo.html .

Bookmarked https://www.clever-cloud.com/blog/engineering/2021/04/12/introduction-to-biscuit/ .

Sun, 25 Apr 2021 12:24 by Jamie Tanna . #oauth2 #oauth #security #jwt #paseto #authorization.

Fri, 23 Apr 2021 22:35 by Jamie Tanna . #security.

Liked https://robertchen.cc/blog/2021/04/03/github-pages-xss .

Tue, 06 Apr 2021 18:29 by Jamie Tanna . #security #github.

Liked https://www.paulosyibelo.com/2021/04/this-man-thought-opening-txt-file-is.html?m=1 .

Bookmarked https://github.blog/2021-04-05-behind-githubs-new-authentication-token-formats/ .

Tue, 06 Apr 2021 13:49 by Jamie Tanna . #security #github.

Sat, 03 Apr 2021 14:28 by Jamie Tanna . #security #mac.

Liked https://daniel.haxx.se/blog/2021/03/30/howto-backdoor-curl/ .

Wed, 31 Mar 2021 18:11 by Jamie Tanna . #security #curl.

Liked https://blog.mergify.io/un-signed-commits-how-we-found-a-non-security-bug-in-github/ .

Wed, 31 Mar 2021 17:56 by Jamie Tanna . #github #security.

Liked http://sakurity.com/oauth .

Fri, 26 Mar 2021 08:12 by Jamie Tanna . #oauth #oauth2 #security.

Bookmarked https://portswigger.net/research/hidden-oauth-attack-vectors .

Thu, 25 Mar 2021 19:20 by Jamie Tanna . #oauth #oauth2 #oidc #security.

Liked https://blog.teddykatz.com/2021/03/17/github-actions-write-access.html .

Fri, 19 Mar 2021 10:07 by Jamie Tanna . #security #github.

Post details

Yesterday I announced HACKED - Fixing hacked WordPress site Workshop. For details eventbrite.co.uk/e/hacked-fixin… TLDR; Join me on the 22nd & 29th of April for 2 sessions on identifying & fixing hacked WordPress sites. Early bird tickets on sale now.
Tim Nash (@tnash)Wed, 17 Mar 2021 09:33 GMT

Wed, 17 Mar 2021 10:46 by Jamie Tanna . #wordpress #security.