In Threat-Driven Software Development, we focus heavily on the nuances of Operational Security and how to secure online services from modern threat actors. There are many books on Application Security, but not on this important operational aspect. How are they different? I think this quote sums it up best:

Application Security is an investment. Operational Security is a commitment.

Here is the full exerpt:

Understanding operational security

One phrase really helps underscore the difference between application security and operational security:

I recently made the mistake of asking folks to thumbs up an email if they wanted me to get back to them on something. Turns out, mail apps make it a royal pain to actually act on that data since it’s always behind a hover. You can’t select all and copy. You can’t use dev tools to inspect the element, since it changes when your mouse goes back to dev tools.

If you’re a Blue Teamer trying to write secure services or secure an organization that does, Threat Driven Software Development is the book you’ve been looking for. This was a deep collaboration between Michael Howard, Sherrod DeGrippo, Shawn Hernan and I - and I’m so excited to be able to get this expertise into the world.

What excites me most about this book is that there are many resources on traditional Application Security: how to protect yourself from things like Cross-Site Scripting, Prompt Injection, and many other risks so carefully described in resources like the OWASP Top 10. But there aren’t resources on how to secure and protect the operational aspects of building an online service. How should you manage keys and identities? What’s the best way to isolate production from development? How should you secure your build systems?

As a Canadian living in the US: whenever my family and I go back up to Canada, we always pack our luggage to bring back stuff you just can’t find easily around here. I’ve given a few friends these sage words of wisdom when they visit Canada or when their Alaska cruise takes them through Victoria, so here’s your shopping list:

• Ketchup chips and All-Dressed Chips. You may or may not like them, but they’re popular and different!
• Cheezies (like Cheetos, but super crunchy and delicious).
• If you like chocolate, go down the candy aisle and get anything you don’t recognize 🙂. The chocolate is way better than US chocolate in general - Cadbury especially. My family really likes Crunchie, Caramilk, Smarties, Wunderbar, Crispy Crunch, Coffee Crisp, Eat More, Big Turk. There are often versions of KitKats you don’t see in the US as well.
• If you like mint, there are these things called English Mints that are unique. They are little hard pucks rather than round chewy ones. Sort of like huge Altoids.
• Farm Boy or Dare Maple Cookies (although you can sometimes find Maple Cookies in the US).
• Maple butter (you can sometimes get this in the US, sometimes also called Maple Cream).
• Spicy Genoa salami - the stuff you can get from the deli counter at Safeway is so much better than the spicy salami I can seem to find in the US.
• Butter tarts. They’re like mini pecan pies, but you can eat an entire one in a sitting and live to tell the tale!
• If you’re going to be around an oven in the very near future, Pillsbury Fruit Turnovers (from where premade cookie dough etc. usually is).
• If you like cheese, you can get actually aged (i.e.: 5+ years) white cheddar everywhere. It’s hard to find aged white cheddar in the US aged more than like 18 months. After 3+ years, aged white cheddar gets delicious little crystals in it in addition to tasting super rich.
• There’s a cereal called Shreddies that is super famous in Canada (i.e.: Cheerios famous) but for some reason not out here. When I visited Canada for the first time with my wife and people found out she’d never had Shreddies, they reacted like had just made first contact with an unknown tribe from a secluded forest.
• Poutine (fries + cheese curds + gravy) is amazing: poutine - Google Maps.
• Tim Hortons. Coffee is far better than gas station coffee, better than most restaurant coffee, but not gourmet tier by any means. But definitely get a pack of assorted Timbits doughnut holes. I usually tell them to skip the plain. Plain doughnut holes are just boring.

Enjoy!

Once every 80 years, T Coronae Borealis - also known as the “Blaze Star” - goes nova. When it does this, it brightens from roughly magnitude 9 (likely only visible with telescopes) to magnitude 1 or 2 (roughly as bright as the North Star).

NASA has a great explanation of it, as well as how to find it in the night sky. Astronomy.com also has a great and more detailed article.

If you have a Hiboy S2 Pro scooter, you might have explored whether you can increase its max speed above 20 MPH / 30 KPH. There are resources out there mentioning that you can snip a speed limiter wire, but as far as I can tell they are AI-generated make-believe.

TLDR: You can’t. The top speed is limited by the scooter firmware. But the BTLE protocol that the app uses to communicate with the scooter is very simple and open for experimentation.

Pixel Doodle is a fun little Pixel Editor for Gameboy, emulators, and retro handhelds like the Anbernic RG35XX.

APL is one of the most curious programming languages you’ll ever run across. For example, take a random problem out of Rosetta Code: “Numbers divisible by their individual digits, but not by the product of their digits.”. Here’s a typical implementation in C:

#include <stdio.h>

int divisible(int n) {
    int p = 1;
    int c, d;

    for (c=n; c; c /= 10) {
        d = c % 10;
        if (!d || n % d) return 0;
        p *= d;
    }

    return n % p;
}

int main() {
    int n, c=0;

    for (n=1; n<1000; n++) {
        if (divisible(n)) {
            printf("%5d", n);
            if (!(++c % 10)) printf("\n");
        }
    }
    printf("\n");

    return 0;
}

I wrote some PowerShell to take a look at the lengths of the solution in different languages, and as you would expect - there is quite a difference in verbosity.

I was recently interested in doing some data analysis of a Microsoft Teams transcript - specifically to understand if I was talking too much and not giving other folks the opportunity to speak.

If you’ve ever wondered something similar (or wanted to do data analysis for other reasons), you might have seen the option to download meeting transcripts. The default options are docx files (Word documents) and VTT files:

The VTT files are handy, but turning that data format into something you can process requires writing a mini little parser. Not a complicated one, but something custom nevertheless.

Postman is an extremely popular application for developers testing remote web APIs. It lets you craft HTTP requests, interact with their responses, and go through the history of what you’ve sent and received.

Many of these HTTP requests are authenticated, meaning that the application deals with API keys, login tokens, credentials, etc.

In May, Postman pivoted to be a cloud-only product for many of its features.

Postman’s Security Risk

When you log in to Postman, it automatically syncs all data to their cloud service – including sensitive data contained in these requests. For example, here is the cloud view of Postman when all I’ve ever used was the on-premises application.