Appcanary Blog
blog.appcanary.com · Company blog · on HN since 2016
Appcanary, a security startup, wrote about web security headers, automatic updates, compression and encryption attacks, and its switch between Clojure and Ruby.
What HN saysHN links it for explanations of why not to compress before encrypting, Ubuntu's unattended upgrades, and the team's Clojure-to-Ruby move.
16HN people shared it
4linked it in comments
21stories submitted
1.4Kstory points
6 years agolast shared
2016people per year2026
Most-shared posts
- 1HTTP security headers7 people · 240 points · first shared 2017 · 21 comments on HN
- 2Simple Ain't Easy, but Hard Ain't Simple: Leaving Clojure for Ruby3 people · 40 points · first shared 2017 · 19 comments on HN
- 3Hacking your Elixir Editor3 people · 5 points · first shared 2017 · discussion on HN
- 4“Should you encrypt or compress first?”2 people · 463 points · first shared 2016 · 235 comments on HN
- 5Good News: Ubuntu now ships with unattended-upgrades on by default2 people · 8 points · first shared 2016 · 1 comments on HN
- 6Slippery exceptions in Clojure and Ruby2 people · 7 points · first shared 2016 · discussion on HN
- 7The Mirai Botnet Is Proof the Security Industry Is Broken1 people · 279 points · first shared 2016 · 256 comments on HN
- 8Symantec's Bad Week1 people · 182 points · first shared 2016 · 67 comments on HN
- 9GitHub acquires AppCanary1 people · 160 points · first shared 2018 · 28 comments on HN
- 10Morris and badBIOS, 25 years in 2 worms1 people · 5 points · first shared 2016 · discussion on HN
- 11Improve Your Security: Port Scan Yourself1 people · 3 points · first shared 2017 · discussion on HN
- 12A tale of 2 worms, 3 vulns and the NSA1 people · 1 points · first shared 2016 · discussion on HN
What HN people wrote when they linked it
godelski · 2018-01-12
From my limited knowledge of encryption, this is why you don't compress before you encrypt. So if I understand the following article correctly, this kind of attack is well known. https://blog.appcanary.com/2016/encrypt-or-compress.html
evand · 2017-05-17
For what it's worth, as of 16.04 Ubuntu automatically installs security updates:
https://blog.appcanary.com/2016/unattended-upgrades.html
In snapcraft, all updates are automatically installed:
https://docs.ubuntu.com/core/en/reference/automatic-refreshes
https://www.youtube.com/watch?v=DLxqdf89hRo
lstamour · 2017-10-19
As pointed out by Microsoft earlier today, MDN is one of the best resources on this sort of thing. Here they write:
> The upgrade-insecure-requests directive is evaluated before block-all-mixed-content and If the former is set, the latter is effectively a no-op. It is recommended to set one directive or the other – not both.
Source: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Secu… and https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Secu…
Yes they are similar, and you have to watch which one you set -- but you can also achieve a similar effect at a more granular level using CSP as also indicated in MDN. These rules are equivalent to saying `default-src https:` in the CSP rule.
In fact, the best option is individual CSP directives which can get more granular than the `https:` scheme alone, because you can then specify which trusted third-party domains (if any) are allowed to load resources on your pages and conditions (like nonces) for running script tags, data URIs, etc. After all, your secure third-party resources could still have servers compromised and they might then send malicious assets over SSL to your unsuspecting users' browsers.
CSP, if trusted enough to set it to block instead of just report (though you can run both modes at the same time), is one of the best defence-in-depth ways to protect your page from attack, right up there with HttpOnly and…
phillmv · 2017-07-31
Shameless plug but… we left Ruby and then came back ;) - https://blog.appcanary.com/2017/hard-isnt-simple-ruby-clojure.html
It's tricky, it's definitely not the bleeding edge like it used to be but – if you already know the toolset well, it does a good job at what it's meant to.