<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" xmlns:content="http://purl.org/rss/1.0/modules/content/"
    xmlns:wfw="http://wellformedweb.org/CommentAPI/"
    xmlns:dc="http://purl.org/dc/elements/1.1/"
    xmlns:atom="http://www.w3.org/2005/Atom"
    xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
    xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
    >
<channel>
    <title>Comments for SANS Application Security Street Fighter</title>
    <atom:link href="http://software-security.sans.org/blog/comments/feed" rel="self" type="application/rss+xml" />
    <link>http://software-security.sans.org/blog</link>
    <description>SANS Application Security Street Fighter Blog</description>
    <lastBuildDate>Mon, 20 May 2013 12:23:09 +0000</lastBuildDate>
    <language>en</language><item><title>Comment on Agile Development Teams CAN build secure software by Fuat Yazar</title><link>http://software-security.sans.org/blog/2012/02/22/agile-development-teams-can-build-secure-software/comment-page-1/#comment-9423</link><dc:creator>Fuat Yazar</dc:creator><pubDate>Thu, 18 Apr 2013 05:38:42 +0000</pubDate><description><![CDATA[Great article, thanks a lot.]]></description><content:encoded><![CDATA[Great article, thanks a lot.]]></content:encoded></item><item><title>Comment on What's in Your iOS Image Cache? by Karen</title><link>http://software-security.sans.org/blog/2011/01/14/whats-in-your-ios-image-cache-backgrounding-snapshot/comment-page-1/#comment-9418</link><dc:creator>Karen</dc:creator><pubDate>Mon, 15 Apr 2013 18:04:27 +0000</pubDate><description><![CDATA[Very interesting. Starting from your post, I tried Decipher Backup Browser (http://deciphertools.com) to look at some of the backups from my iPhones and iPads on my computer. Sure enough, in Home -&amp;gt; Library -&amp;gt; Caches there is data from Safari with thumbnails of the open webpages, but I didn't see any other screenshots cached in the backup.Then again, the program also showed the Safari browsing history :) but the screenshots would be bad as well if they had more sensitive data filled in on them.]]></description><content:encoded><![CDATA[Very interesting. Starting from your post, I tried Decipher Backup Browser (http://deciphertools.com) to look at some of the backups from my iPhones and iPads on my computer. Sure enough, in Home -&amp;gt; Library -&amp;gt; Caches there is data from Safari with thumbnails of the open webpages, but I didn't see any other screenshots cached in the backup.Then again, the program also showed the Safari browsing history :) but the screenshots would be bad as well if they had more sensitive data filled in on them.]]></content:encoded></item><item><title>Comment on What's in Your iOS Image Cache? by Karen</title><link>http://software-security.sans.org/blog/2011/01/14/whats-in-your-ios-image-cache-backgrounding-snapshot/comment-page-1/#comment-9418</link><dc:creator>Karen</dc:creator><pubDate>Mon, 15 Apr 2013 18:04:27 +0000</pubDate><description><![CDATA[Very interesting. Starting from your post, I tried Decipher Backup Browser (http://deciphertools.com) to look at some of the backups from my iPhones and iPads on my computer. Sure enough, in Home -&amp;gt; Library -&amp;gt; Caches there is data from Safari with thumbnails of the open webpages, but I didn't see any other screenshots cached in the backup.Then again, the program also showed the Safari browsing history :) but the screenshots would be bad as well if they had more sensitive data filled in on them.]]></description><content:encoded><![CDATA[Very interesting. Starting from your post, I tried Decipher Backup Browser (http://deciphertools.com) to look at some of the backups from my iPhones and iPads on my computer. Sure enough, in Home -&amp;gt; Library -&amp;gt; Caches there is data from Safari with thumbnails of the open webpages, but I didn't see any other screenshots cached in the backup.Then again, the program also showed the Safari browsing history :) but the screenshots would be bad as well if they had more sensitive data filled in on them.]]></content:encoded></item><item><title>Comment on Session Attacks and ASP.NET - Part 1 by ericjohnson</title><link>http://software-security.sans.org/blog/2009/06/14/session-attacks-and-aspnet-part-1/comment-page-1/#comment-9408</link><dc:creator>ericjohnson</dc:creator><pubDate>Thu, 04 Apr 2013 16:13:55 +0000</pubDate><description><![CDATA[Lelala,Newer applications written in the ASP .NET framework typically use forms authentication coupled with the membership provider and role provider to manage authentication and authorization. These features allow developers to leverage a number of built in .NET controls (login, user registration, change password, forgot password, etc.) and manage much of the access control via configuration files.If you have Visual Studio, try creating a new web application project. It will generate a project pre-configured to use forms authentication along with the membership and role providers. The web.config file will contain a number of elements related to these providers: authentication, membership, and roleManager. Additionally, the Account directory will contain a Login.aspx file that manages the authentication for the application.If you'd like to set this up manually, there is a good article on MSDN that explains each piece step by step: http://msdn.microsoft.com/en-us/library/ff649314.aspx.]]