Infosec on galvanist

Django SECRET_KEY generation

Wed, 13 May 2020 22:13:52 +0000

Generate django `SECRET_KEY`s on the command line using this “one-liner” (django not required)

Background

Django is a Python web framework with a lot of nice features including an exceptional ORM and high quality documentation. Most of my experience with django has been deploying and debugging other people’s projects - during the course of which I often want to regenerate the SECRET_KEY that underpins most of the security of every deployment.

The django settings docs describe the SECRET_KEY:

macOS JavaScript for Automation (JXA) Notes

Sat, 28 Mar 2020 18:28:48 +0100

Overview

There is a macOS feature called the Open Scripting Architecture (OSA) which provides an infrastructure for intercommunication and automation of macOS software. One of the officially supported OSA languages is JavaScript and its use in this context is called “JavaScript for Automation” which is often abbreviated to “JXA”.

The idea is that instead of using AppleScript, you can program & automate macOS using a more modern language like JavaScript. This gives the programmer access to the enormous ecosystem of javascript libraries and tools in addition to all the modern optimizations and language features of ES6-ish JavaScript. JXA also provides access to a built-in Objective-C bridge that enables access to the file system and the ability to call into the Cocoa frameworks and plain C functions. JXA can basically do anything native code can. It’s a bit like node without needing to install node.

Security Resources for Your New Website

Wed, 11 Mar 2020 23:32:43 +0100

Establishing a reasonable amount of security for a website is a non-trivial unending job. Here are some notes and resources that I find helpful.

Web Server Config

Start with TLS

All public-facing websites need to be protected by Transport Layer Security (TLS). TLS is a technology which allows web traffic to be encrypted and this encryption helps to protect the privacy and security of the users of a site.

Deploying a site with TLS can be accomplished in a free and automated fashion. Services like Let’s Encrypt and the issuance features of large cloud providers (for example AWS Certificate Manager) encourage more secure defaults and automatic management. For more information, check out the Let’s Encrypt Getting Started Guide or your hosting provider’s documentation.