Look at the special effects in The Thing (prequel, from this year). They're nowhere near as scary as the original. They don't look any more real IMO. The special effects in the original were disgusting and horrifying. The new one just looks like the necromorphs from Dead Space.
Yeah why don't you bring up Pokemon or some other little 2-bit franchise next. The only things that deserve copyright are Disney property, Chuck Norris / Steven Seagal movies and Larry the Cable Guy.
It's a valid concern, last I remember the only thing Chrome sends off is search requests as you type them, but now Firefox does that too (to use the search provider's autocomplete feature). Of course if you don't want to trust Chrome there's always Chromium.
You joke but Facebook has some in-house tool that converts PHP directly into x86 code, and then this is what actually runs when a page loads. I don't know what mechanism they use to pass the URIs to the executables but it would be most efficient for the http server process to do it directly, eliminating the PHP server entirely on the production site.
In either case, wouldn't doing this with the ~/.macromedia directory cause many Flash apps (especially video players that rely on the LSOs for storing buffered video) to malfunction?
Facebook's "like" button is a tracking widget, that loads a page which then contains JS to do more in-depth analytics if you're not using a script blocker. The page the Like button fetches is probably what the test page checks for.
But in order not to further scare you, if you turn off javascript, 80% of the connecting adnetworks won't load any ads (and their profiling stuff) and if you both turn of all you're scripting and caching, I won't be able to profile much besides your visits to sites running within our ad network.
Haha if only. A lot (and I mean A LOT) of tracking services use pure HTML tracking, to disable them you have to control cross-domain requests. Ghostery or RequestPolicy are good plugins for doing this.
There's a browser plugin you can use to anonymize Google queries, although if you signed up for a Gmail account in a more innocent time like I did and haven't migrated to your own hosting yet, the best thing you can do to reduce your Google footprint is to open your Gmail/Google Reader/Youtube/whatever pages in a separate browser from everything else. Firefox could use "tab sandboxing" - where individual tabs can be like their own private browsing session, basically. I think Chrome has something like that.
Here's an idea to kill the cache attack, have cache loading speed simulate the network connection speed: Have the browser gather stats on its network use. Say the average load speed (call it AVGSPD) is 100KBps and the average lag (call it AVGLAG) is 0.5s. If it's about to load a big 500KB image from cache, it first introduces a delay of AVGLAG*random(0.5,1.5), and then an additional delay of FILESIZE/(AVGSPD*random(0.9,1.1)), so fetching the file would take somewhere around 5 seconds. This simulates the slowdown of fetching the file over the network but doesn't use any additional bandwidth. It will make page loads look a bit less snappy but will kill this cache attack.
However this could still be defeated by using an AJAX script or something to have an attacking server and client script work together to basically gauge the user's connection speed while downloading a large file with a dynamic URL from the attacking server, and then trying to load data from websites and checking for a connection speed drop. If it doesn't drop that means the file was cached, but at least the practicality and stealth of the attack is reduced.
Yep and we'll all be able to run it on our ultra-expensive specialty OpenPCs, turning all of open computing into an obscure FOSS project for hackers. But it won't disappear entirely, so relax!
Good point, there's nothing to worry about, we'll always be able to get open PCs built to order from Klupendorf Custom Computers in Switzerland, and put Linux on them, and run them in our basements. The future of computing is safe!
Strange, I've been going the opposite way. In the early/mid 2000s I had a Treo 180, which acted as a PDA and cell phone, but then I also had an MP3/CD player and a consumer digicam. Then my Treo 650 absorbed the role of the MP3 player but the camera wasn't very good. Next my N900 absorbed the role of the camera as well. If the world wasn't so bass-ackwards, I'd expect the next step would be for the next PDA/phone to absorb the role of the laptop with something like an Atrix, but instead I'm looking at crazy hacked-up custom solutions again (Droid 4 GSM variant running Debian/MeeGo?), and I don't think any company will save me the work by making an open device out of the blue this time.
Yep I find that many of the tech-challenged have a huge array of gadgets that could be brought down to one. Examine my sister's set of devices for example: She has a Blackberry, iPod (old type, for music), pocket digicam, and now she's shopping for a Kindle Fire.
My N900 alone can do more than all of those combined. Maybe also including her netbook.
Slashdot Mirror
Moon was also done on a tiny (by today's standards) effects budget, the outdoor scenes were just miniatures.
Look at the special effects in The Thing (prequel, from this year). They're nowhere near as scary as the original. They don't look any more real IMO. The special effects in the original were disgusting and horrifying. The new one just looks like the necromorphs from Dead Space.
It doesn't make sense for the use in this article but for Facebook and other hosts of popular services it makes a lot of sense.
Ah thanks, I hadn't heard of it in a while, didn't know Facebook open-sourced it.