></description><content:encoded><![CDATA[Lelala,Newer applications written in the ASP .NET framework typically use forms authentication coupled with the membership provider and role provider to manage authentication and authorization. These features allow developers to leverage a number of built in .NET controls (login, user registration, change password, forgot password, etc.) and manage much of the access control via configuration files.If you have Visual Studio, try creating a new web application project. It will generate a project pre-configured to use forms authentication along with the membership and role providers. The web.config file will contain a number of elements related to these providers: authentication, membership, and roleManager. Additionally, the Account directory will contain a Login.aspx file that manages the authentication for the application.If you'd like to set this up manually, there is a good article on MSDN that explains each piece step by step: http://msdn.microsoft.com/en-us/library/ff649314.aspx.]]></content:encoded></item><item><title>Comment on Session Attacks and ASP.NET - Part 1 by ericjohnson</title><link>http://software-security.sans.org/blog/2009/06/14/session-attacks-and-aspnet-part-1/comment-page-1/#comment-9408</link><dc:creator>ericjohnson</dc:creator><pubDate>Thu, 04 Apr 2013 16:13:55 +0000</pubDate><description><![CDATA[Lelala,Newer applications written in the ASP .NET framework typically use forms authentication coupled with the membership provider and role provider to manage authentication and authorization. These features allow developers to leverage a number of built in .NET controls (login, user registration, change password, forgot password, etc.) and manage much of the access control via configuration files.If you have Visual Studio, try creating a new web application project. It will generate a project pre-configured to use forms authentication along with the membership and role providers. The web.config file will contain a number of elements related to these providers: authentication, membership, and roleManager. Additionally, the Account directory will contain a Login.aspx file that manages the authentication for the application.If you'd like to set this up manually, there is a good article on MSDN that explains each piece step by step: http://msdn.microsoft.com/en-us/library/ff649314.aspx.]]></description><content:encoded><![CDATA[Lelala,Newer applications written in the ASP .NET framework typically use forms authentication coupled with the membership provider and role provider to manage authentication and authorization. These features allow developers to leverage a number of built in .NET controls (login, user registration, change password, forgot password, etc.) and manage much of the access control via configuration files.If you have Visual Studio, try creating a new web application project. It will generate a project pre-configured to use forms authentication along with the membership and role providers. The web.config file will contain a number of elements related to these providers: authentication, membership, and roleManager. Additionally, the Account directory will contain a Login.aspx file that manages the authentication for the application.If you'd like to set this up manually, there is a good article on MSDN that explains each piece step by step: http://msdn.microsoft.com/en-us/library/ff649314.aspx.]]></content:encoded></item><item><title>Comment on Session Attacks and ASP.NET - Part 1 by Lelala</title><link>http://software-security.sans.org/blog/2009/06/14/session-attacks-and-aspnet-part-1/comment-page-1/#comment-9402</link><dc:creator>Lelala</dc:creator><pubDate>Tue, 19 Mar 2013 18:16:15 +0000</pubDate><description><![CDATA[What i do not understand, is:For years, ASP devs have used session to deploy a simple logon-yes-no? functionality, say: on the first request, you get the cookie, then, for this cookie put in sessionState something like &quot;LogOnDone&quot; - and on every page load, you just check for the existance of this &quot;flag&quot; like:&quot;if( Session[&quot;LogOnDone&quot;] != null) DoSomething()&quot;So, now with that new stuff, what is the typical way of doing that?Regards]]></description><content:encoded><![CDATA[What i do not understand, is:For years, ASP devs have used session to deploy a simple logon-yes-no? functionality, say: on the first request, you get the cookie, then, for this cookie put in sessionState something like &quot;LogOnDone&quot; - and