istlsfastyet.com
awesome-appsec
istlsfastyet.com | awesome-appsec | |
---|---|---|
14 | 6 | |
418 | 6,098 | |
- | 0.6% | |
1.8 | 0.0 | |
over 2 years ago | 8 months ago | |
HTML | PHP | |
- | MIT License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
istlsfastyet.com
- Is TLS Fast Yet? - TLS has exactly one performance problem: it is not used widely enough. Everything else can be optimized.
- Is TLS Fast Yet?
-
Lost something? Search through 91.7M files from the 80s, 90s, and 2000s
> You want your website to work on vintage computers where they run super old browsers? Then you probably need a HTTP version of the website without TLS/SSL as it's not gonna be accessible otherwise.
That's incredibly niche. I don't think it deserves to be an example of "meme needs to die".
> Running a software/package repository/registry where every package is signed and verified locally? No need for TLS/SSL and it would just slow down downloading 1000s of packages as handshaking does add latency to requests.
Need some secure way to pass around the SHA256 (or whatever) hash you're using for verification.
And thinking of "memes that need to die", https://istlsfastyet.com suggests this isn't as bad as I think you think it is.
-
Why does linux use HTTP to get updates?
Not really... TLS is pretty much unnoticable on "modern" hardware. https://istlsfastyet.com/
-
Healthcare IT: Encrypt PHI Traffic Inside the Network?
So it's not correct to say that simply using TLS is faster than using TCP (see here). It is accurate to say that securing a connection allows engineers to take advantage of some incredibly clever work that greatly accelerates connection speed, and that wouldn't be possible without the strong security guarantees provided by modern encryption.
-
Traefik vs Nginx Proxy Manager & HTTP vs HTTPS
It was a big complaint with TLS as it was coming onto the scene: https://istlsfastyet.com/
-
Consider Disabling HTTPS Auto Redirects
> increases it’s overhead by almost 100%.
3.8/2.9 kB is a 31% increase.
1.16/0.62 s is an 87% increase.
But okay, let's round up to 100%.
The article is citing a page that counter-argues this:
https://istlsfastyet.com/
> But what about sites like https://doesmysiteneedhttps.com? While this website makes a few valid points, it still relies heavily on “fear tactics” that honestly don’t apply for the vast majority of users. It’s overkill.
Sorry, but not good enough.
1. "a few valid points": you avoid making your visitors liable in oppressive environments (employers, regimes), you avoid very real content injection (commercial or malicious), and you give the visitor a way to know that content wasn't tampered. That's a few valid points. (The rest of https://doesmysiteneedhttps.com are counter-arguments.)
2. "fear tactics": not true. Protecting the integrity of your visitors and your content is nurture, not fear.
3. "don’t apply for the vast majority of users": by making HTTPS standard at practically no cost, you make it work for those for whom it matters. Just because I feel safe on Hacker News doesn't mean that any visitor who goes here will be treated fairly by reading my message.
- Vim awesome's website certificates are fucked?
-
Information and learning resources for cryptography newcomers
https://istlsfastyet.com/ (Is TLS fast yet?)
-
Why most of mirrors(if not all) use http instead of https?
CPUs have specific features to help with encryption now, and HTTP/2 (which pretty much requires TLS) can actually reduce the number of overall TCP connections and may use less resources than clear text HTTP/1.1. Check out https://istlsfastyet.com/
awesome-appsec
-
Aside from OWASP, are there other relevant certs to get for App Sec?
For resources : https://github.com/paragonie/awesome-appsec
-
Cybersecurity Repositories
AppSec
-
Resources to learn secure coding? App Sec and Web Sec?
Here is a repo of some resources. You are going to need to learn to walk before you run so that at a concrete level you can articulate what secure vs insecure code is and why it matters, then dive into appsec. No disrespect intended but from the way this is written my suggestion would be to focus on computer science foundational concepts as well as spending significant time writing and reading code. This will likely be a several year journey if you are a total beginner but the best time to start is now :)
- Information and learning resources for cryptography newcomers
-
Anyone in AppSec (Application Security)?
Come over to /r/devsecops to get more information about the field. Also, there are lots of good sources, you can get some from my blog, or Awesome AppSec, or Security Prince and other places.
- I'm preparing for the interview and I've curated a list of resources that might be helpful for you also.
What are some alternatives?
boringssl - Mirror of BoringSSL
API-Security-Checklist - Checklist of the most important security countermeasures when designing, testing, and releasing your API
CryptoDoneRight - CryptoDoneRight is a cryptographic knowledge base.
UnSAFE_Bank - Vulnerable Banking Suite
docco - Literate Programming can be Quick and Dirty.
see awesome-security - A collection of awesome software, libraries, documents, books, resources and cools stuffs about security.
css-loaders - A collection of loading spinners animated with CSS
labs - This is a collection of tutorials for learning how to use Docker with various tools. Contributions welcome.
pnotify - Beautiful JavaScript notifications with Web Notifications support.
SecureCodingDojo - The Secure Coding Dojo is a platform for delivering secure coding knowledge.
Less - Leaner CSS, in your browser or Ruby (via less.js).
Security_Engineer_Interview_Questions - Every Security Engineer Interview Question From Glassdoor.com