menu.sh
Ali Can Saykal — InfoSec & Stuff
I design the things that stop attackers. This is where the short thoughts land before they turn into anything.
changelog
- A threat model that does not fit in one sentence is not a threat modelideaIf you cannot say who you are defending against and what they want, the spreadsheet underneath is decoration.
- projectdiscovery/nucleirepoTemplate-driven scanning that other people can read, review and argue with. The YAML being boring is the point.
- An alert without an owner is a decorationideaDetection coverage is easy to buy and easy to measure. Someone whose week gets worse when the alert fires is neither.
- Choosing static was the security decisionideaThis site has no server, no database, no login and no third-party script. Most of its security work was done by deciding what not to build.
- Sandworm — Andy GreenbergbookThe best answer I have found to "why does any of this matter" for people outside security.
- gitleakstoolA pre-commit hook that has saved me more embarrassment than any scanner I have ever paid for.
- Moda seafront, KadıköyplaceWalk it at sunset with the phone in your pocket. Cheapest incident recovery available in Istanbul.
- Reflections on Trusting Trust — Ken ThompsonpaperForty years old and still the last word on supply chain. Read it once a year until it stops being comfortable.