IT Hare on Soft.ware
If you're in trouble and cannot find an answer to a question which goes beyond Stack Overflow...
If you have a not-so-usual solution for your problems but need to justify it to your boss...
If you like to think on your own rather than blindly follow "common wisdom" and "profound truth"...
...then 'No Bugs' Hare on Soft.ware might be the right place for you.
Your mileage may vary. Batteries not included

Developing secure software is a challenge. Writing really secure software is a real challenge.
Here are the articles which touch different security aspects of software, from “what cipher suites are not to be used with TLS”, to certain more or less novel things under ‘Security Research’ subcategory.

All Not so Profound Truths about Security, page 4:

Random Number Generation

posted by

Quote: “even if your RNG is statistically perfect, people will still complain 🙁 “
Another Quote: “On modern x86 CPUs, single core can generate 150M+ random bytes/second this way (and this is a Damn Lot).”
[→]

UDP for games – security (encryption and DDoS protection)

posted by

Quote: “Yes, you DO need to encrypt your UDP traffic. And no, using UDP is NOT a valid excuse to skip encryption”
Another Quote: “Personally, I prefer to think of it as of insurance – when I’m paying my premiums in hope that my money will go to waste.”
[→]

Avoiding ugly afterthoughts. Part b. Coding for Security, Coding for i18n, Testing as a Part of Development

posted by

Quote: “Doing sanitization at IDL level automates quite a bit of tedious-and-error-prone work, which is always a Good Thing™”
Another Quote: “Hey, this whole thing can be made MUCH simpler, the only thing we need to acknowledge is that the best identifier for a string is the string itself!”
[→]

Password Hashing: Why and How

posted by

Abstract: Password hashing is a Big Headache, and doing it right is complicated
Quote: “Note that none of the C++11 random number engines (LCG, Mersenne-Twister, or Lagged Fibonacci) can be considered good enough for cryptographic purposes – in short, they’re way too predictable and can be broken by a determined attacker, given enough output has leaked.”
[→]
Copyright © 2014-2016 ITHare.com