immontilla

Looking for information about Red, Blue and Purple teams, I found out an interesting article written by Daniel Miessler titled The Difference Between Red, Blue, and Purple Teams. There, the author extraordinarily condensed into a single image all the INFOSEC color meanings. Originally posted

Splunk is a platform that let us look into huge sets of data generated by several sources. The official image is available at https://hub.docker.com/r/splunk/splunk/. This is a ready-to-use docker-compose file to deploy Splunk wherever you want. version: '3'

I wanted to watch off-line some Adobe Connect recordings in my commuting time. Googling about it, I found out that you can download any Adobe Connect recording just by appending output/filename.zip?download=zip to its url. The resulting zip file is just

I have switched my machine from Linux Mint to Debian Stretch keeping my beloved Cinnamon as desktop environment. The process itself, was not a big deal. However, I did some additional tasks to suit my taste. Scenario First of all, I am going to

In this post, I will show you how to code in Go & mongoDB a small API using a couple of Go tool-kits: Goji and mgo. As usual, find the code at Github: https://github.com/immontilla/mgo-n-goji.git. Before to start, in case

A new security header has been added to the https://securityheaders.com/ checking service, the Feature Policy header. The Feature Policy is a new header that allows a site to control which features and APIs can be used in the browser. In my case,

Originally read at "The Business Blockchain", a William Mougayar book... When the wind of change blows, some people build walls, others build windmills.

I'm starting to delve into blockchain from my developer point of view. Maybe the following warning is not absolutely necessary but just in case: This post is not about cryptocurrencies, it is about the Hyperledger Composer. According to the Wikipedia, Hyperledger is an umbrella

I upgraded my Spring Boot projects on Github from the 1.5.x version to the newest 2.0 over the weekend. These are my experiences: immontilla/file-uploading-web-app webjars-locator dependency missing I had to change the dependency org.webjar.webjars-locator to org.webjar.webjars-locator-core.

I have found an artistic, fun and original article about HTTP codes published at Medium by Hani Lim. I am going to share its images here.

Even bad code can function Taken from Clean Code: A Handbook of Agile Software Craftsmanship by Robert C. Martin

There may be cases where you do not want to store a container’s data on the host machine, but you also don’t want to write the data into the container’s writable layer, for performance or security reasons. Use tmpfs mounts https:

Automated Builds have several advantages: Images built in this way are built exactly as specified. The Dockerfile is available to anyone with access to your Docker Hub repository. Your repository is kept up-to-date with code changes automatically. -- Configure automated builds on Docker Hub

Last week, I pushed docker-mitreid-oidc-server at Docker Hub. It has been pulled 50 times so far. I have received some comments demanding me to fix the simple-web-app log-in bug, and also, customize the Tomcat server default page with links to the MITREid OpenID Connect

MITREid Connect is an open source certified OpenID Connect Server implemented in Java on the Spring platform. It can be used as an OpenID Connect Identity Provider as well as a general-purpose OAuth 2.0 Authorization Server. To developers, MITREid Connect gives us a

Running a secure file uploading web app in a Docker container not only let you scale vertically its functionality, it is also a way to make it more secure. How so? Well, in the worst scenario, the web app fails and a malicious file

I had some problems renewing my SSL certificate automatically again. However, this time it was not related to an automatic HTTP to HTTPS redirection as I posted before. This time it was because my blog is not a static website. Sounds so weird, but

There is a new player around named wedeploy. This is a simple example to show how you can use it. Let's build a Spring Boot Java REST project to publish some Chuck Norris IT facts. mkdir wedeploy-norrisws && cd wedeploy-norrisws && curl

When a "Not enough free disk space on /boot" message comes up and a "sudo apt-get autoremove" does nothing, there is another way to fix this issue. To solve this problem you need to know: Which Linux kernel version your

In my previous post, I shared a template to run a Spring Boot server in a https self-signed secured connection. However, that template is only valid to serve static content and this is not what I really wanted. In this post, using a gradle

Tomcat SSL/TLS configuration is a non-difficult task to do in Spring Boot. You just need to generate a self-signed certificate and add its references in the src/main/resources/application.properties file. Note This template is valid only to serve static content. If

Uploaded files represent a significant risk to applications. The first step in many attacks is to get some code to the system to be attacked. Then the attack only needs to find a way to get the code executed. Using a file upload helps

In theory, there is no difference between practice and theory. In practice, there is. Update What I wrote here is no longer necessary. There is a new fix to apply. Read it here. In theory, you just need to add /usr/local/sbin/certbot-auto

Recently, I had to consume a SOAP web service via SSH using curl because a direct connection between my laptop and the web service endpoint was not allowed. In this post, I am going to show you how to invoke a public SOAP web

Invoking a HTTPS protected web service with CURL using the flag --insecure is a contradiction, --cacert is the right flag. To show you how to do it right, I have chose a simple web search to Google via HTTPS as an example. Of course,