Series · 7 parts · 2,024–2,024
How systems get broken, and how they get defended, from first principles. Every vulnerability is one confusion: code mistaking data for instructions, or trusting input it should have checked. SQL injection, cross-site scripting, cross-site request forgery, broken access control, memory corruption, and what actually stops each one. Written to make you a developer who does not ship the bug, not a headline.
Security is not a product you add. It is a property of where you decide to trust, and almost every vulnerability is one of two confusions crossing that line.
Security From the Ground Up01
The clearest case of data becoming code. How a login form ends up running the attacker's SQL, why escaping is the wrong fix, and the one that actually ends it.
Security From the Ground Up02
The same bug as SQL injection, moved to the browser. How attacker text becomes attacker script in your users' sessions, the three flavours, and the layered fix.
Security From the Ground Up03
The attacker never steals the session. They get the victim's own browser to send an authenticated request, using cookies the browser attaches for them.
Security From the Ground Up04
The most common serious web bug is also the most boring: the server checks who you are, then forgets to check whether you may touch this particular thing.
Security From the Ground Up05
The oldest confusion of data and code, at the lowest level. How writing past a buffer can hijack a program, and the four defences that made it hard.
Security From the Ground Up06
On a network the confusion is not data and code but identity. What HTTPS really guarantees, what it does not, and why a padlock is about the pipe, not the site.
Security From the Ground Up07