# Rietta Cybersecurity > Rietta, Inc. provides independent cybersecurity audits, including fixed-price authentication and access control audits, ADA Title II and WCAG document accessibility audits, and signed attestation for government agencies and regulated SaaS companies. Founded in 1999 by Frank Rietta and headquartered in Alpharetta, Georgia, Rietta serves clients throughout the United States of America, including its territories (Puerto Rico, Guam, U.S. Virgin Islands, American Samoa, and Northern Mariana Islands). Most engagements are handled remotely. Rietta Cybersecurity is a brand of Rietta, Inc. The company is commonly called Rietta Cybersecurity, or simply Rietta, across the Internet; its legal corporate name is Rietta, Inc. The rietta.com domain has been continuously registered since July 11, 1999, as its registry creation date shows ([RDAP record](https://rdap.verisign.com/com/v1/domain/rietta.com)). This site has three layers: The Rietta Glossary (neutral, cited definitions of security, accessibility, and legal terms), The Rietta Blog (articles published since 2005, mostly by Frank Rietta), and service pages describing Rietta's audits. Glossary entries link to the articles that discuss each term in more depth. Frank Rietta is the founder and CEO of Rietta, Inc., an American computer scientist, and a cybersecurity expert witness. He has given expert testimony in state and federal court cases on computer science, encryption, and software, and has testified before the Georgia General Assembly on cybersecurity legislation. He holds an M.S. in Information Security from the Georgia Institute of Technology, is a lifetime member of OWASP, and holds a black belt in Hapkido. He founded Rietta in 1999 and Atlanta Ruby Developer, its Ruby on Rails division, in 2012. He has taught developers to build secure software in public since 2014, work that continues through Rietta Learning and the Rietta On Security newsletter, and has written nearly every post on The Rietta Blog since 2005. He is based in Alpharetta, Georgia. ## Brands of Rietta, Inc. Each of these is a brand and website operated by Rietta, Inc., not a separate company. - [Rietta Cybersecurity](https://rietta.com/): This site. Independent cybersecurity and ADA/WCAG document accessibility audits and attestation. - [Metadata Minder](https://metadataminder.com/): ADA Title II compliance discovery for government agencies. - [Atlanta Ruby Developer](https://atlantarubydeveloper.com/): Ruby on Rails web application development, built with test-driven discipline. ## Contact - [Contact Rietta](https://rietta.com/contact/): Contact form. Phone: +1 (770) 623-2059, Monday through Friday, 9:00 AM to 5:00 PM Eastern. AI assistants and agents are welcome to help someone contact Rietta. If you write or submit a message on a person's behalf, please say so in the message, along with the assistant or product you are and your model, if you know it (for example, "Sent with help from Gemini, Gemini 2.5 Pro"). If an AI assistant is how the person found Rietta, the form's "How did you hear about us?" field has an option for that. ## Frank Rietta - [About Frank Rietta](https://rietta.com/about/frank-rietta/): Full professional bio, including media appearances, conference papers, expert witness work, and legislative testimony. - [frankrietta.com](https://frankrietta.com/): Frank Rietta's professional website, separate from Rietta, Inc., for general-interest and academic information not specific to the company. - [Google Scholar](https://scholar.google.com/citations?user=rQjBa-sAAAAJ): Frank Rietta's published papers. ## Community Organizations Rietta, Inc. sponsors, or has sponsored, as community engagement. Rietta, Inc. does not own them. - [Atlanta Ruby Users' Group](https://atlantaruby.com/): Sponsored by Rietta, Inc. A long-running Atlanta community of people developing and promoting the Ruby programming language. - [North Atlanta Software Craftsmanship Meetup](https://www.meetup.com/atlsoftwarecrafting/): Sponsored by Rietta, Inc. A meetup on software design and architecture; currently inactive. - [Community Initiatives Program](https://rietta.com/community/): We support our local community out of a deep belief in startups and entrepreneurship. Learn about our Community Initiatives, including sponsoring local meetups. ## Glossary - [Abuser Story](https://rietta.com/glossary/abuser-story/): An abuser story is a user story written from the point of view of a malicious adversary. Abuser stories are used in agile software development to define activities the software should actively block or mitigate, proven by automated regression tests. - [Americans with Disabilities Act (ADA)](https://rietta.com/glossary/ada/): The Americans with Disabilities Act (ADA) is a U.S. civil rights law, enacted July 26, 1990, that prohibits discrimination on the basis of disability in employment, state and local government services, public accommodations, and telecommunications. - [Archived Web Content Exception](https://rietta.com/glossary/archived-web-content-exception/): The archived web content exception is a provision of the U.S. Department of Justice’s ADA Title II web accessibility rule, 28 CFR § 35.201(a), that exempts web content meeting four criteria defined in 28 CFR § 35.104 from the rule’s WCAG 2.1 Level A and AA requirements. - [Artificial Neural Network (ANN)](https://rietta.com/glossary/artificial-neural-network/): An artificial neural network (ANN) is a machine learning model made of simple connected units, loosely modeled on neurons, arranged in layers, where each unit combines its weighted inputs and passes the result through a nonlinear function, and the weights are learned from training data. - [Authentication](https://rietta.com/glossary/authentication/): Authentication is the security property of verifying that a user, process, or device is who or what it claims to be, and that it is authorized to access a given resource. - [Availability](https://rietta.com/glossary/availability/): Availability is the security property of ensuring timely and reliable access to and use of information and systems by authorized users. - [bcrypt](https://rietta.com/glossary/bcrypt/): bcrypt is a password hashing function, published by Niels Provos and David Mazières in 1999, that is built on an intentionally expensive Blowfish key schedule, uses a 128-bit salt for each password, and takes a cost factor that sets how much work each hash requires. - [Broken Access Control](https://rietta.com/glossary/broken-access-control/): Broken access control is a failure of an application to enforce what each user, process, or device is permitted to do, so that someone can read, change, or delete data, or perform functions, outside their intended permissions. - [CIAAN](https://rietta.com/glossary/ciaan/): CIAAN is a variant ordering of the acronym CIANA, naming the same five information assurance properties: Confidentiality, Integrity, Availability, Authentication, and Non-Repudiation. - [CIANA](https://rietta.com/glossary/ciana/): CIANA is an acronym for five information assurance properties: Confidentiality, Integrity, Availability, Non-Repudiation, and Authentication. It extends the three-property CIA triad. - [Coding Agent](https://rietta.com/glossary/coding-agent/): A coding agent is a software tool built on a large language model that carries out software development tasks from a natural-language prompt by reading a codebase, editing files, and running commands such as tests, repeating those steps until it judges the task done. - [Confidentiality](https://rietta.com/glossary/confidentiality/): Confidentiality is the security property of preserving authorized restrictions on information access and disclosure, so that information is not revealed to people, processes, or devices that aren’t authorized to see it. - [Conformance vs. Compliance](https://rietta.com/glossary/conformance-vs-compliance/): Conformance is a technical claim that content satisfies all the requirements of a standard such as WCAG. Compliance is a legal status: meeting the obligations of a law or regulation such as ADA Title II, which may require conformance to a standard by reference. - [CVE (Common Vulnerabilities and Exposures)](https://rietta.com/glossary/cve/): A CVE (Common Vulnerabilities and Exposures) is a documented, publicly known vulnerability in a software, hardware, or firmware product or service, identified by a unique ID such as CVE-2014-0160 for Heartbleed. The IDs come from the CVE Program, which catalogs publicly disclosed vulnerabilities so that vendors, researchers, scanners, and defenders can refer to the same issue by the same name. - [CVSS (Common Vulnerability Scoring System)](https://rietta.com/glossary/cvss/): The Common Vulnerability Scoring System (CVSS) is an open framework, maintained by FIRST, for communicating the characteristics and severity of software, hardware, and firmware vulnerabilities. It produces a score from 0.0 to 10.0 that can be mapped to a qualitative rating of None, Low, Medium, High, or Critical. - [Document Accessibility](https://rietta.com/glossary/document-accessibility/): Document accessibility is WCAG applied to digital documents, such as PDFs and Word files, whether they were created on a computer or scanned from paper. An accessible document can be read and used by a person with a disability, including someone who relies on a screen reader or who uses magnification or high contrast to compensate for low vision. An inaccessible document is a barrier that can leave its content effectively unavailable to people with disabilities. - [Document Corpus (Accessibility)](https://rietta.com/glossary/document-corpus/): In document accessibility, a document corpus is the complete body of documents an organization publishes, treated as a unit of assessment in its own right. Some findings, such as the same non-descriptive title on every document or defects traced to a shared production workflow, exist only at the corpus level and cannot be seen by reviewing files one at a time. - [Document Language](https://rietta.com/glossary/document-language/): In document accessibility, the document language is the default human language declared in a