paragonie / awesome-appsec Goto Github PK

Are there any recommended Python books, articles, blogs, etc.?

Have you thought about adding an appsec conferences section?

JSON:

• data/00-general/articles/0002-hashing-security.json
• data/00-general/books/0018-security-engineering.json
• data/00-general/websites/00-blogs/0002-nccgroup.json
• data/00-general/websites/02-tools/0003-report-uri.json
• data/Go/articles/0001-cryptolosophy-memory-security.json
• data/Node.js/articles/0001-risingstack-checklist.json

Examples: NOK(broken link)

• https://github.com/paragonie/awesome-appsec#security-engineering-second-edition-2008
• https://github.com/paragonie/awesome-appsec#security-engineering---second-edition-2008
• https://github.com/paragonie/awesome-appsec#ncc-group-blog
• https://github.com/paragonie/awesome-appsec#ncc-group---blog
• https://github.com/paragonie/awesome-appsec#report-uri-io
• https://github.com/paragonie/awesome-appsec#report-uriio
• https://github.com/paragonie/awesome-appsec#memory-security-in-go-cryptolosophy-io-2017
• https://github.com/paragonie/awesome-appsec#memory-security-in-go---cryptolosophyio-2017
• https://github.com/paragonie/awesome-appsec#node-js-security-checklist-rising-stack-blog-2015
• https://github.com/paragonie/awesome-appsec#nodejs-security-checklist---rising-stack-blog-2015

JSON:

• data/00-general/articles/0005-crypto-unicorns.json
• data/00-general/websites/0005-news-feeds.json
• data/00-general/books/0020-holistic-info-sec-for-web-developers-f0.json
• data/00-general/books/0021-holistic-info-sec-for-web-developers-f1.json

Examples: OK

• https://github.com/paragonie/awesome-appsec#be-wary-of-one-time-pads-and-other-crypto-unicorns-2015
• https://github.com/paragonie/awesome-appsec#security-news-feeds-cheat-sheet
• https://github.com/paragonie/awesome-appsec#holistic-info-sec-for-web-developers-fascicle-0-2016
• https://github.com/paragonie/awesome-appsec#holistic-info-sec-for-web-developers-fascicle-1

Workaround: Add this snippet or similar task between lines 237/238 (suggestion).
src/Util.php

        if (\array_key_exists('name', $fd)) {
          if (isset($fd['name'])) {
            $fd['name'] = preg_replace('/\-/', ' ', $fd['name']);
        }

https://github.com/paragonie/awesome-appsec#salted-password-hashing-doing-it-right-2014
https://github.com/paragonie/awesome-appsec#salted-password-hashing---doing-it-right-2014

Let me know if you are accepting PRs?

Is there a place for this on awesome-appsec?

This API has been unmaintained for several years, I'm the new owner and keeping it maintained now

• The API code
• Now official
• Official announcement
• Main issue
• Main PR
• What's changed

Interested in a PR?

Idk

Note to myself for later: Chargen has moved, now it's the NCC Group blog. I should remember to update this tonight.

Just wondering if this list is still maintained, or if not could i help maintain it?

Since not everything on the list is free, I'm thinking about making the compiler mark the non-free ones.

For example:

{
    "date": "2010-01-23",
    "free": false,
    "name": "....",
    "remark": "Read this and you can avoid the rest of this list forever!",
    "url": "http://omfgdogs.com"
}

And have it indicate non-free in the markdown somehow. (An image would probably be best!)

https://crackstation.net/hashing-security.htm
http://insanecoding.blogspot.co.uk/2014/05/a-good-idea-with-bad-usage-devurandom.html
http://www.cyberciti.biz/tips/php-security-best-practices-tutorial.html
http://blog.astrumfutura.com/2013/04/20-point-list-for-preventing-cross-site-scripting-in-php
https://timoh6.github.io/2014/06/16/PHP-data-encryption-cheatsheet.html
https://timoh6.github.io/WebAppSecQuiz/index.html
http://lzone.de/cheat-sheet/Security-News-Feeds

https://resources.sei.cmu.edu/downloads/secure-coding/assets/sei-cert-c-coding-standard-2016-v01.pdf

https://resources.sei.cmu.edu/downloads/secure-coding/assets/sei-cert-cpp-coding-standard-2016-v01.pdf

A curated list of cryptography resources and links.
https://github.com/sobolevn/awesome-cryptography

Secure passwords in several languages/frameworks, I think this might be useful to some people.

