John Cox

Blogs · @wyome

Tagged security · everything

Marginal REVOLUTION

Close the Washington Monument — Marginal Revolution

Schneier argues that the National Park Service's plan to add airport-style security to the Washington Monument misses a larger point about how we respond to terrorism. He contends that closing the monument permanently would actually serve a more important symbolic function—forcing lawmakers to confront the fear driving excessive security measures and the trade-off between safety and liberty that defines post-9/11 America. By keeping it closed, the monument would stand as a reminder that terrorism succeeds when it makes us fundamentally alter our open society, and that true leadership means accepting reasonable risks rather than pursuing impossible absolute security.

Permalink philosophysecuritypolitics

Queness

17 Useful Htaccess Tricks and Tips

This article presents 17 practical .htaccess techniques divided into general optimization methods and security hardening measures. The general section covers tasks like setting timezone, implementing SEO-friendly redirects, file compression, and caching strategies, while the security section focuses on preventing malicious attacks through hotlink protection, blocking suspicious URL patterns, restricting access to sensitive files, and filtering unwanted bots and referrers. The author claims to have tested these methods and presents them as both essential security protections and efficiency improvements for web server management.

Permalink performancesecuritydevelopmenttutorial

perishablepress.com

2010 User-Agent Blacklist • Perishable Press

The 2010 User-Agent Blacklist is a set of .htaccess rules that blocks hundreds of malicious bots while allowing legitimate search engines through, improving site performance and SEO by preventing bad bots from consuming server resources and bandwidth. The blacklist identifies problematic user-agents through careful server-log analysis and prevents them from accessing your site, which is especially important during search engine crawls when poor performance could harm rankings. However, the author emphasizes this requires active monitoring and isn't a set-and-forget solution, as false positives are possible and the list needs regular updating to remain effective.

Permalink performancesecurityseotutorial

www.serverdensity.com

Easy server monitoring with e-mail, SMS, iPhone alerts - Server Density

Zarpra is a managed IT services company that takes over application support and infrastructure management for organizations with neglected or undocumented tech stacks, providing documentation, stabilization, and ongoing support rather than piecemeal fixes. The company emphasizes establishing clear ownership and responsibility for systems, managing access controls and user administration, and handling daily IT operations without downtime—positioning itself as the missing "foreman" for companies whose technical infrastructure has grown chaotic through lack of coordination.

Permalink securitybusinesstools

code.google.com

A List Apart

A List Apart: Articles: The Problem with Passwords

Jakob Nielsen proposes revealing passwords in clear text as users type them to reduce frustration and errors, but this creates tension between security, usability, and user expectations. The article presents two JavaScript-based middle-ground solutions: a toggle checkbox that lets users voluntarily switch between masked and unmasked views, and a progressive masking technique that displays only the most recently typed character in clear text for two seconds before masking it. Both approaches aim to improve usability and reduce typing errors without undermining the security perception that makes password fields feel like a trusted "black box."

Permalink securityusability

Jason Kolb dot Com

Sarbanes-Oxley IT Security Compliance Checklist from JasonKolb.com - The life of a technology entrepreneur.

Kolb provides a practical security checklist for Web 2.0 applications organized into front-end, back-end, and network layers, designed to help companies meet Sarbanes-Oxley compliance requirements without expensive consultants. The guide covers protecting sensitive user information through encryption, password policies, and secure authentication methods; preventing common attacks like SQL injection and man-in-the-middle exploitation; and restricting database access and logging security violations. While not exhaustive, the checklist aims to serve as a starting point for entrepreneurs building secure web applications and a cost-saving reference for companies navigating SOX audit requirements.

Permalink securitybusiness

SANS Institute

Verifi

Verifi - Chargeback management, fraud prevention and risk mitigation consulting services.

This is a marketing page for Verifi, a dispute management platform that helps merchants prevent chargebacks through three main mechanisms: providing customers real-time transaction details to clear up confusion before they dispute, resolving disputes early at the pre-dispute stage rather than letting them escalate, and recovering lost revenue by building compelling evidence cases for merchants. The company emphasizes that transaction confusion drives nearly half of first-party misuse disputes, and positions its Order Insight product as a solution to reduce billing confusion by sharing detailed purchase information through a global network connecting issuers and merchants.

Permalink securitybusiness

Asterisk

Asterisk :: The Open Source Telephony Platform |

This is the Asterisk project's landing page rather than an article with a single argument: it promotes the open source communications framework and its 2027 AstriCon call for speakers (Pasadena, April 1–2, alongside SCALE), then lists three security advisories dated June 25, 2026. The advisories cover a privilege-escalation and remote code execution flaw in ast_loggrabber via a world-writable /tmp path, an unauthenticated LDAP filter injection in res_config_ldap triggered by a SIP username, and SQL injection in the cel_pgsql and cel_tds modules through the CELGenUserEvent eventtype field. Saved for the advisories, the page is most useful as a record of those three vulnerabilities and their GHSA identifiers.

Permalink communicationsecurityinternetopensource

OpenDNS

OpenDNS | Providing A Safer And Faster DNS

OpenDNS is a DNS service that improves home internet speed through optimized routing and data centers, while providing content filtering and parental controls to protect against malware, phishing, and inappropriate content across all household devices. The service emphasizes ease of setup and reliability as core features for consumer users.

Permalink privacysecuritysmart homewindows

www.crossloop.com

CrossLoop - Secure Screen Sharing

This is a marketing page for Avast One antivirus software, not a saved article or reportage. It promotes the free antivirus app and its features—including AI-powered scam protection, device optimization, and dark web monitoring—while listing industry awards from AV-Comparatives, AVLab, and other testing organizations. The page contains product descriptions, award citations, and a download prompt rather than analytical or informational content.

Permalink aiprivacysoftwaresecurity

HowtoForge

Mirror Your Web Site With rsync

This tutorial explains how to set up automated file mirroring from a main web server to a backup server using rsync over SSH, with password-less authentication via SSH keys so the sync can run unattended via cron. The setup tunnels rsync through SSH (securing the connection and avoiding firewall configuration), uses public key authentication to eliminate password prompts, and restricts the backup server's SSH access to only execute rsync commands through a validation script on the main server.

Permalink securityautomationtutorialinternet

wikiHow

History Tracks - WikiHow

This guide provides step-by-step instructions for removing various types of activity history from Windows computers, including Start search history, app usage data, File Explorer searches, and browsing history across Chrome, Firefox, and Microsoft Edge. It covers both disabling future history storage through Windows settings and manually clearing existing history records from individual applications and system folders.

Permalink privacysecuritywindowstutorial

www.buzzsurf.com

the Guardian

tracking my girlfriend via her cell phone

This article demonstrates how easily anyone with brief physical access to a mobile phone can install location-tracking software that works invisibly—the phone shows no alerts or traces of the tracking, yet the tracker can pinpoint the device's location within 150 yards and monitor movements continuously. The author, a journalist, installed such tracking on his girlfriend's phone (with her permission "in principle") by simply registering her phone on a commercial GSM tracking website, paying £5, and deleting the warning text messages that appeared on her phone. The piece serves as a warning that mobile phone companies could monetize location data through these services, and anyone—not just authorities—might already be secretly tracking you if they've had five minutes alone with your phone.

Permalink technologyprivacysecurityinternet