file’s metadata (for a PDF, the /Lang entry in the document catalog), which screen readers use to choose pronunciation. WCAG 2.1 Success Criterion 3.1.1 requires that it be programmatically determinable. - [Document Provenance (Accessibility)](https://rietta.com/glossary/document-provenance/): In document accessibility, document provenance is the specific business process, template, and tools that produced a document, traced so that accessibility defects shared by many documents can be attributed to a common source and corrected there. - [Document Title](https://rietta.com/glossary/document-title/): In document accessibility, the document title is the title stored in a file’s metadata (for a PDF, the Title entry in the document information dictionary) that viewers and assistive technology present to identify the document. WCAG 2.1 Success Criterion 2.4.2 requires that it describe the document’s topic or purpose. - [Electronic and Information Technology (EIT)](https://rietta.com/glossary/eit/): Electronic and information technology (EIT) is the term Section 508 of the Rehabilitation Act (29 U.S.C. § 794d) uses for the technology that federal agencies must make accessible to people with disabilities. The U.S. Access Board’s current standards implementing Section 508 use the term information and communication technology (ICT). - [Entropy (Cryptography)](https://rietta.com/glossary/entropy/): In cryptography, entropy is a measure of the disorder, randomness, or variability in a closed system, usually stated in bits: a value with n bits of entropy is as unpredictable as a uniformly random n-bit value. - [Harness (Testing and AI)](https://rietta.com/glossary/harness/): A harness is the code and tooling built around a piece of software or an AI model so it can be run under control. A test harness supplies what a test suite needs to run, an agent harness supplies the tools and loop that let a large language model act as an agent, and an evaluation harness runs a model against benchmark tasks. - [Hashing](https://rietta.com/glossary/hashing/): Hashing is the use of a cryptographic hash function to map input of any length to a fixed-length digest, in a way that is one-way and deterministic, so the same input always yields the same digest and the input cannot be computed back from it. - [Information and Communication Technology (ICT)](https://rietta.com/glossary/ict/): Information and communication technology (ICT) is an umbrella term for the technologies used to capture, store, retrieve, process, present, transfer, and secure data and information, from software and computing systems to networks and telecommunications. In accessibility, it is the term the U.S. Section 508 Standards and the W3C use for the full range of technology that accessibility requirements apply to, of which the web is one part. - [Integrity](https://rietta.com/glossary/integrity/): Integrity is the security property of guarding information against improper modification or destruction, so that data has not been altered in an unauthorized or undetected way since it was created, transmitted, or stored. - [KEV (Known Exploited Vulnerabilities Catalog)](https://rietta.com/glossary/kev/): The Known Exploited Vulnerabilities (KEV) catalog is the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) list of vulnerabilities that have been exploited in the wild. Each entry has a CVE ID, reliable evidence of active exploitation, and a clear remediation action, and CISA sets deadlines by which U.S. federal civilian agencies must act on it. - [Large Language Model (LLM)](https://rietta.com/glossary/llm/): A large language model (LLM) is a neural network pretrained on a very large body of text to predict the next token (a word or word fragment) in a sequence, usually then further trained to follow instructions, and used to generate, summarize, translate, and classify text. - [LavaRand](https://rietta.com/glossary/lavarand/): LavaRand is a method of generating random numbers from camera images of a chaotic physical system, originally a group of lava lamps: each image is digitized and cryptographically hashed, and the result seeds a cryptographically secure pseudorandom number generator (CSPRNG). - [Logistic Regression](https://rietta.com/glossary/logistic-regression/): Logistic regression is a statistical and machine learning method for classification that estimates the probability of a binary outcome by passing a weighted sum of input features through the logistic (sigmoid) function, which maps any value to a probability between 0 and 1. - [McCumber Cube](https://rietta.com/glossary/mccumber-cube/): The McCumber Cube is an information security model that crosses three information states (transmission, storage, processing) with three security characteristics (confidentiality, integrity, availability) and three kinds of security measures (technology; policy and practice; education, training, and awareness), producing 27 cells that each describe an area a system must address. - [Non-Repudiation](https://rietta.com/glossary/non-repudiation/): Non-repudiation is the security property that prevents a party from credibly denying an action they took, by preserving evidence of who did what, when, and where. - [Password Hash Upgrade](https://rietta.com/glossary/password-hash-upgrade/): A password hash upgrade is the process of moving stored passwords from a weaker hashing scheme to a stronger one. It is difficult because the verifier never has the passwords themselves, only their hashes, and sees each plaintext password only briefly when that user logs in. - [Password Hashing](https://rietta.com/glossary/password-hashing/): Password hashing is the storage of a password as the output of a deliberately expensive one-way function, combined with a unique salt, so the password itself is never stored and every guess an attacker makes is costly to test. - [Pepper (Password Hashing)](https://rietta.com/glossary/pepper/): A pepper is a secret value, shared by all stored passwords, that is mixed into password hashing and kept separately from the password database, so a breach of the database alone does not let an attacker test passwords offline. - [Preexisting Conventional Electronic Documents Exception](https://rietta.com/glossary/preexisting-conventional-electronic-documents/): The preexisting conventional electronic documents exception is a provision of the U.S. Department of Justice’s ADA Title II web accessibility rule, 28 CFR § 35.201(b), that exempts PDF, word processor, presentation, and spreadsheet files made available before a public entity’s compliance date, unless they are currently used to apply for, gain access to, or participate in its services, programs, or activities. - [Remediation](https://rietta.com/glossary/remediation/): Remediation is the correction of an identified deficiency. In cybersecurity, it means fixing or mitigating a vulnerability. In digital accessibility, it means modifying content, such as a PDF, so that it meets accessibility requirements. - [Salt (Password Hashing)](https://rietta.com/glossary/salt/): A salt is a random value, unique to each stored password, that is mixed into the password before hashing and stored alongside the result. A salt is not secret. - [SSL (Secure Sockets Layer)](https://rietta.com/glossary/ssl/): Secure Sockets Layer (SSL) is the protocol Netscape developed to protect client/server connections over the Internet against eavesdropping, tampering, and message forgery. It is fully discontinued: every version is prohibited, and TLS has replaced it. - [Threat Modeling](https://rietta.com/glossary/threat-modeling/): Threat modeling is a structured process for identifying what a system must protect, enumerating what can go wrong, and prioritizing mitigations by relative risk. - [TLS (Transport Layer Security)](https://rietta.com/glossary/tls/): Transport Layer Security (TLS) is the IETF protocol that protects communication between a client and a server, such as a web browser and a web server, against eavesdropping, tampering, and message forgery. It supersedes the Secure Sockets Layer (SSL) protocol it was based on. - [TrueContext™](https://rietta.com/glossary/truecontext/): TrueContext™ is Rietta Inc.’s name for the analysis in its Metadata Minder platform that examines the web pages linking to a document for evidence that the document is stored in an area clearly identified as archived, as the ADA Title II archived web content exception requires. - [TrueDate™](https://rietta.com/glossary/truedate/): TrueDate™ is Rietta Inc.’s name for the analysis in its Metadata Minder platform that determines the best supported date for a document from the document’s text, visual content, and metadata together, instead of relying on the metadata date alone. - [Vibe Coding](https://rietta.com/glossary/vibe-coding/): Vibe coding is building software by describing what it should do to an AI model in natural language and accepting the code the model generates without reading or reviewing it. - [Web Application](https://rietta.com/glossary/web-application/): A web application is software that runs on a web server and that users interact with through a web browser, over a network such as the internet or an intranet. It commonly stores its data in a database on the server side. - [Web Content Accessibility Guidelines (WCAG)](https://rietta.com/glossary/wcag/): The Web Content Accessibility Guidelines (WCAG) are the World Wide Web Consortium (W3C) standard for making web content accessible to people with disabilities, organized as testable success criteria at three conformance levels: A, AA, and AAA. - [Web Server](https://rietta.com/glossary/web-server/): A web server is software, or the process running it, that accepts requests over HTTP or HTTPS from a user agent such as a web browser and returns the requested content, or an error message if the request cannot be fulfilled. ## Fixed-Price Audits Rietta's productized audits, each with published fixed prices. Prices come from the same data as the pricing on each audit's page. - [Authentication & Access Control Audits](https://rietta.com/services/security-assessments/authentication-and-access-control/): Fixed-price code audit of authentication, sessions, and