Tagged #security

Every endpoint on your app is an open invitation to send requests. Most visitors send a few. Some scripts will send as many as your server can take. Rate limiting is just the rule that says "this many, this fast, and no more." It's one of those features nobody notices when it's there and everybody notices when it isn't. Here's what it protects you from. Brute force on your login page. Without a limit, an attacker can try password after password as fast as your server answers. Even with good password hashing, you don't want to give them unlimited attempts. Abuse of expensive actions. Sending a…

At some point a lot of people decide they're done letting an ad company read their inbox. Good instinct. Then they search "private email" and land in a pile of providers that all promise privacy in slightly different ways, and it's hard to tell what actually matters. So let's walk through the big names and, more importantly, what they can and can't do for you. First, a reality check about email Email was never built to be private. Every message has a sender, a recipient and a timestamp, and the servers involved need that information to deliver it. No provider can fully hide who you talk to…