143 articles
A password alone protects an account only as long as the password remains secret. Reused passwords leak in one breach and are tried elsewhere. Time-based one-time password (TOTP) adds "something you have" to "something …
Read article
A small PHP application eventually needs a database password, an API token, or a key for signing messages. Where should that value live? Putting it directly in…
A home server can display the right hour and still have an unreliable clock. The timezone may be correct while network synchronization is failing. A time servi…
A home server can survive a brief power cut only if something keeps supplying power. But survival is not the most useful question. A better one is: can the mac…
A PHP page fails halfway through a request. What should the visitor receive, and what should the operator keep? Those are related questions, but they should no…
A scheduled job finishes without an error, a new archive appears on another disk, and its checksum matches. Is the database now recoverable? Those are useful s…
A settings form can require a valid login and still accept a request the user never meant to send. The session cookie tells the server which browser session is…
A form accepts a name correctly, PHP prints it correctly in a debug message, and MariaDB stores something that still looks plausible. Later, the page shows rep…
An application release can be rolled back by checking out an earlier commit. A database is less cooperative: it contains state accumulated while the applicatio…
A login form can verify the right password and still leave the account resting on a weak session. The difficult part begins after authentication: how does the …
