错综复杂的 Web
The tangled Web
Michal Zalewski · 初版 2011 年
32人推荐
38位读者提及
50次提及
为什么值得读
- 作者在安全界享有盛誉且技术底蕴深厚
- 深入揭示各类Web技术交织下的脆弱本质
- 点出应用开发中容易踩坑的诸多安全隐患
“‘来自浏览器安全领域顶尖专家的详尽全面剖析。’——Tavis Ormandy，Google Inc.。现代 Web 应用程序建立在一团随着时间推移演进并随意拼凑起来的技术乱麻之上。从 HTTP 请求到浏览器端脚本，Web 应用技术栈的每一个环节都伴随着重大而微妙的安全隐患。为了确保用户安全，开发者必须能够从容应对这一复杂局面。在 The Tangled Web 一书中，全球顶尖的浏览器安全专家之一 Michal Zalewski 提供了引人入胜的叙述...
Hacker News 上怎么说
正在加载完整评论……
……这本能带你走到的高度，基本是任何书所能及的极限了；再往后你就需要实操，并去读比如 Project Zero 团队的技术复盘和 HackerOne 的互联网 Bug Bounty 报告了。5. 《The Tangled Web》——Google 安全总监兼 afl-fuzz 作者 Michal Zalewski 著。这本书非常适合搭配《The Web Application Hacker's Handbook》一起读。不像这里列出的大多数其他书……
…one will take you about as far as any book reasonably can; beyond that you'll need to practice and read walkthroughs from e.g. The Project Zero team and HackerOne Internet Bug Bounty reports. 5. The Tangled Web - Written by Michal Zalewski, Director of Security at Google and author of afl-fuzz. This is the book to read alongside The Web Application Hacker's Handbook. Unlike many of the other books listed here…
如果你不知道他是谁，他写过一本我最喜欢的 Web（浏览器）安全方面的书：《The Tangled Web》[1]。他另一本相对冷门的书也值得一读：《Silence on the Wire》，探讨了从你敲击的键盘到数据传输的线缆整个信息安全技术栈，……
If you don't know who this is, he wrote one of my favourite books on web (browser) security: "The Tangled Web" [1]. Another lesser known book by him is also worth a read: "Silence on the Wire" that takes a look at the full information security stack from the keyboard you type on, to the wires the data transits,…
有意思的想法。试图让那些考虑卖 exploit 的人转而从 Google 这边赚点钱。Michal Zalewski（lcamtuf）在安全界备受推崇——《The Tangled Web》和《Silence on the Wire》都是绝佳读物。如果这没在不久的将来挖出几个新的 BIND 和 ISC DHCPD bug，那才真叫奇怪呢。
Interesting idea. Try get people who are considering selling exploits to get a little money from Google instead. Michal Zalewski (lcamtuf) is highly respected in the security world - The Tangled Web and Silence on the Wire are excellent reads. It would be very surprising if this didn't lead to a few new BIND and ISC DHCPD bugs coming out in the near future.
……互联网最终不得不承担远超其最初设计负荷的东西。互联网泡沫为它成为我们生活中不可或缺的一部分铺平了道路。Michal Zalewski 的《The Tangled Web》是一本优秀的专业技术书，讲的是支撑 Web 的技术是如何交织在一起的，以及它们全都是一堆脆弱、七拼八凑的 hack 产物。表面上看，一切运转顺畅，……
…Internet simply ended up having to swallow far more than it was designed to handle. The dot-com boom paved the way for it becoming essential and inseparable to our livelihoods. Michal Zalewski's The Tangled Web is an excellent technical book on how the technologies that power the web are interconnected, and how they're all a vulnerable mess of hacks. On the surface, it looks like everything is running smoothly,…
又一个 Web 应用程序的奇葩破事。我从 Michal Zalewski 的力作《The Tangled Web》里学到的最核心一点就是：希望我这辈子都不用去写 Web 应用。坑实在是太多了。
More web app madness. The main lesson I took from Michal Zalewski's excellent book "The Tangled Web" was I hope I never have to write a web application. There are far too many traps.
我很喜欢 WAHH。受不了《Deadly Sins》。我会把它换成 Zalewski 的 Web 安全新书《The Tangled Web》；把 WAHH 和《The Tangled Web》吃透，掌握的知识量就相当可观了。
I love WAHH. I can't stand "Deadly Sins". I'd replace it with _The Tangled Web_, Zalewski's new web security book; WAHH and _Tangled_ is a formidable amount of knowledge to keep on tap.