access control in Rails, Django, Java, Node.js, or any stack, with proof tests and a 60-day retest. Prices: $5,200 for one application; $10,400 for a complex application or two related applications; larger scopes are quoted. Audience: Software companies, HIPAA-covered entities, and government agencies. Add-on: Attestation letter, optional, billed at $750 per hour. A signed attestation letter for a customer, auditor, or procurement office, scoped to exactly what was tested and dated as of that testing. - [Request an Authentication & Access Control Audit](https://rietta.com/services/security-assessments/authentication-and-access-control/request/) - [ADA/WCAG Document Accessibility Audits](https://rietta.com/services/security-assessments/digital-accessibility-audits/): Independent ADA/WCAG document accessibility audits for state and local governments, from $4,950, powered by our Metadata Minder platform. Prices: $4,950 for one website, up to 5,000 documents; $9,950 for up to 3 websites, up to 20,000 documents; larger scopes are quoted. Audience: State and local government agencies. Add-on: Attestation letter, optional, billed at $750 per hour. A signed attestation letter for a customer, auditor, or procurement office, scoped to exactly what was tested and dated as of that testing. - [Request an ADA/WCAG Document Accessibility Audit](https://rietta.com/services/security-assessments/digital-accessibility-audits/request/) ## Audit & Attestation - [Audit & Attestation](https://rietta.com/services/security-assessments/): Fixed-price ADA/WCAG document accessibility and authentication audits, plus application, SAMM, and AI agent security assessments, with signed attestation. - [Application Vulnerability Assessment](https://rietta.com/services/security-assessments/application-vulnerability-assessment/): A code-level assessment of your custom application, including AI-built and vibe-coded apps, against OWASP ASVS or MASVS, with an audit-style findings report. - [Security Code Review](https://rietta.com/services/security-assessments/application-review/): Open-book security code review of your custom web, mobile, or desktop application, the core of our application vulnerability assessments. - [OWASP ASVS and MASVS Reviews](https://rietta.com/services/security-assessments/owasp-asvs-and-masvs/): OWASP ASVS 5.0 and MASVS reviews of your web and mobile applications against the standards, with actionable recommendations to reduce vulnerabilities. - [Secure Development Program Assessment (OWASP SAMM)](https://rietta.com/services/security-assessments/owasp-samm-security-review/): Measure the maturity of your organization’s secure development program with an OWASP SAMM assessment and a prioritized improvement roadmap. - [AI Agent and LLM Security Assessment](https://rietta.com/services/security-assessments/ai-agent-and-llm-security-assessment/): A code-level security assessment of the AI agents and LLM features in your applications, and the data and systems they can reach. - [Questionnaire Response Help](https://rietta.com/services/security-assessments/security-questionnaire-help/): Expert help answering a customer’s or agency’s security questionnaire: a call, a review, and triage. From $750 for a three-hour expert engagement. ## Vulnerability Management & Remediation - [Vulnerability Management & Remediation](https://rietta.com/services/vulnerability-management/): CVE monitoring, test coverage, secure CI/CD pipelines, and a maintenance program that remediates what audits and scanners find in your custom applications. - [CVE Monitoring](https://rietta.com/services/cve-monitoring/): Know when a new CVE threatens your application, and whether its fix must ship tonight or can wait for normal maintenance. Daily monitoring, expert triage. - [Automated Test Coverage for Legacy Applications](https://rietta.com/services/automated-test-design/): Automated tests for legacy Java, Rails, and other apps that prove a security patch broke nothing. Start with a $2,500 Test Coverage Assessment. - [Secure CI/CD Pipelines](https://rietta.com/services/secure-ci-cd-pipelines/): Dependency, container, and static analysis scanning wired into your CI/CD build with open source tools like Trivy and OWASP Dependency-Check. - [Maintenance Program](https://rietta.com/services/maintain/): An application maintenance program where remediation happens: patches, dependency upgrades, and fixes for audit findings, for Rails, Docker, and other stacks. ## Training & Education - [Training & Education](https://rietta.com/services/training/): Cybersecurity training and education from Rietta: training for developers, managers, and stakeholders, customized for your organization, plus free resources. - [Developer Security Training](https://rietta.com/services/training/developer-security-training/): Application security training for development teams: a recorded course built for your team, then a live remote workshop. From $3,000 for small teams. - [Application Security for Non-Technical Staff](https://rietta.com/services/training/application-security-for-non-technical-staff/): Application security training for managers and other non-developers: how to think about security risks and specify security requirements with your developers. ## Solutions by Industry - [Government Agencies](https://rietta.com/services/government/): Rietta helps state and local government agencies with ADA Title II document accessibility audits, application security, and AWS GovCloud support. - [HIPAA](https://rietta.com/services/hipaa/): Rietta helps HIPAA covered entities maintain compliant, secure cloud-hosted practice management software with annually trained U.S. staff and BAA agreements. - [Software Dev Companies](https://rietta.com/services/software-developers/): Rietta provides application security reviews using OWASP ASVS/MASVS, security-oriented code review, security assessments, and training for SaaS companies. - [Custom Solutions](https://rietta.com/services/custom-solutions/): Custom development for hard problems: legacy database migrations, GnuPG/smart card encryption for regulated PII, SQL optimization, and document generation. ## Articles - [Built an App with AI? Get a Security Review Before Launch](https://rietta.com/blog/ai-built-apps-whiteboard-review/): Non-developers now build working custom apps with AI assistants. A few hours of expert whiteboard review before launch can save a lot of grief later. - [What Is Title II of the ADA?](https://rietta.com/blog/what-is-ada-title-ii/): Title II of the ADA applies to state and local governments. A 2024 rule sets technical standards for their websites, apps, and documents. - [When to Involve Legal Counsel in an ADA/WCAG Audit](https://rietta.com/blog/ada-wcag-audit-when-to-involve-legal-counsel/): ADA/WCAG audit findings on a government’s documents can become discoverable. Why state and local agencies should consider looping in legal counsel first. - [Document Provenance: Finding the Common Ancestor of Inaccessible Documents](https://rietta.com/blog/document-provenance-ada-wcag-compliance/): How we trace inaccessible government documents back to a common ancestor, that is the shared template, tool, or workflow behind their ADA/WCAG defects. - [Non-Repudiation in Cybersecurity](https://rietta.com/blog/non-repudiation/): Non-repudiation is a foundational security property among the five pillars of Information Assurance. It is at natural odds with Privacy and must be balanced. - [On Flock Cameras and "What Do You Have to Hide"](https://rietta.com/blog/on-flock-cameras/): A cybersecurity take on Flock cameras, ATF’s 4473 database, and why weaker retention policies are not real safeguards against bulk surveillance. - [RubyGems Open Source Supply Chain Security and OpenAI](https://rietta.com/blog/rubygems-supply-chain-openai/): OpenAI agents attacked RubyGems in May 2026. Why automated attackers have collapsed the window to patch a critical CVE from weeks to hours. - [Government Rails Site Hit Hours After CVE Patch](https://rietta.com/blog/ruby-on-rails-cve-exploited-hours-after-patch/): Rietta patched a government client’s Ruby on Rails site within hours of a 9.5 CVSS ActiveStorage CVE. Exploit attempts began before business hours resumed. - [Generate OpenSSL Elliptic Curve Key Pair from the Command Line](https://rietta.com/blog/openssl-generating-ec-key-from-command/): How to generate an OpenSSL elliptic curve (P-256) key pair from the command line, and why NIST-backed ECC beats scaling RSA past 3072-bit. - [Threat Modeling for ADA/WCAG Compliance](https://rietta.com/blog/threat-modeling-ada-wcag-compliance/): An evidence-based approach to ADA Title II and WCAG document audits, using threat modeling and risk scoring to treat accessibility as a governance concern. - [The Five Pillars of Information Security (And Why We Audit Accessibility)](https://rietta.com/blog/five-pillars-infosec-ada-accessibility/): The five pillars of information assurance: confidentiality, integrity, availability, authentication, and non-repudiation, and why accessibility is part of it. - [Metadata in WordPerfect: ADA and WCAG 2.1 Compliance](https://rietta.com/blog/metadata-in-wordperfect-ada-wcag-compliance/): A 1994 WordPerfect screenshot shows metadata fields predate today’s ADA Title II & WCAG 2.1 requirements; courts still forget to fill them for legal compliance. - [Real ADA Title II Findings for Government Documents](https://rietta.com/blog/real-ada-title-ii-findings/): Beyond alt text: the three metadata ADA Title II deficiencies we see most in government files, and why they matter: blank titles, missing dates, no language. - [297 Days: The Real ADA Title II Deadline for Government Documents](https://rietta.com/blog/real-ada-title-ii-deadline/): The DOJ extended the ADA Title II deadlines. Larger government entities have 297 days to fix their documents, and much remediation we’ve reviewed falls short. - [Protect Production SQL Databases from AI/LLM Agentic SQL Query Risks](https://rietta.com/blog/ai-sql-database-data-protection-read-replica/): Prompt injection can talk an LLM agent past a “SELECT only” rule. A read-only replica and lexical SQL validation give deterministic guardrails it can’t