The blog of Tinfoil Security, a hosted web application vulnerability scanning company, with guides on VPNs, Rails exploits and web security.
HN links its guide to setting up your own OpenVPN for public WiFi. One commenter says the scanner is good but the company seems inactive.
How many times do people need to talk about SQL injection before people writing web apps get it? This isn't news and this isn't hard to completely avoid. Just do it and stop being amazed every time someone puts a tick mark in an URL parameter (or any parameter for that matter).
EDIT: I looked around this detectify website and found this gem: http://blog.detectify.com/post/22258359654/zerg-rush-how-to-influence-google
"326 exploits found"
I have so much faith that this company will do well. If you're interested in others like it that might fair better, you can try WhiteHat Security or Tinfoil Security, both of which do web security scanning as a service.
https://www.whitehatsec.com/
https://www.tinfoilsecurity.com/
We've done some tests, and many of our customers would much rather have a basic scan and see the full results of the scan, than only be shown a piece of the scan. It gives off the impression that we're holding their vulnerabilities hostage, and that's definitely not what we hope to do!
The best test to see how we differ from Nessus/Burp is to try it yourself! A lot of the vulnerability classes we scan for are very similar, but the ways in which we scan for them are different. We do offer our Standard Plan for a free 30 day trial. Would love to hear what you think :)
If you have any issues, ping us at http://tinfoilsecurity.com/supportchat
This is something we help with a lot at Tinfoil (https://www.tinfoilsecurity.com). You can read our blog for useful tips and info, but we always recommend actually running our web application scans against your app in order to actually look for vulnerabilities. Is it as good as having 'tptacek or someone else from Matasano looking at it as a human? Not quite, since humans have more ingenuity. Is it better than reading a blog post and trying to follow 'best practices'? Infinitely.
Don't try to do it yourself.
There was a post on here yesterday about setting up your own ad hoc system https://www.tinfoilsecurity.com/blog/dont-get-pwned-on-public-wifi-use-your-own-vpn-tutorial-guide-how-to
I've also put together a listing of over 90 providers http://www.proxy.ie/blog/ultimate-vpn-list/ you should find one there ! Personally I've used Overplay, HideMyAss & IPVanish all to great success. HideMyAss have an offer until Sunday for $60 for a year's access which is quite good.
I've used https://www.tinfoilsecurity.com/vpn/new several times to quickly set up a new VPN on a DigitalOcean droplet. Takes ~5 minutes.
Lately I had it set one up for me and have just let it run constantly since then. I effectively have my own personal VPN for $5 month.
Such a product exists: https://www.tinfoilsecurity.com/ . It's pretty good and we pay $199/month. But they have not been active recently and the company may be dying without enough business to support them.