Medium

Suleyman Musayev

Suleyman Musayev

·

Oct 28

Rendering User-Supplied SVG Without Getting Burned

An SVG is not an image. It is a program the browser will run. If you let users upload avatars, logos, or icons, you are letting them upload…

Rendering User-Supplied SVG Without Getting Burned

Suleyman Musayev

·

Oct 21

Memory-Hard Password Hashing in Ruby: Balloon and yescrypt

Your password hash’s job is to be slow for an attacker and bearable for you. Against a modern GPU farm, being slow is not enough anymore…

Memory-Hard Password Hashing in Ruby: Balloon and yescrypt

Suleyman Musayev

·

Oct 14

The Attacker Doesn’t Need to Know Your Programming Language Anymore

LLMs did not make attackers smarter. They made them cheaper. What your front end has always told the world, and why reading it just got…

The Attacker Doesn’t Need to Know Your Programming Language Anymore

Suleyman Musayev

·

Oct 7

Adding OpenID Connect Login to Rails Without the Dependency Pile

“Sign in with…” looks like a solved problem until you open the box and find five HTTP clients and a transitive dependency graph the size of…

Adding OpenID Connect Login to Rails Without the Dependency Pile

Suleyman Musayev

·

Sep 30

The Attacker Filed a Support Ticket

Some complaints are not feedback. They are an attack on the people who can switch your defenses off. How attackers work on support…

The Attacker Filed a Support Ticket

Suleyman Musayev

·

Sep 23

Rendering User-Supplied SVG Without Getting Burned

An SVG is not an image. It is a program the browser will run. If you let users upload avatars, logos, or icons, you are letting them upload…

Rendering User-Supplied SVG Without Getting Burned

Suleyman Musayev

·

Sep 16

Post-Quantum Cryptography Is Here: What FIPS 203, 204, and 205 Mean for Engineers

In 2024 the post-quantum standards stopped being a research topic and became official. You do not need a physics degree to know what to do…

Post-Quantum Cryptography Is Here: What FIPS 203, 204, and 205 Mean for Engineers

Suleyman Musayev

·

Sep 9

Bringing a Post-Quantum Signature into Ruby

NIST finalized ML-DSA in 2024 as the post-quantum replacement for the signatures we have trusted for decades. If you write Ruby, how do you…

Bringing a Post-Quantum Signature into Ruby

Suleyman Musayev

·

Sep 2

300 Fake Signups a Day, and the CAPTCHA Was Losing

Bots do not solve CAPTCHAs anymore. People do. What it takes to defend a signup flow when the attacker’s economics beat yours.

300 Fake Signups a Day, and the CAPTCHA Was Losing

Suleyman Musayev

·

Aug 26

Post-Quantum Keys Don’t Need OpenSSL

A post-quantum key exists to outlive classical cryptography. So why does saving one to disk route through the biggest classical crypto…

Post-Quantum Keys Don’t Need OpenSSL

Suleyman Musayev

Suleyman Musayev

Software engineer, scalable and distributes systems, fraud & abuse, bot defense, insider threat detection, account security https://msuliq.github.io/

Help

Status

About

Careers

Press

Blog

Store

Privacy

Rules

Terms

Text to speech