Security on billpg industries™

I Wrote a NuGet Package!

Sat, 05 Sep 2026 14:41:07 +0000

I’ve been working a little in the world of HTTP Authentication. When you connect a system to another system, there’s usually a set of tokens that get passed around and managed and sometimes accidentally pushed to a public git repo.

When you try to connect to a website that requires a user login, you’ll be sent back a 401 response with a WWW-Authenticate: header. Except you won’t. You’ll be sent a 302 redirect to a login page.

Rufus - An Adventure in Downloading

Mon, 20 Oct 2025 07:17:17 +0000

I needed to make a bootable USB. Simple task, right? My aging Windows 10 machine couldn’t upgrade to 11 and Ubuntu seemed like the obvious next step.

Downloading Rufus, the tiny tool everyone recommends, turned out to be less of a utility and more of a trust exercise. Between misleading ads, ambiguous signatures and the creeping dread of running an EXE as administrator, I found myself wondering how something so basic became so fraught?

I want a less powerful programming language for Christmas.

Wed, 12 Feb 2025 21:44:24 +0000

I’m writing this because I’m hoping someone will respond, telling me that what I want already exists. I have a specific itch and my suspicion is that developing a whole programming language and runtime is the only way to scratch that itch.

Please tell me I’m wrong.

Dear Father Christmas…

If you’ve ever written a web service, you’ve almost certainly had situations where you’ve taken a bunch of bytes from a completely untrusted stranger and passed those bytes into a JSON parser. What’s more you’ll have done that without validating the bytes first.

NEVER sanitize your inputs!

Sun, 08 Sep 2013 20:18:00 +0000

I’ve seen this cartoon being linked-to in so many comment threads and forums. Anytime its even a little bit applicable, someone will post a link to this cartoon. It has become so pervasive that if you search Google for “327”, it’ll be the third link returned, right after the Wikipedia pages for the year and the car. Search “328” and the next XKCD is no-where to be seen. The lesson, according to this character and so many real people on the internet, is to sanitize your inputs. The school in the cartoon didn’t sanitize its inputs - and one of its database tables got deleted! Ask anyone about developing websites and they will tell you the first lesson is always to sanitize your inputs. In this day and age you’d have to be crazy not to sanitize your inputs. Trouble is, sanitizing your inputs is very bad advice.