Recent Posts

A Beginner’s Guide to Python Development on Windows 10 The Python programming language is used for web development, data analysis, machine learning, statistics, web scraping, and so much more. There are tons of tutorials which, ironically, makes it pretty hard to recommend one. However, there is also a lack of support for Windows. Let’s get the very first … Read More »

Password Hashing 😇 Software gets hacked, data breaches happen, data is leaked. It’s not a rare exception but happens all the time. We need to acknowledge that software is not perfect. This is where the concept of defense in depth comes into play. Defense in depth means we don’t rely on … Read More »

Cross-site Scripting (XSS) 😈 Cross-site scripting (XSS) is a type of attack on websites where the attacker can make the attacked website deliver JavaScript to the user. This malicious JavaScript is then executed on the users’ machine. Various types of XSS are distinguished: Stored XSS: The attacker can make the website store the XSS … Read More »

Leaking Secrets 😇 One of the worst mistakes one can make in application security is to publicly post secrets. That can be API keys, database credentials, service tokens, or private keys for asymmetric cryptography such as RSA as used for GPG. It’s best to prevent leaking credentials completely, but if it’s … Read More »

SQL Injections 😈 An SQL injection is an attack on a web system with a database. The attack is done by injecting unexpected commands into parameters. Don’t worry, I’ll explain that later in detail. After reading this article you will understand what the effect of being vulnerable to SQL injections can … Read More »

JSON encoding/decoding with Python JSON is a cornerstone for the exchange of data on the Internet. REST APIs use the standardized message format all around the world. Being a subset of JavaScript, it got a huge initial boost in its adoption right from the start. The fact that its syntax is pretty clear and … Read More »

Identification vs Authentication vs Authorization Identification, authentication, and authorization are closely related, but not the same. Identification is about knowing who somebody is, even without their cooperation. Surveillance systems, fingerprints, DNA samples are the techniques that come to mind in the physical world. In the digital world, device fingerprinting is used. It’s also possible … Read More »

Localization vs Internationalization Internationalization is the process of making your software easy to adapt to different languages or regions. Internationalization is often abbreviated by i18n. In a website, i18n can mean to use Babel projects (e.g. flask-babel in Python, gettext in PHP, FormatJS in JavaScript, …) Localization is the process of adapting your … Read More »

Safe vs Secure When I hear “safety” in the context of software development, I’m always reminded that I need to automate my backup solution. The potential harm most software developers have to deal with is luckily only data loss due to hardware failures. Safety is resilience against accidential harm to people, property … Read More »

How Twitter’s Image Choice is Biased Photo by Ravi Sharma on Unsplash Twitter shows preview-images of shared images. If the aspect ratio is not the wanted one, the image needs to be cropped for the preview. The way the cropping is done is supposedly not random. People seem to think that it is “smart” in the … Read More »