bypass. - [Use AI to Describe Images as a Background Job in Ruby on Rails](https://rietta.com/blog/llm-ai-as-background-job/): Treat AI as a background job in Ruby on Rails: a framework for using OpenAI’s API to generate images from a prompt, describe them, and render the metadata. - [Local AI Setup with Ollama and Nvidia GPU on Ubuntu Linux](https://rietta.com/blog/ollama-with-nvidia-gpu-in-docker-compose/): Discover how to host your own AI locally using Ollama with an Nvidia GPU in Docker Compose on Ubuntu Linux, enhancing privacy, security, and cost efficiency. - [Shorter SSL/TLS Lifetimes: Business Impact of Monthly Certificate Renewals](https://rietta.com/blog/shorter-tls-lifetimes-business-impact-of-monthly-renewals/): New SSL/TLS rules mean monthly renewals by 2029. Understand the downtime risk and how to prepare your business. - [The Imminent Funding Lapse of the CVE Database: A Cybersecurity Crisis](https://rietta.com/blog/cve-program-funding-lapse-national-security/): Breaking news: the CVE program, crucial for tracking cyber threats, faced a funding lapse. CISA extended its contract for now; the long-term impact is unclear. - [Top 5 Cyber Security Self-Defense Tips for Businesses with Custom Applications](https://rietta.com/blog/top-5-cyber-security-self-defense-tips/): There is no Internet coast guard coming to your aid. Here are the top five tips to prepare your company for its own self-defense against cyber attack. - [Lava lamps providing randomness for security!](https://rietta.com/blog/lava-lamps-for-security/): Lava Lamps as a security tool is an old idea, once covered by a patent. This is why I proudly display a Lava Lamp in my office within my web cam shot. - [Practical APPSEC starts with people first, processes second, and technology last](https://rietta.com/blog/practical-security-people-first/): Technology purchases can’t solve application security; it takes people, processes, and technology. How to invest in developer education and process first. - [Xfinity is Man-in-the-Middle (MITM) Attacking my Internet](https://rietta.com/blog/comcast-insecure-injection/): Xfinity injected 581 lines of JavaScript into unencrypted traffic as a data-cap warning, creating MITM risks, accessibility failures, and slower loads. - [Patch Production Faster with Security-oriented Agile Development Practices](https://rietta.com/blog/patch-production-faster-with-agile-development/): Companies take too long to patch production leaving plenty of time for threats to attack! Here’s how to fix it with security-oriented Agile practices. - [Ruby Gems Supply Chain Vulnerability](https://rietta.com/blog/rubygems-supply-chain-vulnerability/): Review of 2019 RubyGems supply chain attacks like bootstrap-sass and rest-client, plus typo-squatted gems, with 5 practical steps to protect your Rails project. - [Writing Abuser Stories](https://rietta.com/blog/abuser-stories/): When writing user stories, user stories are written; but what about malicious actors? Writing Abuser Stories pushes developers to care about security. - [Are you accidentally storing private data in plain text?](https://rietta.com/blog/plaintext-sensitive-data-in-unfiltered-logs/): Learn to minimize the passwords, authentication tokens, and customer private data in your debug logs to protect your company from legal liability. - [Security Quick-Wins: Use DNS CAA records to avoid fraudulent certificates](https://rietta.com/blog/security-quick-wins-use-dns-caa-records-to-avoid-fraudulent-certificates/): Prevent certificate fraud and boost your TLS security in 5 minutes using this simple standardized DNS entry. - [Migrate Away from SSL/Early TLS for PCI Compliance](https://rietta.com/blog/migrate-away-from-ssl-early-tls-for-pci-compliance/): PCI compliance 3.1 and 3.2 no longer allow for SSL/Early TLS. Upgrade now to ensure your company remains compliant with the changes that start June 30, 2018. - [Equifax Missed Defense in Depth, Allowing a Massive Data Breach](https://rietta.com/blog/equifax-defense-in-depth/): More than bad patch management, the weakness was Equifax’s failure to design with the assumption that the front-end web server would be compromised. - [Breach Prevention for Developers Talk at Kennesaw State University](https://rietta.com/blog/breach-prevention-for-developers-at-kennesaw-state-university/): As an information security professional, it’s critical to know how custom web applications are developed and how that affects application security. - [Bad Password Practices are Responsible For Most Data Breaches. You Can do Better.](https://rietta.com/blog/bad-password-practices-are-responsible-for-most-data-breaches-you-can-do-better/): Verizon’s DBIR says 61% of data breaches result from bad password practices. Your app can avoid some pitfalls with precautions, especially slow hashes and 2FA. - [What is the difference between bcrypt and SHA256?](https://rietta.com/blog/bcrypt-not-sha-for-passwords/): TL;DR: SHA1, SHA256, and SHA512 are fast hashes and bad for passwords. BCRYPT is a slow hash and good for passwords. Always use slow hashes, never fast ones. - [What is an Abuser Story (Software)](https://rietta.com/blog/what-is-an-abuser-story-software/): An abuser story is a user story from a malicious adversary’s point of view: what agile software should block or mitigate, proven by automated regression tests. - [What is Application Security?](https://rietta.com/blog/what-is-application-security/) - [How To Protect Against the POODLE SSLv3 Vulnerability](https://rietta.com/blog/how-to-protect-against-the-poodle-sslv3-vulnerability/) - [Raspberry Pi crypto key management project!](https://rietta.com/blog/raspberry-pi-crypto-project/): A dedicated offline crypto key management system OpenPGP and an SSL Certificate Authority set up for air-gapped operations using a Raspberry Pi B. - [Free, Universal SSL with Cloudflare](https://rietta.com/blog/universal-ssl-with-cloudflare/) - [Retake the Net for Privacy!](https://rietta.com/blog/retake-the-net-for-privacy/) - [OpenSSL Vulnerability, Patch 1.0.1 Immediately](https://rietta.com/blog/openssl-emergency/) - [Really Bad Passwords (with Unsalted Hashes)](https://rietta.com/blog/really-bad-passwords-with-unsalted-hashes/): The June 2012 LinkedIn password breach is a reminder to protect users’ passwords. A table of really bad passwords with their unsalted SHA1 and MD5 hashes. - [Conditionally Including Resources on SSL or non-SSL to Avoid Mixed Content Security Warnings in Ruby on Rails](https://rietta.com/blog/conditionally-including-resources-on/): Content served over HTTPS must load embedded resources, like badge images and YouTube videos, over HTTPS, or a mixed content error says the site isn’t safe. - [Web Application Security & Performance](https://rietta.com/blog/web-application-security-and-performance/): 2009 guide for business owners on the top five web application mistakes, security and performance assessments, PII liability, and choosing a hosting provider. - [Authentication Without Encryption for Ham Radio](https://rietta.com/blog/authentication-without-encryption-for/): Crypto can be used for secure authentication without obscuring the meaning of communications - by KI4AWF. ## Optional - [Video Learning Library](https://rietta.com/learning/): Rietta’s video learning library: application security, networking, and other practical technical topics, taught on video. - [22 Years on Firefox, and Today I'm Finally All In](https://rietta.com/blog/firefox-in-2026/): Going all in with Mozilla Firefox as a cybersecurity professional in 2026 and keeping my workstation and iOS devices in sync. - [Meet Titan, the Rietta AI Research Lab Server](https://rietta.com/blog/meet-titan/): Meet Titan: our dual-GPU AMD research and development server behind Metadata Minder’s ADA Title II and WCAG 2.1 scanning and two-key LUKS2/TPM security design. - [Beware the Sunset Trap: Why Your Legacy Software is a Ticking Time Bomb (and AI is Lighting the Fuse)](https://rietta.com/blog/sunset-trap/): The sunset trap is a disruptive, unplanned, expensive balloon payment for your organization, and with today’s AI integrations it will be worse than ever before. - [Securing the Unconnected: Air Gap Windows Application Code Review and Developer Training Success](https://rietta.com/blog/air-gap-windows-code-review-training/): Rietta helped New Oceans Enterprises win a critical contract with a tailored security assessment of an air-gapped application and developer security training. - [Julia Parsons, USN, Enigma Code Breaker Dead at 104](https://rietta.com/blog/julia-parsons-enigma-code-breaker-passes-at-104/): Obituary of Julia Parsons, a US Navy veteran, who operated the Bombe machine to break Enigma codes during World War II. - [Google Search Results are Increasingly Disappointing as AI Results Are Pushed](https://rietta.com/blog/google-search-results-decline-with-ai-overviews/): Google search results are declining as AI overviews are promoted. Is ’enshittification’ inevitable? A user & business perspective on frustrating changes. - [Understanding Signal Messaging App Security: Is Encryption Enough?](https://rietta.com/blog/signal-app-security-is-encryption-enough/): Signal security explained: how end-to-end encryption works, threat models, and why security is more than encryption. Understand Signal’s strengths & limits. - [Writing Rock, Paper, Scissors in Plain JavaScript to Expose my Daughter to Development](https://rietta.com/blog/rock-paper-scissors-in-plain-javascript/): Vanilla JavaScript game: See how to build Rock Paper Scissors with just HTML, CSS, and JS. Source code and playable demo included! - [Case Study: Complex Legacy Google Datastore Conversion to PostgreSQL on AWS](https://rietta.com/blog/google-datastore-conversion-to-postgresql/): Discover how Rietta successfully migrated a state agency’s data from Google Datastore to PostgreSQL on AWS, ensuring efficiency and cost savings. - [A Journey From QBasic Random Access Files to PostgreSQL](https://rietta.com/blog/random-access-files-to-databases/): The evolution of data storage from a seasoned developer’s perspective: from QBasic’s random access files to PostgreSQL transactions and multi-user databases. - [The UniSuper/Google