random_compat

? Check out Halite: https://paragonie.com/project/halite Want to stop CSRF (including replay attacks)? https://github.com/paragonie/anti-csrf Want to quickly examine the differences between two PHP Archives (e.g. for reproducible builds)? https://github.com/paragonie/pharaoh We even wrote the community's accepted interface for generating cryptographically secure random numbers in PHP 5 projects: https://github.com/paragonie/random_compat And coming soon (pending an audit), a pure-PHP implementation of libsodium that will likely be adopted by WordPress so its automatic updates are Ed25519 secured: https://github.com/paragonie/sodium_compat And even more: https://paragonie.com/projects Guess how many clients we've gotten from all this open source software we wrote over the past two years that demonstrably improves the security posture of software written in PHP? Zero. My solution: Our next project isn't going to be OSS, and it's unlikely that any of our future ones will be unless it's intended to be a giveaway. The open source + consulting business model may sound good in theory, but it simply doesn't work. (Though, I will grant that it's possible that the "consulting about someone else's open source project" is more sustainable, due to near-zero investment in said project itself.)

com/security/advisories A sample of PHP projects I've developed or contributed to significantly: - random_compat - PHP 5 polyfill for the CSPRNG functions introduced in PHP 7; this security library has over 19 million installs according to Packagist - https://github.com/paragonie/random_compat - sodium_compat - A pure-PHP implementation of much of modern elliptic curve cryptography and (AEAD) symmetric encryption - https://github.com/paragonie/sodium_compat - CMS Airship - A secure-by-default content management system - https://paragonie.com/project/airship - CSP-Builder - A developer utility to promote the adoption of Content-Security-Policy headers - https://github.com/paragonie/csp-builder I can be reached via https://paragonie.com/contact or email: security@paragonie.com

ub.com/paragonie/constant_time_encoding - Constant-Time Encoding: A full implementation of RFC 4648 encoding/decoding functions that can be used to encode encryption keys for storage without leaking key material through cache-timing side-channels. * https://github.com/paragonie/csp-builder - CSP Builder: Build a Content-Security-Policy header for your website. Example config: https://github.com/paragonie/airship/blob/master/src/config/... Live demo: https://securityheaders.io/?q=https%3A%2F%2Fcspr.ng%2F * https://github.com/paragonie/airship - CMS Airship (beta software): A secure-by-default content management system and development framework that emphasizes secure package management and attempts to solve the Triangle of Secure Code Delivery: https://defuse.ca/triangle-of-secure-code-delivery.htm Other Technologies: * Excellent: PHP, Java, C#, Shell scripting * Experienced: HTML5/CSS3/JS, Node.js, C, C++, Python (with Django), Webserver configuration (Apache/nginx) * Currently learning: Ruby [on Rails] Feel free to contact me at security@paragonie.com if you're interested in working together.

n source community. Yet, until the most recent release, the documentation referred to a MCRYPT_CREATE_IV constant that does not exist. The correct constant is MCRYPT_DEV_URANDOM. Somehow, we all missed it. "Open source is automatically more secure" is a fallacy. I just happen to like open source better, personally. Aside: despite being downloaded ~1.9 million times, a grand total 30 people outside of Paragon have contributed to its development in some way so far. The "many eyes" are actually quite sparse, especially when it comes to security expertise. (I think it's reasonable to say those 30 represent much of the the upper 0.01% of security talent in the PHP community.)

or the community to use. How does that relate to your situation? Simple: Your contributions are valuable. Whether or not anyone recognizes them as valuable reflects on their value, not yours. Just something to keep in mind.