Two questions sit underneath almost every distributed system, and most of the security work anyone does is really about answering them well. Who is calling me. And are they allowed to do what they are asking for. The first is authentication, the second is authorization, and the reason they are worth keeping apart is that the good answers to them look nothing alike.
I keep this series going because most security news is useless to me as a developer. You get a CVE number, a CVSS score, a one line summary that says “an attacker may be able to execute arbitrary code”, and then nothing. You close the tab having learned that a thing is bad, which you already assumed, and not one word about why the thing happened or whether the same mistake is sitting in your own code.
Last week’s post covered 19 to 25 August, this one covers 27 August to 2 September. Same format as always: five things worth knowing, then two of them taken apart properly, because the CVE number and the CVSS score are the least reusable information in any advisory and the mechanism is the most.
The previous post covered 12 to 18 August, this one covers 19 to 25. The format is unchanged: five things worth knowing, then two of them taken apart properly, because a CVE number and a CVSS score tell you nothing you can reuse and the mechanism usually does.
The previous post covered 5 to 11 August, this one covers 12 to 18. Same format: the five things worth knowing, then two taken apart, because the mechanism is the part you can generalise from.