"when i set off to do this work in early november i expected i was going to have to deal with anti-csrf tokens, double-submit cookies and hidden form fields, pretty much the traditional elements that we have used to build a defense against csrf for years. and i did start along this tedious route. but then i bumped into a new way some people are dealing with csrf attacks that is way simpler, which i describe below..."

"uncover 25 hard-hitting lessons from a 17-year cybersecurity career that can reshape your approach to the industry and career..."

"in summary, there are three common ways that a browser uses to determine the character encoding of an html document, ordered by priority..."

"a proliferation of vendors, underclear ownership of services and assets, and the difficulty of successfully communicating and explaining security risks exacerbate other security problems..."

"cross-origin resource sharing (cors) is a specification that enables truly open access across domain-boundaries. if you serve public content, please consider using cors to open it up for universal javascript/browser access..."

"dns was not designed with security in mind, and there are many types of attacks created to exploit vulnerabilities in the dns system..."

"dnssec authenticates dns using digital signatures based on public key cryptography. with dnssec, it's not dns queries or response that are signed but rather the dns data itself is signed by the owner of the data..."

"the internet engineering task force (ietf), which is responsible for standardizing the dns protocol, has been working steadily to improve the security and stability of dns. one key enhancement is the dns security extensions (dnssec) suite of features that adds authentication and validation in dns using digital signatures..."

"dns security is like air traffic control for the internet. it manages the flow of data to ensure safe and correct routing, just like planes in crowded airspace..."

"whether we like it or not, the entire internet is continuously scanned by bots looking for vulnerabilities, and, as soon as your website is even mildly popular, you will get even more attack attempts from criminals and bored hackers..."