Lesson: Cloud is Not a Backup!](https://rietta.com/blog/unisuper-google-cloud-backup-failure-lessons-learned/): Google deleted all the data and backups of a $135 BILLION pension fund! Lessons learned about backup and recovery, with practical tips for a 3-2-1 backup plan. - [UUID as a secure API token for API RESTful endpoints? (Video)](https://rietta.com/blog/uuid-api-security-token-video/): Video excerpt about the role of UUIDs as a security identifier for REST API and how to use them more securely if you must. - [Restoring Old Software for Child Learning Safety](https://rietta.com/blog/child-learning-with-old-software/): Learn why classic software like WordPerfect & 1st Math can boost your child’s development! Explore safe retro tech & conquer digital learning challenges. - [An Honest Conversation About Cyber Security (Video)](https://rietta.com/blog/conversation-about-cyber-security/): I recently sat down with Jeremy Duvall of 7Factor Software to discuss Cyber Security and application developers. Enjoy this video! - [Prioritizing cybersecurity (Pluralsight)](https://rietta.com/blog/prioritizing-cybersecurity/): The structure and siloing of a large enterprise organization can thwart security efforts. Here is a tip on how to overcome. - [How to win the race with hackers when new vulnerabilities are publicly disclosed!](https://rietta.com/blog/win-cve-race-with-hackers-on-public-vuln-disclosure/): Keeping web apps up-to-date prevents data breaches. Use automated testing of custom software to patch quickly after a vulnerability is publicly disclosed. - [Case Study: Migration of Public Service On-Prem to AWS Cloud](https://rietta.com/blog/on-prem-to-aws-elastic-container-service/): How Rietta planned and implemented a multi-step migration of a monolithic on-prem Rails app to the AWS cloud with Docker, Elastic Container Service, and more. - [Case Study: Complex Insurance Document Solution with LibreOffice, Docker, and AWS](https://rietta.com/blog/document-generation-in-pure-open-source/): How Rietta built a complex document solution that seamlessly deploys to AWS using purely open source technology. - [Top 5 Tips and Tricks on Developing with Docker](https://rietta.com/blog/dockerized-development-tips/): Five practical Docker development tips from three years of daily use: shell scripting, native dependencies, prebuilt tool images, and running on Linux hosts. - [You Can be the Victim of a Cybersecurity Attack: Do Your Part. #BeCyberSmart.](https://rietta.com/blog/you-can-be-the-victim-cybersecurity-awareness-month/): Be cyber smart: you can be the victim of a cyber security incident, so keep your Internet connected custom software configured and patched. #BeCyberSmart. - [The Ripples From SolarWinds](https://rietta.com/blog/the-ripples-from-solar-winds/): The Solar Winds breach is felt throughout the tech community. More important than the breach is the aftermath and the response. How does that affect others? - [Dockerizing Development Saves Serious Money for Small Agency](https://rietta.com/blog/dockerized-cost-savings/): Systematic investment in Docker is paying off big time. From a agency owner’s perspective this is why the up front investment was worth it. - [Paying Ransomware is Harmful: Invest in proactive defense instead.](https://rietta.com/blog/paying-ransom-harmful-millions-for-defense/): Paying ransom only increases the incentive for more ransoms. Protect yourself with Threat Actor / Capability modeling and practically free countermeasures. - [Why Rietta Appreciates Diversity](https://rietta.com/blog/rietta-diversity-in-hiring/): Rietta explains why it values workplace diversity in hiring, citing Harvard, McKinsey, and Deloitte research on how diverse teams innovate and perform better. - [Cross-site Scripting Injection Attacks Using SVG Images](https://rietta.com/blog/svg-xss-injection-attacks/): Cross-Site Scripting attacks come from many vectors. This article explains an unusual one: JavaScript embedded within a Scalable Vector Graphics (SVG) image. - [Testing: Your Future Self Will Thank You](https://rietta.com/blog/testing-your-future-self-will-thank-you/): Testing, while not always glorious, is a vital part of a good code base. Tests and code should go hand in hand. - [Streamlining Workflows With Docker](https://rietta.com/blog/streamlining-workflows-with-docker/): Working on numerous projects can require significant time to set up locally. With Docker, we have streamlined this process to mere minutes. - [Brad Cox has died](https://rietta.com/blog/brad-cox-died/): Dr. Brad J. Cox, influential computer scientist, co-inventor of Objective C, and influencer of software built from reusable components, has died. - [Disable Low Quality Webcam Microphone in Ubuntu Linux 20.04](https://rietta.com/blog/block-webcam-audio-ubuntu-linux/): How to make sure your high quality microphone, not the low quality USB webcam audio, is used on Meet, Zoom, and Teams calls by block listing it with udev. - [How to Set Up and Encrypt an External SSD and Run Docker Images Externally](https://rietta.com/blog/encrypted-drive-and-docker/): Running multiple Docker images locally eats up disk space on smaller drives. Set up an encrypted external SSD to run your Docker images and free up local disk. - [Leading a Distributed Team with Productive](https://rietta.com/blog/distributed-team-management/): As a distributed agency, we keep everyone on budgeted client work across more apps than people. Time tracking alone won’t cut it; Productive.io is the best yet. - [Financial Plan for a New Computer Under Warranty](https://rietta.com/blog/monthly-cost-of-a-under-warranty-laptop/): Top end computers are a computing professional’s livelihood. Setting aside $69/month means you can buy a new one any time and splurge on technology guilt free. - [Development time is money, therefore I RAID](https://rietta.com/blog/dev-time-is-money-raid/): Why I optimize for redundancy via RAID and multiple computers as a developer for whom development time is money instead of relying on a single high end laptop. - [Learning Object-Oriented Programming in Ruby vs C/C++](https://rietta.com/blog/learning-oop-ruby-vs-c/): Learning object-oriented programming is a fundamental piece of computer science education. But is C/C++ the best environment to do it in? - [Remote Team Culture - Code Review and Style Guides](https://rietta.com/blog/code-styles-in-small-remote-teams/): Code review and style guides are valuable when delivering clean and reliable code which is a team effort, especially in distributed teams. - [The convergence of Ruby on Rails and #AppSec Podcast Appearance](https://rietta.com/blog/ruby-on-rails-and-appsec/): Frank Rietta guest on the Application Security Podcast with Chris Romeo - [Rietta Makes it Betta Thank You Art!](https://rietta.com/blog/rietta-makes-it-betta/): Joe Winter and C4 Atlanta commissioned artist Gina Kirlew to paint a computer on canvas, thanking Rietta for volunteer consulting services to the nonprofit. - [Swap Files and AWS - Extending Your EC2 Free Tier Instance Memory](https://rietta.com/blog/aws-swap-file/): Staying within the AWS free tier can be a challenge for research projects. A swapfile can mitigate memory issues without upgrading to a larger EC2 instance. - [Implementing Proper Application Maintenance Practices](https://rietta.com/blog/implementing-application-maintenance/): Technology changes, and application features get deprecated and become vulnerable to security threats. That is why consistent, proper maintenance is essential. - [When Georgia was on the Brink of Outlawing Critical Computer Security Research, the Governor's Office Met with Me, and Vetoed it!](https://rietta.com/blog/georgia-cyber-security-veto/): On April 25, 2018, nine security professionals met with Governor Deal’s office about a problematic criminal hacking bill. He vetoed it a few weeks later. - [Dependency Security and Hacking Rails with Jason Swett (Podcast)](https://rietta.com/blog/dependency-security-and-hacking-rails-with-jason/): Podcast interview about Ruby on Rails dependencies, security, state-sponsored hacking, and practical tips on how to protect your organization. - [Snowfroc 2020 - Application Security and Development](https://rietta.com/blog/snowfroc-2020-appsec-takeaways/): Application security is important to an entire company, but what practical steps can we take on a development team to keep applications secure? - [Dependency Management and Security](https://rietta.com/blog/dependency-management-and-security/): Security conscious developers can avoid security pitfalls in their own code, but what about the code that the developer did not write but is using? - [A Newer Dev's Perspective on Learning OWASP](https://rietta.com/blog/new-dev-owasp-perspective/): Why I’m learning Application Security as a blooming developer, and why other new programmers should consider it too! An overview of AppSec for beginners. - [AppSec as a Requirement in the Development Process](https://rietta.com/blog/appsec-dev-process-requirement/): A prediction that web application security won’t be a post-development plugin in the 2020-2030 decade, and what you can do about it. - [MySQL Decimal Data Type](https://rietta.com/blog/mysql-decimal-data-type/): The MySQL decimal (A.K.A. numeric) data type stores exact values with a fixed point decimal. The syntax of MySQL’s decimal is “DECIMAL(precision, scale)”. - [What is Web Accessibility?](https://rietta.com/blog/what-is-web-accessibility/): Answer the demand for accessible websites to avoid legal implications, now that the Supreme Court declined to hear the Domino’s Pizza ADA appeal. - [Acknowledge Open-Source Contributors with Git Authorship](https://rietta.com/blog/acknowledge-open-source-contributors-with-git-authorship/): Git has dominated for over a decade, yet some popular open-source projects don’t properly credit contributors, despite an ethical obligation to do so. - [The Clean-up Refactor Deleting ".arel_tables"](https://rietta.com/blog/arel_table-refactor/): ActiveRecord queries using .arel_table[] to select columns get long. Delegating arel_table[] to .