I think Ralph E. Wolf and Sam Sheepdog are a better analogy...
Yeah why don't you bring up Pokemon or some other little 2-bit franchise next. The only things that deserve copyright are Disney property, Chuck Norris / Steven Seagal movies and Larry the Cable Guy.
You horrible sick fuck!
It's not astroturfing, it's trolling. We all come in to poo-poo the stupid article and it drives up ad revenue.
Sorry but I'm forced to think this, with the increasing number of clearly troll articles that are making it through these days.
It's stylish AS FUCK
It's a valid concern, last I remember the only thing Chrome sends off is search requests as you type them, but now Firefox does that too (to use the search provider's autocomplete feature). Of course if you don't want to trust Chrome there's always Chromium.
You joke but Facebook has some in-house tool that converts PHP directly into x86 code, and then this is what actually runs when a page loads. I don't know what mechanism they use to pass the URIs to the executables but it would be most efficient for the http server process to do it directly, eliminating the PHP server entirely on the production site.
In either case, wouldn't doing this with the ~/.macromedia directory cause many Flash apps (especially video players that rely on the LSOs for storing buffered video) to malfunction?
If that's overkill for your requirements, I recommend Ghostery, which uses a blacklisting approach and includes a long list of tracking/ad services.
Facebook's tracking is just the tip of the iceberg...look at Ghostery's downloadable blocklist.
It's definitely not easy enough for the average user. My dad's better than average with computers and he struggles with it sometimes.
Facebook's "like" button is a tracking widget, that loads a page which then contains JS to do more in-depth analytics if you're not using a script blocker. The page the Like button fetches is probably what the test page checks for.
But in order not to further scare you, if you turn off javascript, 80% of the connecting adnetworks won't load any ads (and their profiling stuff)
and if you both turn of all you're scripting and caching, I won't be able to profile much besides your visits to sites running within our ad network.
Haha if only. A lot (and I mean A LOT) of tracking services use pure HTML tracking, to disable them you have to control cross-domain requests. Ghostery or RequestPolicy are good plugins for doing this.
There's a browser plugin you can use to anonymize Google queries, although if you signed up for a Gmail account in a more innocent time like I did and haven't migrated to your own hosting yet, the best thing you can do to reduce your Google footprint is to open your Gmail/Google Reader/Youtube/whatever pages in a separate browser from everything else. Firefox could use "tab sandboxing" - where individual tabs can be like their own private browsing session, basically. I think Chrome has something like that.
Here's an idea to kill the cache attack, have cache loading speed simulate the network connection speed: Have the browser gather stats on its network use. Say the average load speed (call it AVGSPD) is 100KBps and the average lag (call it AVGLAG) is 0.5s. If it's about to load a big 500KB image from cache, it first introduces a delay of AVGLAG*random(0.5,1.5), and then an additional delay of FILESIZE/(AVGSPD*random(0.9,1.1)), so fetching the file would take somewhere around 5 seconds. This simulates the slowdown of fetching the file over the network but doesn't use any additional bandwidth. It will make page loads look a bit less snappy but will kill this cache attack.
However this could still be defeated by using an AJAX script or something to have an attacking server and client script work together to basically gauge the user's connection speed while downloading a large file with a dynamic URL from the attacking server, and then trying to load data from websites and checking for a connection speed drop. If it doesn't drop that means the file was cached, but at least the practicality and stealth of the attack is reduced.
Yep and we'll all be able to run it on our ultra-expensive specialty OpenPCs, turning all of open computing into an obscure FOSS project for hackers. But it won't disappear entirely, so relax!
Thanks for the new sig! Mod parent to +5!
Good point, there's nothing to worry about, we'll always be able to get open PCs built to order from Klupendorf Custom Computers in Switzerland, and put Linux on them, and run them in our basements. The future of computing is safe!
Vs. the iShiny where if the device doesn't do what you want and it's not a bug, you can go pound sand.
Strange, I've been going the opposite way. In the early/mid 2000s I had a Treo 180, which acted as a PDA and cell phone, but then I also had an MP3/CD player and a consumer digicam. Then my Treo 650 absorbed the role of the MP3 player but the camera wasn't very good. Next my N900 absorbed the role of the camera as well. If the world wasn't so bass-ackwards, I'd expect the next step would be for the next PDA/phone to absorb the role of the laptop with something like an Atrix, but instead I'm looking at crazy hacked-up custom solutions again (Droid 4 GSM variant running Debian/MeeGo?), and I don't think any company will save me the work by making an open device out of the blue this time.
Yep I find that many of the tech-challenged have a huge array of gadgets that could be brought down to one. Examine my sister's set of devices for example: She has a Blackberry, iPod (old type, for music), pocket digicam, and now she's shopping for a Kindle Fire.
My N900 alone can do more than all of those combined. Maybe also including her netbook.