Debugging Certificate Errors

It is a truth universally acknowledged, that any developer accessing a web service must be in want of using 'curl -k'. But why?

Infosec Skill Sets

Soft skills are hard, and everybody's career path different. Some skill sets tend to intersect, however. Here's my simplified breakdown using, what else, Venn diagrams.

strlcat(3) > strncat(3)

A quick look at a common mistake made when using strncat(3), and how strlcat(3) prevents a possible buffer overflow here.

Open Source Security Process Wishlist

A list of resources and ideas that I wish Open Source projects followed in their handling of security vulnerabilities.

Uninitialized Stack Variables

An illustration of how uninitialized stack variables can lead to undefined behavior.

IPv4 addresses are silly, inet_aton(3) doubly so.

For historical reasons, inet_aton(3) accepts IPv4 addresses in several silly formats. Let's see what we can do with those...

What's in a hostname?

The common definition of a 'valid hostname' is often reduced to a simple regular expression, but as the saying goes: 'Now you have two problems.' Because hostnames are DNS labels and those... well, it's the DNS. All bets are off.

There is no 'printf'.

In C, 'main' returns an int. What happens when you don't explicitly return a value, though? C99 provides a return value of 0, but C89... well, that's undefined, my favorite kind of behavior.