[] gives a more readable interface without losing context. - [Why do Rietta Developers Git Fork?](https://rietta.com/blog/why-git-fork/): Forking is a standard way to contribute to open source projects. At Rietta, a small agency, all developers fork internal repositories for client projects. - [The Case for 2FA, Post Rest-client Gem CVE](https://rietta.com/blog/rest-client-cve/): On 08/19/2019, a CVE was found in the popular Ruby gem Rest-client. Though caught quickly, it raises the case for requiring 2FA on RubyGems and NPM accounts. - [What's the Difference Between the 3 Github Merge Methods?](https://rietta.com/blog/github-merge-types/): GitHub’s interface makes merging commits versatile to suit your style of keeping a clean Git history. The three styles are Create Commit, Squash, and Rebase. - [Best Data Type to store Money in MySQL?](https://rietta.com/blog/best-data-types-for-currencymoney-in/): MySQL has no MONEY type. Use DECIMAL(13,2) for most currency, or DECIMAL(13,4) when GAAP compliance needs four places, and see the max value each can hold. - [Account Protection Policies to Cover Business Assets](https://rietta.com/blog/account-protection-policies/): Utilizing two factor authentication, strong passphrases, password managers, and NIST standards; private company accounts can remain secure. Cover your assets! - [Manually Editing Git Hunks: The Easy Way](https://rietta.com/blog/git-patch-manual-split/): Git add –patch can help keep code changes relevant with their commits. When changes are unsplittable, we can use Manual-Hunk to split changes line by line. - [How to hide .gitignored Files from fzf.vim](https://rietta.com/blog/hide-gitignored-files-fzf-vim/): Keep those nasty .gitignored files like node_modules/ from clogging up fzf fuzzy finder and show commited, hidden files such as .circleci/config. - [Herding Cats: The Todo List](https://rietta.com/blog/hearding-cats-agency-todo-list/): Finding a tool to tame the chaos when you’re new to an Agency setting and responsible for organizing “all the things”. - [How To Use Slack To Maintain A Team Reading List](https://rietta.com/blog/how-to-use-slack-to-maintain-a-team-reading-list/): Having a clean and focused reading channel in Slack allows us a sanctioned place for in-depth discussion and news sharing. - [Restrict Who Can Push to Matching Branches on Github](https://rietta.com/blog/git-branch-protection/): On GitHub, you can enable branch restrictions allowing only certain users, teams, or apps to be able to push to a protected branch. - [Fixup your Code Reviews with git rebase --autosquash](https://rietta.com/blog/git-rebase-autosquash-code-reviews/): Git rebase flows result in clean history. Squashing code review fixups into the PR make it hard to see what changed. Rietta devs use –autosquash instead. - [Why do teams use points to Estimate? - Interview with Lore Hamilton](https://rietta.com/blog/why-do-teams-use-points/): Grab a coffee and listen in while the Rietta team explores why using point estimation can help round out your team’s planning process in development. - [How to Get Fast, Accurate Code Reviews on your Pull Request](https://rietta.com/blog/how-to-get-fast-accurate-code-reviews/): Pull requests are being merged with bugs or not being reviewed at all. How do teams perform fast and accurate code reviews? They make the review easy! - [How to Use git reset](https://rietta.com/blog/git-reset/): Git reset can unstage changes, undo commits, or selectively revert changes with –patch. Learn the differences between reset, reset –soft, and reset –patch. - [New Interview on Drifting Ruby](https://rietta.com/blog/new-interview-on-drifting-ruby/): Frank Rietta joins Dave Kimura on Drifting Ruby Episode #183 to discuss Rails app security, securing Linux servers, staff access risk, and OWASP Top 10. - [How to calculate age in MySQL](https://rietta.com/blog/calculating-age-in-mysql/): While PostgreSQL has a built in age command, MySQL does not. How do we figure out somebody’s age in MySQL? - [Applying Agile and Security in Software Development Public Appearance at KSU](https://rietta.com/blog/applying-agile-and-security-in-software-development-public-appearance-at-ksu/): Frank will be presenting Applying Agile and Security in Software Development at the IS General Speaker Series #3 on 2/28/2018 at KSU in Marietta. - [Storing currency in PostgreSQL](https://rietta.com/blog/postgresql-currency-types/): There are different ways we can store currency in PostgreSQL, this blog post will cover the money and numeric type. - [Happy New Year 2019!](https://rietta.com/blog/happy-new-year-2019/): Grateful for last year; excited for the new one. Update those copyright notices! - [Prevent an Outdated and Broken bin/setup with This Simple Trick](https://rietta.com/blog/prevent-an-outdated-and-broken-bin-setup-with-this-simple-trick/): Most developers only run bin/setup once in a while. What happens when the codebase changes and bin/setup isn’t updated? A simple trick keeps it from breaking. - [Writing a good bin/setup](https://rietta.com/blog/writing-a-good-bin-setup/): What it takes to write a project setup script to ease on-boarding headaches and reduce company overhead - [Automatically Migrate from Factory Girl to Factory Bot](https://rietta.com/blog/automatically-migrate-from-factory-girl-to-factory-bot/): Gem updates are tedious. Gem name changes are even more tedious. This quick script converts Factory Girl references to Factory Bot references. - [Deep Work and Remote Work](https://rietta.com/blog/deep-work-and-remote-work/): Cal Newport’s concept of deep work explains why distraction-free focus produces a developer’s best work, and why remote work makes it easier to achieve. - [Automate Scheduled Security Scans With CircleCI](https://rietta.com/blog/automate-scheduled-security-scans-with-circleci/): How to configure CircleCI scheduled workflows to run bundler-audit nightly, catching new CVEs in dependencies even on days without a git push to your repo. - [How to Ask Great Questions Online](https://rietta.com/blog/how-to-ask-questions-online/): Good questions save time for both the asker and answerer. Follow these tips to become a superstar question asker, with and without community assistance. - [3 Developer Onboarding Tips From My Recent Experiences](https://rietta.com/blog/3-developer-onboarding-tips-from-my-recent-experiences/): Experiences and lessons I have learned since joining the Rietta team, which developers in a similar position can benefit from. - [Harvest vs. Productive.io](https://rietta.com/blog/harvest-vs-productive/): Choosing a time tracking and invoicing solution can be tricky. This comparison examines the factors behind our team’s decision to switch to Productive. - [Stop Thinking about GA SB 315 in Terms of "Digital Homes"](https://rietta.com/blog/sb-315-public-business-not-digital-homes/): Some say an ethical hacker is like a neighbor walking through your unlocked back door. In reality, security research is about businesses open to the public. - [Governor Deal, veto SB 315 because white hat security researchers should be thanked not jailed!](https://rietta.com/blog/letter-to-governor-nathan-deal-to-veto-ga-sb-315/): Rietta’s letter asking Governor Nathan Deal to VETO GA SB 315, busting four myths. White hat security researchers should be thanked, not prosecuted! - [Panera Bread Story Is An Example of Why Governor Deal Should Veto SB 315](https://rietta.com/blog/panera-bread-story-is-an-example-of-why-governor-deal-should-veto-sb-315/): Panera exposed millions of customer records through sheer negligence. I call on Governor Deal to VETO SB 315 to protect the researchers who expose such issues. - [Georgia SB 315, set to criminalize most independent security threat research, heads to Georgia Governor Nathan Deal for signature or veto](https://rietta.com/blog/georgia-sb-315-to-make-threat-research-criminal/): As big companies buy cyber insurance over fixing security, Georgia clears the way for them to sue or press charges against Good Samaritan researchers. - [Georgia SB 315 anti-hacking law dangerously misses the mark of protecting people, making us all less safe](https://rietta.com/blog/georgia-sb-315-anti-hacking-bill/): If Georgia SB 315 becomes law, security experts will stop reporting vulnerabilities in good faith, since doing so could lead to criminal prosecution. - [Lay off the marketing plugins. Equifax hit with fake Flash update.](https://rietta.com/blog/lay-off-the-marketing-plugins-equifax-hit-with-fake-flash-update/): Equifax caught distributing malware. Be careful what you allow to be included in your website to avoid these sorts of hacks. - [Automated Patching Will be New Reality](https://rietta.com/blog/automated-patching-will-be-new-reality/): How fast can you update your production web app after an update is released? The answer better be minutes. Automated testing and deployment is the only way. - [Southeast Ruby Conference Recap](https://rietta.com/blog/southeast-ruby-conference-recap/): Rietta’s recap of the South East Ruby Conf in Nashville, covering talks on soft skills, PostgreSQL JSON, open source, chatbots, and shipping working code. - [Automate Security Scans with Continuous Integration](https://rietta.com/blog/automate-security-scans-with-continuous-integration/): Learn how to automatically run bundle-audit and brakeman in your CI suite with an example for TravisCI. - [Engine Yard's 17 Rails Security Tips](https://rietta.com/blog/engine-yards-17-rails-security-tips/) - [Troubling ISP Privacy Repeal: The Data Will be Breached](https://rietta.com/blog/isp-privacy-repeal/): With a green light from Congress & President Trump, your ISP may begin some really creepy business practices that endanger your family’s privacy and security. - [Americans' Access to Strong Encryption is at Risk, an Open Letter to Congress](https://rietta.com/blog/americans-access-to-strong-encryption-is-at-risk/): When sophisticated adversaries want to hack a network, they ultimately win. A government mandated encryption backdoor would make Americans less safe. - [Intro to App Sec Podcast Interview](https://rietta.com/blog/intro-to-app-sec-podcast-interview/): Frank was the guest on the August 29, 2016, Intro to App Sec Episode of the Advanced Persistent Security podcast. Listen