Maybe there's a place for it here somewhere!

https://securepasswords.info/

Hello, I wrote a tool that can validate README links (valid URLs, not duplicate). It can be run when someone submits a pull request.

It is currently being used by

• https://github.com/vsouza/awesome-ios
• https://github.com/matteocrippa/awesome-swift
• https://github.com/dkhamsing/open-source-ios-apps

Examples

• https://travis-ci.org/matteocrippa/awesome-swift/builds/96526196 ok ✅
• https://travis-ci.org/matteocrippa/awesome-swift/builds/96722421 link redirected / rename 🔴
• https://travis-ci.org/dkhamsing/open-source-ios-apps/builds/96763135 bad link / project deleted 🔴
• https://travis-ci.org/dkhamsing/open-source-ios-apps/builds/95754715 dupe 🔴

If you are interested, connect this repo to https://travis-ci.org/ and add a .travis.yml file to the project.

See https://github.com/dkhamsing/awesome_bot for options, more information
Feel free to leave a comment 😄

I think https://github.com/ircmaxell/RandomLib library serves the needs than using urandom.

{
"date": "2023-01-1",
"free": true,
"name": "Angela",
"remark": "Received a 404 error on the CIS 4930 link.",
"url": "https://www.cs.fsu.edu/~redwood/OffensiveComputerSecurity/"
}

CERT C Coding Standard: https://www.securecoding.cert.org/confluence/display/c/CERT+C+Coding+Standard

CERT C++ Coding Standard: https://www.securecoding.cert.org/confluence/pages/viewpage.action?pageId=637

Android, Java, Perl: https://www.securecoding.cert.org/confluence/spacedirectory/view.action

Although, historically, we've maintained an open inquiry for reading material suggestions in other languages, creating an issue for each and every language isn't feasible. For general purpose application security material suggestions, please feel free to leave a comment here or open a pull request.

Are there any great articles, books, blogs, etc. for writing secure Node.js software? If so, let us know and we'll add them to the list.

After running src/compiler.php the date is ignored:

$ grep -r date data/C/books-and-ebooks/0002-fedora-defensive-coding.json 
    "date": "2012",

• README.md:

-      * [Defensive Coding: A Guide to Improving Software Security by the Fedora Security Team](#defensive-coding-a-guide-to-improving-software-security-by-the-fedora-security-team-2018) (2018)
+      * [Defensive Coding: A Guide to Improving Software Security by the Fedora Security Team](#defensive-coding-a-guide-to-improving-software-security-by-the-fedora-security-team-2019) (2019)

• src/Util.php:

        if (!empty($fd['date'])) {
            $dt = new \DateTime($fd['date']);
            $header .= ' ('.$dt->format('Y').')';
        }

• DateTime:

Instead of just using the year, it seems working when date matches the pattern "YYYY-MM"

https://github.com/paragonie/awesome-appsec/blob/master/data/C/books-and-ebooks/0002-fedora-defensive-coding.json#L2

• Notes:

OK: Four digit year and month (GNU) YY "-" mm "2008-6", "2008-06", "1978-12"
NOK: Year (and just the year) YY "1978", "2008"
https://www.php.net/manual/pt_BR/datetime.construct.php#123882
https://www.php.net/manual/pt_BR/datetime.construct.php#119591
https://www.php.net/manual/en/datetime.formats.date.php)

• Enhancement:

Include optional fields and examples.

ModSecurity is a pretty decent open-source WAF that can be placed in front of applications. Can this be added to this repo? https://modsecurity.org/

Also OWASP updated its cheatsheet series and placed them on Github, these are a good resource as well: https://github.com/OWASP/CheatSheetSeries/tree/master/cheatsheets

***Can I make a pull request that adds 1 or both of these to the repo?

I have been maintaining a small web application specific quiz at http://timoh6.github.io/WebAppSecQuiz/ (tests knowledge about different kind of quirks and so on regarding to web application security).

Maybe this could be used on the list? Under "General"?