Back to top

Knaddisons

All of the Knaddisons in the world

Earth Treks Englewood - The Largest Indoor Climbing Gym?

In April of 2017 the old Sports Authority headquarters in Englewood was sold for $15.7 million but at that point it wasn't well known who the purchaser was and who would inhabit the space. It turns out Earth Treks is one of the major inhabitants of the space and they had a big plan for the building. The Earth Treks climbing gym will open an Englewood location.

Category: 
People Involved: 
Location: 

Cross Site Request Forgery in Tumblr "Ask a Question" feature

This might be the first nerd-blog post in a long time, so my apologies if I startle anyone. As a quick update, I wrote a book on security in Drupal and then founded a company focused on Drupal security services and then sold that company to Acquia where I currently work.

So....Tumblr is a big deal. They apparently have 120million users and are totally awesome.

I was trying Tumblr out for a site and noticed that many of their interactions relied 100% on Javascript for a "delete/cancel" confirmation. I fired up my handy-dandy browser tools and inspected the http headers associated witih deleting a message. Turns out that it's vulnerable to a cross-site-request-forgery. In general Tumblr uses the token-synchronizer csrf prevention (as documented on OWASP). I'm not necessarily saying they copiedOWASP or were inspired, just that it follows the pattern of using a second form token that is sent on all requests for a session. They do not use a different token per form/action: once you get the anti-CSRF-nonce it's the same for multiple different operations. Their token is called the form_key.

Want to see the problem in action? I even made this handy dandy movie of the problem:

Category: 
People Involved: 

Lost: The Drinking Game

We started watching the tv-show lost a while ago on netflix streaming. This is great because we can watch episodes back to back which gets rid of the anxiety over what will happen "next week."

We found a few occurrences that were uncommon enough that they could be used as a pretty decent game.

People Involved: 
timeline: 
Location: 

Tomato Basil Sauce

Ingredients and Instructions for Tomato Basil Sauce

  • 1/4 cup extra virgin olive oil
  • 1 small yellow onion, diced
  • 3-4 garlic cloves, peeled and thinly sliced
  • 1/4 cup finely diced or shredded carrot
  • 2 cans San Marzano tomatoes (56 ounces)
  • kosher salt to taste
  • small handful basil leaves, torn in pieces
Category: 
People Involved: 

Triple Reduction Red Wine Sauce

Get your triple reduction on! We learned this sauce at a cooking school and love making it as a special treat. We rarely cook steaks but this sauce best accompanies grilled red meat. The chefs in the class made the point that you should never cook with wine you wouldn't drink. Since this sauce essentially concentrates all the flavors from a bottle of wine, it makes sense to choose a low-cost but tasty red wine. Malbec, anyone?

Category: 
People Involved: 

Pumpkin Pie and Hazlenuts

Ingredients for Hazelnut Pumpkin Pie

  • 2/3 cups flour
  • pinch salt
  • 1 tbsp. sugar
  • 6 tbsp butter
  • 1.5 tbsp ice water
  • 1/3 cup ground hazelnuts
  • 1/3 cup brown sugar
  • 2 tbsp soft butter
  • 2 eggs, 1 egg yolk
  • 1 cup unsweetened canned pumpkin
  • 1 tbsp flour
  • 2/3 cup brown sugar
  • 1/4 tsp cinnamon
  • 1/4 tsp cloves
  • 1/2 tsp salt
  • 1 cup heavy cream

Preparation instructions for pie crust

Category: 
People Involved: 

Pages

Subscribe to RSS - Knaddisons