145 reputation
5
bio website blog.rodger-brown.com
location United Kingdom
age
visits member for 3 years, 10 months
seen yesterday

Ex-developer, CTO of various companies and now co-founder of YunoJuno, helping to build a community of the very best freelancer developers, designers, UX and associated digital talents.


1d
asked Heartbleed - what information is leaked by Nginx?
Mar
18
awarded  Supporter
Mar
18
accepted How can I use environment variables in Nginx.conf
Mar
18
comment How can I use environment variables in Nginx.conf
Yup - current (working) solution is exactly this. Just seems a bit hacky. (That said, it's only a local dev environment, so hacking isn't a huge problem.)
Feb
28
awarded  Tumbleweed
Feb
21
revised How can I use environment variables in Nginx.conf
More details supplied
Feb
21
revised How can I use environment variables in Nginx.conf
Added in the full conf file.
Feb
21
asked How can I use environment variables in Nginx.conf
Sep
15
awarded  Scholar
Sep
15
accepted Enabling xp_cmdshell in a production environment
Sep
15
comment Enabling xp_cmdshell in a production environment
I'm going to close this as there's some useful comment, but one thing I would like to understand is when a best practice becomes dogma, rather than common sense. Yes, enabling xp_cmdshell is clearly a security issue, but in our scenario, we have the following as standard: multiple firewalls between public internet and database, managed IPS / IDS systems, regular security audits, dedicated AD account used to run the procedure that would use xp_cmdshell, with access to just that procedure and the relevant ACLs. We store no financial data. Is it still that bad? Just asking ;-)
Sep
15
asked Enabling xp_cmdshell in a production environment
Sep
1
awarded  Editor
Sep
1
revised How do I secure a .NET (MVC) website prior to launch?
Updated with a more concise description of the problem.
Sep
1
comment How do I secure a .NET (MVC) website prior to launch?
Actually - this doesn't work - as it now logs the user into the site as the Windows user - which doesn't now make any sense. I can now express my problem a bit better though: I want Windows authentication to control access to the site, and ASP.NET authentication to control a user's interaction with the website (whether they appear logged in, access to secure areas - my account etc.)
Sep
1
answered How do I secure a .NET (MVC) website prior to launch?
Aug
31
comment How do I secure a .NET (MVC) website prior to launch?
Co-lo. The developers have VPN access, but the test group are just regular office people - and we can't install the VPN software on their machines. In addition, certain people will want access when out of the office (for demonstration purposes), so IP-restrictions won't work.
Aug
29
revised How do I secure a .NET (MVC) website prior to launch?
Added new tag (basic-authentication)
Aug
28
comment How do I secure a .NET (MVC) website prior to launch?
I don't think there is either - it's just so weird that there's no way to disconnect IIS from ASP.NET - this cannot be an unusual use case? The requirement is so simple - and I do NOT want to have to start mucking around with live configuration files just to achieve this.
Aug
28
awarded  Student