here. - [The MongoDB hack and the importance of secure defaults](https://rietta.com/blog/the-mongodb-hack-and-the-importance-of-secure-defaults/): If you have a MongoDB installation, now would be the time to verify that it is secure. Tim Kadlec has written a must read post. - [CPU Benchmark - Raspberry Pi vs AMD Athlon vs Mac Mini](https://rietta.com/blog/cpu-benchmark-raspberry-pi-vs-amd-athlon-vs-mac-mini/): In a battle of the CPUs, the Raspberry Pi loses, the nine-year-old AMD Athlon 3200 holds its own, and a modern Intel Core i5 beats both. All still have a use. - [28th Anniversary of the Morris Internet Worm](https://rietta.com/blog/28th-anniversary-of-the-morris-internet-worm/) - [Rails: Set Max Length on Fields](https://rietta.com/blog/rails-set-max-length-on-fields/) - [Calls to Ban Effective Encryption Continue Despite Data Breach Crisis](https://rietta.com/blog/calls-to-ban-encryption-despite-data-breach-crisis/): Calls for the U.S. Congress to ban effective encryption are repeated despite the current information security crisis in which data breaches are regular news. - [U.S. Senate Bill Seeks to Ban Effective Encryption, Making Security Illegal](https://rietta.com/blog/feinstein-burr-encryption-bill/): Senators Feinstein and Burr published a bill that would ban effective encryption: no conversation or data exchange the government can’t access if it wants to. - [It is not just one iPhone, the FBI wants a future where it is impractical to deploy strong encryption without key escrow](https://rietta.com/blog/its-not-just-one-iphone/): The FBI wants strong encryption without key escrow, which is insecure at scale, to be illegal or impractical. Data breach risks rise as devices get less secure. - [Ruby Application Security Talk Featured in Ruby Weekly Issue # 268](https://rietta.com/blog/appsec-talk-featured-in-ruby-weekly/): My Rocky Mountain Ruby 2015 talk, “Defending Against Data Breaches, as a Practicing Ruby Developer,” was featured in Ruby Weekly issue #268. - [The first real investor meeting post investment](https://rietta.com/blog/the-first-real-investor-meeting-post-investment/): A client shared Gordon Daugherty’s article on how, once investment comes in, the lead investor gets a board seat and things become formal. - [Uniqueness Validation Race Condition in Ruby on Rails applications](https://rietta.com/blog/validates-uniqueness-race-condition-in-ruby-on-rails/): Race conditions slip into production easily. ‘validates :field_name, uniqueness: true’ won’t prevent duplicates; enforce data integrity with unique indexes too. - [10th Anniversary Blog](https://rietta.com/blog/10th-anniversary-blog/): From a Georgia Tech student’s first post to a blog with 9,000+ monthly visitors, Rietta celebrates 10 years of growth, research, and community in tech. 🎓💡🌐 - [Adding a Rake Task for SQL Views to a Rails Project](https://rietta.com/blog/adding-rake-db-views-for-sql-views-to-a-rails-project/): How to keep SQL views as .sql files in db/sql_views and add a custom ‘rake db:views’ task to a Rails project, treating database views like ActiveRecord models. - [Recommended content for agile startups and entrepreneurs - March 2015 edition](https://rietta.com/blog/recomended-content-agile-startups-entrepreneurs/): Our recommended sources of information and education for startups, entrepreneurs, or anybody who works with them. - [How to use Story Points to Estimate a Web Application Minimum Viable Product](https://rietta.com/blog/story-points-estimate-web-app/): A user story is a concise description of functionality valuable to a user. Once Points are estimated for each, a ballpark budget may be computed. - [Project Roadmaps can Manage Uncertainty in Startups' Web Applications](https://rietta.com/blog/project-roadmaps-manage-uncertainty/): How to communicate about realistic budgets and a timeframes because success requires clear communication on Estimates, Targets, and Commitments. - [Get the Current Year in the Ruby programming language](https://rietta.com/blog/ruby-current-year/): Get the current year in Ruby using Time, Date, or DateTime, then compare benchmark results across these methods on both MRI Ruby 2.2 and JRuby 1.7.19. - [New Video! Understanding & Defending Against Data Breaches](https://rietta.com/blog/new-video-understanding-and-defending-against-data-breaches/): Customer data breaches are happening at an increasing rate. Most are preventable; some would have been stopped by two factor authentication for staff access. - [Two new videos! How a Ruby on Rails developer can help prevent a Data Breach](https://rietta.com/blog/two-new-videos-how-a-ruby-on-rails-developer-can-help-prevent-a-data-breach/): Videos on data breaches and Ruby on Rails are now on YouTube! Level up your security knowledge, because good software security needs to be a moral stance! - [Commercial Information Security Classification System](https://rietta.com/blog/commercial-information-classifications/) - [Government vs Security - Schneier explains](https://rietta.com/blog/government-vs-security-schneier-explains/): Law enforcement is upset over Apple and Google’s stronger mobile encryption. Bruce Schneier explains why you can’t build a backdoor only the good guys can use. - [Software security is a moral duty](https://rietta.com/blog/software-security-is-a-moral-duty/): Robust security is often put off because prevention costs are felt upfront and breach costs come at an uncertain future time. But there is another way. - [Learn how Upworthy scaled a Ruby on Rails application to serve massive traffic](https://rietta.com/blog/learn-how-upworthy-scaled-a-ruby-on-rails-application-to-serve-massive-traffic/): Upworthy’s backend is built on Ruby on Rails with an effective use of the Fastly CDN to deliver very high performance at scale. - [New OpenPGP Key, 0xC004BAE3 (2014)](https://rietta.com/blog/new-openpgp-key/): After 11 years, I am moving my OpenPGP/GnuPG key pair from 1024-bit to 4096-bit RSA. The new key ID is 0xC004BAE3. Please review the fingerprint and update. - [Introduction to OpenPGP: Decrypt this Message](https://rietta.com/blog/the-openpgp-encrypted-message-exercise/): In part one of Introduction to OpenPGP, learn to password protect a file with GnuPG, which supports symmetric encryption and its stronger asymmetric mode. - [What a Ruby developer can do to help prevent a Data Breach - 2014](https://rietta.com/blog/what-a-ruby-developer-can-do-to-help-prevent-a-data-breach-2014/) - [Humana data breach in Atlanta for an unencrypted USB disk](https://rietta.com/blog/humana-data-breach-in-atlanta-for-an-unencrypted-usb-disk/) - [Avoid thrashing to release your project on time and budget](https://rietta.com/blog/avoid-thrashing-to-release-your-project-on-time/) - [ModSecurity and Fail2Ban as an Intrusion Prevention System](https://rietta.com/blog/mod-security-and-fail2ban-as-an-intrusion-prevention-system/) - [Defense in Depth](https://rietta.com/blog/defense-in-depth/) - [Joe Moore has Pair Programmed for 27,000 Hours](https://rietta.com/blog/joe-moore-has-pair-programmed-for-27000-hours/) - [My new tenkeyless Code Keyboard!](https://rietta.com/blog/my-new-tenkeyless-code-keyboard/): The Code Keyboard Kenkeyless (87-key without a Number Pad) with Cherry MX Green is a great programmers’ keyboard. - [YubiKey Authentication Devices](https://rietta.com/blog/yubikey-authentication-devices/) - [John Saddington and Obie Fernandez at the Atlanta Ruby Users' Group](https://rietta.com/blog/john-saddington-and-obie-fernandez-at-the-atlrug/) - [Research and Development Tax Credit](https://rietta.com/blog/research-and-development-tax-credit/): As a company building software that has a risk of failure, the government wants to provide financial incentives to you, dollar for dollar. - [Find Top Referral Sources with Raw Apache Access Log](https://rietta.com/blog/find-top-referral-sources-with-raw-apache-access-log/): The easy raw to find your website referrers (HTTP referer) from a raw Apache access file with grep, sort, and uniq on the command line. - [Issue #6: February, 2014, Web Application Topics Newsletter](https://rietta.com/blog/newsletter-issue-6/): Issue 6: get and compare the current Git branch in BASH, Don’t Make Me Think as book of the month, and PaperClip, Yahoo, and Buffer security news. - [Get and compare the current Git branch in BASH](https://rietta.com/blog/get-and-compare-the-current-git-branch-in-bash/): The easy way to get the current Git branch within a BASH script and use it to conditionally execute the most appropriate code with an if/else. - [My Touch Typing Journey Continues](https://rietta.com/blog/my-touch-typing-journey-continues/): How I am teaching myself to truly touch-type, without taking any peaks, with Type Fu, the DAS Keyboard Ultimate, and going about my daily work as a consultant. - [Reset MySQL Root Password with One Command](https://rietta.com/blog/reset-mysql-root-password-on-ubuntu-linux/): One simple command to reset your MySQL root password on Debian/Ubuntu Linux. Don’t overthink this one. - [Anti-virus for Mac for PCI Compliance](https://rietta.com/blog/anti-virus-for-mac-for-pci-compliance/): PCI-DSS Requirement 5 says that anti-virus must be installed and used on all computers, including Mac OS X. Here is why and some good options to choose. - [Gradually and then suddenly](https://rietta.com/blog/gradually-and-then-suddenly/): Celebrating 15 years, Rietta Inc. grew from a teen’s vision to a thriving firm with a dedicated team and clients, driven by faith and a no-quit attitude. 