Let's give some stuff away
As an effort to promote application security awareness in the CFML community, I am going to do a little bit of giving things away. Specifically, I am going to be giving away some security related items.
As many of you know, I am very interested in Application Security. I am always trying to learn more about it and encourage others to learn more. Application Security is becoming more and more important even for our simple applications.
So to help encourage learning about application security, I am going to give away some of these security related learning materials to the good people of the CFML community who provide substantive comments on my blog.
I will choose pseudo-randomly from the good comments that show up on my blog.
Comments must be substantive. Things like "Nice Post!" and "I agree" are fine if that is what you want to say, but they will not be chosen from. I want this to promote discussion, and I want to learn from others who would either add to my posts with knowledge of their own, or to disagree and offer their own insight.
Remember, I will be choosing from the comments, so multiple comments means multiple entries. I will also include my subscribers. So simply by subscribing you will get another entry.
I will start this off by giving away three of these items for comments posted in June and see how it goes. That's one item to three people, not three items to one person. I will notify the recipients by email, so be sure to use a valid email address.
Ajax Security![]() |
Professional Pen Testing for Web Applications ![]() |
Foundations of Security ![]() |
Web Application Hackers Handbook ![]() |











Looking forward to the series, Jason.
Oh, and if nothing else, the t-shirt will help you feel more secure in the fact that you are not naked at work.
Thanks for continually reminding us about Web application security, a truly important topic that doesn't get enough press coverage in blogs.
I also appreciate you digging deep to make giveaways happen for your constituents.
DW
@Chris, You always win when you think about security . How's that? Feeling fulfilled? ;)
@Dan, thanks for the kind (and big) words.
thanks for the comment. I have that article sitting open in a browser at home waiting for me to read it. We only recently started doing App scanning where I work, and when I looked at the report it, at first seemed overwhelming, but then as I got used to looking at the report, i realized that a lot of the problems were the same problem in different places, and a lot of them were easy fixes or false positives.
Outside of the no-brainers (SQL Injection, XSS)I don't know that I would pick any one kind of vulnerability to start with, but I would start with either the most serious and/or the lowest hanging fruit (easiest to fix).
When I read the article, I may post my thoughts and expand on that.