on every page load, you just check for the existance of this &quot;flag&quot; like:&quot;if( Session[&quot;LogOnDone&quot;] != null) DoSomething()&quot;So, now with that new stuff, what is the typical way of doing that?Regards]]></content:encoded></item><item><title>Comment on Session Attacks and ASP.NET - Part 1 by Lelala</title><link>http://software-security.sans.org/blog/2009/06/14/session-attacks-and-aspnet-part-1/comment-page-1/#comment-9402</link><dc:creator>Lelala</dc:creator><pubDate>Tue, 19 Mar 2013 18:16:15 +0000</pubDate><description><![CDATA[What i do not understand, is:For years, ASP devs have used session to deploy a simple logon-yes-no? functionality, say: on the first request, you get the cookie, then, for this cookie put in sessionState something like &quot;LogOnDone&quot; - and on every page load, you just check for the existance of this &quot;flag&quot; like:&quot;if( Session[&quot;LogOnDone&quot;] != null) DoSomething()&quot;So, now with that new stuff, what is the typical way of doing that?Regards]]></description><content:encoded><![CDATA[What i do not understand, is:For years, ASP devs have used session to deploy a simple logon-yes-no? functionality, say: on the first request, you get the cookie, then, for this cookie put in sessionState something like &quot;LogOnDone&quot; - and on every page load, you just check for the existance of this &quot;flag&quot; like:&quot;if( Session[&quot;LogOnDone&quot;] != null) DoSomething()&quot;So, now with that new stuff, what is the typical way of doing that?Regards]]></content:encoded></item><item><title>Comment on Software Security starts with Software Quality by Wibo ten Have</title><link>http://software-security.sans.org/blog/2012/01/25/software-security-starts-with-software-quality/comment-page-1/#comment-9393</link><dc:creator>Wibo ten Have</dc:creator><pubDate>Mon, 11 Feb 2013 13:12:49 +0000</pubDate><description><![CDATA[Great blog. It coincides with my experience with our customers. Acknowledging &quot;improvable&quot; code quality usually comes when problems arise: lead times, cost, security risks, applications failing. It is good for our business but it would be better to make source code quality and improving it at least a recurring project (or better still: part of every release).]]></description><content:encoded><![CDATA[Great blog. It coincides with my experience with our customers. Acknowledging &quot;improvable&quot; code quality usually comes when problems arise: lead times, cost, security risks, applications failing. It is good for our business but it would be better to make source code quality and improving it at least a recurring project (or better still: part of every release).]]></content:encoded></item><item><title>Comment on Security Testing: Less, but More Often can make a Big Difference by AndreG</title><link>http://software-security.sans.org/blog/2013/01/14/security-testing-less-but-more-often-can-make-a-big-difference/comment-page-1/#comment-9388</link><dc:creator>AndreG</dc:creator><pubDate>Thu, 31 Jan 2013 21:13:48 +0000</pubDate><description><![CDATA[The title of this article made me think of another important topic: how to test what, how, and when.Organizations that have an app portfolio (which may consist of some in-house as well as externally developed projects, apps, libraries, frameworks, et al) will want to try to (at least at first) assess all of their software at once, i.e. a]]></description><content:encoded><![CDATA[The title of this article made me think of another important topic: how to test what, how, and when.Organizations that have an app portfolio (which may consist of some in-house as well as externally developed projects, apps, libraries, frameworks, et al) will want to try to (at least at first) assess all of their software at once, i.e. a]]></content:encoded></item><item><title>Comment on Security Testing: Less, but More Often can make a Big Difference by AndreG</title><link>http://software-security.sans.org/blog/2013/01/14/security-testing-less-but-more-often-can-make-a-big-difference/comment-page-1/#comment-9388</link><dc:creator>AndreG</dc:creator><pubDate>Thu, 31 Jan 2013 21:13:48 +0000</pubDate><description><![CDATA[The title of this article made me think of another important topic: how to test what, how, and when.Organizations that have an app portfolio (which may consist of some in-house as well as externally developed projects, apps, libraries, frameworks, et al) will want to try to (at least at first) assess all of their software at once, i.e. a]]></description><content:encoded><![CDATA[The title of this article made me think of another important topic: how to test what, how, and when.Organizations that have an app portfolio (which may consist of some in-house as well as externally developed projects, apps, libraries, frameworks, et al) will want to try to (at least at first) assess all of their software at once, i.e. a]]></content:encoded></item></channel></rss>