Application Security Weekly | Appsec

Just as there can be appsec truths, there can be appsec laws.
Science fiction author Arthur C. Clarke succinctly described the wondrous nature of technology in what has come to be known as Clarke’s Third Law (from a letter published in Science in January 1968):...

I know what you’re thinking. “Did my regex block six XSS attacks or five?” You’ve got to ask yourself one question: “Do I feel lucky?” Well, do ya, punk?
Maybe you read a few HTML injection (cross-site scripting) tutorials and think a regex solves this problem. Maybe. Let’s revisit that thinking. We’ll need an attack vector. It could be a URL parameter, form field, header, or any other part of an HTTP...

This is how it began. Over two years ago I unwittingly planted the seeds of an undead horde into the pages of my book, Seven Deadliest Web Application Attacks.
Only recently did I discover the rotted fruit of those seeds festering within the pages of Amazon....

In which the exposition of Twelve Web (In)Security Truths begins.
Twist #1 – Software execution is less secure than software design, but running code has more users.
A site you send people to visit is infinitely more useable than the one you describe to people. (Value differs from usability. Before social media flamed out you could raise $41 million dollars on a slide deck.) Talk all you want, but eventually someone...