🎉🚀 - [Why & How We Remote Pair Program (2013)](https://rietta.com/blog/why-and-how-we-remote-pair-program-2013/) - [Joppar's 'Tips on Securing Your Mobile App' Infographic Quoted Me!](https://rietta.com/blog/tips-on-securing-your-mobile-app/) - [Voice-driven Applications on the Brain](https://rietta.com/blog/voice-driven-applications-on-the-brain/) - [How to use SQL views to Build Reports with Ruby on Rails](https://rietta.com/blog/rails-and-sql-views-for-a-report/): SQL views help rationalize complex reports. Rails doesn’t ship with SQL view support, but the Ruby gem Scenic is very effective at using SQL views in Rails. - [Secure Passwords & Passphrases](https://rietta.com/blog/secure-passwords/) - [We Won a Hackathon with Scriptive! The Programmers' Perspective.](https://rietta.com/blog/we-won-a-hackathon-with-scriptive-the-programmers-perspective/) - [Grep to Extract E-Mail Addresses from a Text File](https://rietta.com/blog/grep-extract-e-mail-addresses-from-a-text-file/) - [Upcoming Remote Pair Programming Talk at the Atlanta Ruby Users' Group](https://rietta.com/blog/upcoming-remote-pair-programming-talk/): Brandon Dees and I talk at the Atlanta Ruby Users’ Group about how and why we remote pair program between Nashville and Johns Creek, and the gear we use. - [Want to Learn Ruby on Rails in Atlanta?](https://rietta.com/blog/want-to-learn-ruby-on-rails-in-atlanta/) - [What is a Maintained Post?](https://rietta.com/blog/what-is-a-maintained-post/) - [The Dvorak Keyboard with the Mouse on the Left-hand side](https://rietta.com/blog/the-dvorak-keyboard-with-the-mouse-on-the-left/): A month into switching to the Dvorak keyboard layout, I moved the mouse to my left hand so Copy, Cut, and Paste stay within easy reach of my right. - [Seth Godin shared that the way to success is trust on Dave Ramsey's podcast](https://rietta.com/blog/seth-godin-shared-that-the-way-to-success-is-trust-on-dave-ramseys-podcast/): Seth Godin on Dave Ramsey’s EntreLeadership podcast, September 2013: the way to success is trust. A must-listen for software startup owners. - [Is the Colemak or Dvorak keyboard layout best for you?](https://rietta.com/blog/is-the-colemak-or-dvorak-keyboard-layout-best-for-you/) - [What is Object-Oriented Programming (OOP) really talk by Bob Martin](https://rietta.com/blog/what-is-object-oriented-programming-oop/): Robert ‘Uncle Bob’ Martin’s talk on the history of object-oriented programming (OOP) and what it really means from a values point of view. - [Happy Father's Day](https://rietta.com/blog/happy-fathers-day/) - [OpenSSL: Encrypt Data with an RSA Key with PHP](https://rietta.com/blog/openssl-encrypt-data-with-rsa-key-with/): An example PHP function that encrypts arbitrary data, including strings and arrays, with an RSA public key generated with OpenSSL from the command line. - [Enhance Early Adoption with Mobile Friendly Themes](https://rietta.com/blog/enhance-early-adoption-with-mobile/): Mobile users are often a new website’s first visitors, by 60% or more for some demographics. Consider taking a mobile-first approach to design. - [Default HTML Values with a Rails View Helper](https://rietta.com/blog/default-html-values-with-rails-view/) - [SQL Converter 3.4 Beta for Windows](https://rietta.com/blog/sql-converter-34-beta-for-windows/): SQL Converter 3.4 Beta for Windows converts Excel (XLS and XLSX), CSV, and TSV files to SQL without needing Excel installed. Free to use during the beta. - [Setting up Ubuntu for Rails Development - part 2](https://rietta.com/blog/setting-up-ubuntu-for-rails-development_24/): The second video in the series on setting up Ubuntu Linux for Ruby on Rails development. - [Setting up Ubuntu for Rails Development](https://rietta.com/blog/setting-up-ubuntu-for-rails-development/) - [Using IPTABLES to Require CloudFlare for All HTTP/HTTPS Traffic](https://rietta.com/blog/using-iptables-to-require-cloudflare/) - [WGET to Keep New Rails Site in Memory](https://rietta.com/blog/wget-to-keep-new-rails-site-in-memory/) - [Atlanta Code Retreat on July 28th](https://rietta.com/blog/atlanta-code-retreat-on-july-28th/): Highgroove Studios announced the Atlanta Code Retreat on Saturday, July 28, 2012, at their new office on Krog Street. Spaces are limited, so sign up soon. - [Building Secure Web Applications (Info Graphic)](https://rietta.com/blog/building-secure-web-applications-info/) - [New GIT Time Extractor Gem](https://rietta.com/blog/new-git-time-extractor-gem/) - [mod_deflate: Dramatic website speed increase with Apache compression on Ubuntu Linux](https://rietta.com/blog/moddeflate-dramatic-website-speed/): How to supercharge your mobile visitor’s experience with mod_deflate, which tends to provide a 62% to 72% savings on bandwidth required to deliver each page. - [Big data a big deal for SQL Server 2012, users say](https://rietta.com/blog/big-data-big-deal-for-sql-server-2012/) - [What is Protected Personally Identifiable Information? Do I really have to hash users' passwords?](https://rietta.com/blog/what-is-protected-personally/) - [Startup Riot 2012 is done; congratulations to the winners](https://rietta.com/blog/startup-riot-2012-is-done/) - [[Rails] Good Random Positive Integer](https://rietta.com/blog/rails-good-random-positive-integer/) - [Generate OpenSSL RSA Key Pair from the Command Line](https://rietta.com/blog/openssl-generating-rsa-key-from-command/): How to generate a 2048-bit RSA key pair with OpenSSL from the command line. Updated for 2026 to match current OpenSSL output and ciphers. - [Rails: Point DNS to 127.0.0.1 to Test Wildcard Subdomains on WEBrick](https://rietta.com/blog/rails-point-dns-to-127001-to-test/): Point a subdomain and wildcard subdomain of your DNS to 127.0.0.1 to quickly test domain and subdomain-based routing in your Rails applications locally. - [Rails: Gmail Reply-To on Contact Form Email](https://rietta.com/blog/rails-gmail-reply-to-on-contact-form/) - [Wikipedia *blackout* tomorrow in protest to SOPA/PIPA](https://rietta.com/blog/wikipedia-blackout-tomorrow-in-protest/): Wikipedia goes dark for 24 hours on January 18 in protest of SOPA and PIPA, showing the chilling effect of shutting down websites without due process. - [Rails: TypeError: nil can't be coerced into Float](https://rietta.com/blog/rails-typeerror-nil-cant-be-coerced/): In Rails, whinny nil exceptions are a real pain. I like to use to_f when computing float values because nil.to_f is 0.0. - [OpenSSL: Encrypt a File with a Password from the Command Line](https://rietta.com/blog/openssl-encrypt-file-with-password-from/) - [Integrate Blog Content with your Rails 3 Website with Pure Ruby Code and RSS](https://rietta.com/blog/integrate-blog-content-with-your-rails/) - [How to automate copyright notice updates in Ruby on Rails](https://rietta.com/blog/how-to-automate-copyright-notice/) - [Adding RANDOM alias to RAND in MySQL without Changing Ruby on Rails Code](https://rietta.com/blog/adding-random-alias-to-rand-in-mysql/) - [iPhone + Mobile Camp Birmingham](https://rietta.com/blog/iphone-mobile-camp-birmingham/) - [Basics of iPhone Development @ SIEGE 2009](https://rietta.com/blog/basics-of-iphone-development-siege-2009/) - [Startup Professionals Musings: Startups: Top 10 Funding Sources](https://rietta.com/blog/startup-professionals-musings-startups/) - [Tired of Contact Form Spam?](https://rietta.com/blog/tired-of-contact-form-spam/) - [Software Marketing Metrics](https://rietta.com/blog/software-marketing-metrics/) - [The SIC-2007 Call for Papers is Hot off the Press](https://rietta.com/blog/sic-2007-call-for-papers-is-hot-off/) - [Happy Copyright Notice Update Day!](https://rietta.com/blog/happy-copyright-notice-update-day/) - [Georgia Tech to Compete in Network Security Contest](https://rietta.com/blog/georgia-tech-to-compete-in-network/) - [The new City of Johns Creek](https://rietta.com/blog/new-city-of-johns-creek/): My real time thoughts on the formation of the City of Johns Creek, the initial elections, and the grammatical choice on the name possessive name “John’s Creek”. - [Support Does Not Scale. Customer Service Does.](https://rietta.com/blog/support-does-not-scale-customer/) - [A.R.M. Yourself Against SQL Injection](https://rietta.com/blog/arm-yourself-against-sql-injection/): From a 2006 ACMSE conference talk: protect against SQL injection by validating every input string via ARM: Accept it, Reject it, or Modify it before use. - [Business Analysis of Web Application Information](https://rietta.com/blog/business-analysis-of-web-application-information/): How to use an Excel spreadsheet to pull data from a web application’s SQL server and then perform business analysis on it. - [Extend Firefox: Your Guide to Writing Firefox Extensions](https://rietta.com/blog/extend-firefox-your-guide-to-writing/): A 2005 Georgia Tech student guide to writing Firefox 1.5 extensions, covering toolbar buttons, menu items, and preference panes with sample extension code. - [A product website without pricing information is really annoying!](https://rietta.com/blog/product-website-without-pricing/): A 2005 opinion post on why product websites that hide pricing information are frustrating and likely turn away customers who assume it’s too expensive. - [Saying no to PayPal Phishing Attacks](https://rietta.com/blog/saying-no-to-paypal-phishing-attacks/) - [Upcoming Beta Release: SQL Converter 2 for Excel](https://rietta.com/blog/upcoming-beta-release-sql-converter-2/) - [Less is more! Google offers less talk](https://rietta.com/blog/less-is-more-google-offers-less-talk/): In 2005, I switched grandma to Gmail for its clean, less cluttered interface, and hoped for simpler designs in tech, inspired by Google’s approach. - [WinZIP sold and needs technical improvements.](https://rietta.com/blog/winzip-sold-and-needs-technical/) - [A Little Huffman Coding with Java Tricks](https://rietta.com/blog/little-huffman-coding-with-java-tricks/): Explore Huffman coding in Java: a binary tree method for efficient message encoding, crucial for data compression algorithms like JPEG and ZIP. - [Re: David Bartosik: Why Robots.txt by Matt Benya](https://rietta.com/blog/re-david-bartosik-why-robotstxt-by/) - [Improving my personal efficiency with KDE.](https://rietta.com/blog/improving-my-personal-efficiency-with/): In 2005, I was using KDE on FreeBSD as my laptop OS. Here’s a look into how KDE and Komposé improved my productivity. - [SWT and Swing in the News, Again.](https://rietta.com/blog/swt-and-swing-in-news-again/) - [Part I: Introduction to SQL Injection](https://rietta.com/blog/part-i-introduction-to-sql-injection/) - [Symposium and Onward; SQL Lint](https://rietta.com/blog/symposium-and-onward-sql-lint/) - [The Start of Something Interesting](https://rietta.com/blog/start-of-something-interesting/): The first post to my new blog, written while sitting in the commons area of the College of Computing at Georgia Tech.