jacksingleton

ah I can see how that sidebar is confusing now. the point was just to highlight the configuration names across different frameworks. as @ameliaquining points out, a randomly generated secret that's been leaked to github has much the same effect as one that is easily guessed.

I'll think about ways to make it more clear! Thanks

@AgentME -- correct

@franciscop -- keep an eye out for the rest of the article (it's already written and will be released soon). I go over the impacts of an attacker knowing the secret in much more detail. I also have sections on prevention for both application developers and library/framework authors that I think you'll find interesting!

(apparently a known issue)

File on master: https://github.com/jacksingleton/cr-newline-diff-test/blob/m... File in pull request: https://github.com/jacksingleton/cr-newline-diff-test/blob/v...

Note the diff does not show "print 'did you see this coming?'" as a change - yet once merged python will run it with no problems.

Interestingly, if you hit expand at the bottom left, you will see "print 'did you see this coming?'" in both the master and the PR version... which is not the case.

Remember to review PRs in git, not GitHub - especially if you're working on sensitive software!

The argument is that implementing crypto within an application that is designed to download and execute untrusted code from untrusted servers and has an extremely large attack service [1] is a difficult if not dangerous task.

[1] your browser

Hah, such strong language.

I must admit though I AM mutable and globally accessible

Thanks, that demo is all courtesy of Sandstorm - all I had to do was add the link to the README.

This is what Mozilla is trying to create with Rust

http://www.rust-lang.org/