The above example said Checkpoint was only vunerable when both were open at the same time.
While that does happen, it probably would be extremely rare.
And the "attacker" would have to pre-craft the page. This would be easily defeated by simply dynamically generating each page and giving a short time to live.
The attacker would need to know the dynamically generated ID and He'd need to know it before that page expired and He'd need to get that code into his webpage that you were looking at.
Sure, this "attack" would work on static pages. Or pages that use a guessable format (based upon "screen name" or some such). But that's about it.
I may be wrong, but I think Amazon already implements something like that. I cannot bookmark my "shopping cart" page... and then go into it from a different computer with a different IP address. Even if I'm logged into Amazon on both computers.
There seem to be a lot ways to defeat this "sleeping giant" of a vulnerability. And most of them seem to related to basic security practices by the websites themselves.
"Solving" this at the firewall level just seems... weird.
CSRF works like this: An attacker identifies a URL on a Website -- such as Netflix or a bank -- that initiates typical Web functions such as making a purchase, changing an email address or transferring funds. "The attacker takes that URL and loads it to a Web page they control," White Hat's Grossman says.
The actual attack occurs when the user visits the attacker-controlled Web page via a legit link, which forces the browser -- using legitimate, authenticated cookies -- to make malicious requests. The user has no clue as to what's happening.
And the catch is that neither the original Website nor the user's computer is necessarily compromised, Grossman says.
Wouldn't this be easily killed by simply having the webpage dynamically generate a page with a life of 15 minutes or less?
Or even by using some basic encryption that involves the IP address of the original request?
About 100 million fingerprints have been taken so far, and more than 34,000 people whose names showed up on U.S. watch lists were denied entry, Wright said.
If they're dangerous enough to be on a "watch list" why aren't we arresting them when we catch them?
Oh, too dangerous to be allowed in... but not dangerous enough to arrest.
You've been rejected at this border point. Please try another border point for entry.
Yeah, just like in the old King's Quest games. Or just about anything from Sierra's old line.
If you're looking for history books, it'll say "HISTORY" on the shelves.
Again, just like the old games. If you're looking for the "armourer", you look for the shop with the say saying "armourer".
Not to mention they ignore the obvious solution of walking up to said librarian and asking "Excuse me, could you tell me where the history section is?" And then they tell you, and all is well.
It's like a trip down Memory Lane.:)
Just like in the old games. You walk up to EVERY person you see and you talk to them.
The ONLY difference (and this is a BIG one, folks) is that you do NOT pick up everything you find and put it in your pack to see if you can use it later. Aside from that minor point, using the library is EXACTLY like the old video games.
Yes, we have many books here. May I help you find a particular one?
Say "dragon."
Yes, we have a few books on dragons. Would you be interested in any particular subject such as fantasy dragons or pictures of dragons or hunting dragon?
Say "hunting".
Yes, here is a book on how to hunt dragons. If you spend the next 2 hours reading it, you will gain a level in your dragon hunting skill. I will check this book out to you. It is due back in 2 weeks.
What we are talking about is that librarians frequently know jack diddly shit about computers.
Seeing as how the subset of "Librarians" is selected from the set of "everyone", why would they know any less, on average, than the average person?
In fact, in my experience they have a deeper understanding of how to SEARCH for information than the average person. It comes from getting requests like "it's that book that was on Oprah a while ago".
The internet is the greatest information-gathering tool on the planet, so if you don't know how to use it, you're horribly crippled in terms of being able to find information, in comparison with those who do know how to find it.
And... ?
So what if the librarian's Google-fu is weak? You've already exploited the Internet and have found the exact book you want. So you go to the tech-ignorant librarian and give him/her the exact title, author, publisher, date, etc.
I'm not seeing the problem here.
The only time there WOULD be a problem is: #1. The person cannot find the book s/he wants. #2. The person cannot find it on the Internet. #3. The person cannot effectively communicate WHICH book it is to the librarian. #4. The librarian cannot understand what that person is saying.
And again, given that librarians are used to vague requests, I'm not seeing that #4 would be much of a barrier.
I am afraid that there isn't much that can be done to make library's functional to today's youth.
But libraries haven't changed much in the past 2,000+ years. They worked for everyone else. Why have they failed now?
Most people are not getting their own books anymore and therefore don't need anything to look up their locations.
This probably isn't directed at me because I'm old and I live 2 blocks from the local library. I search online to find the book I want, then I place "hold" on it and I receive an email when it is ready for me to pick up.
But I can still find the section in the library where the book WOULD have been shelved and I can go to that location to find what OTHER books are there.
From TFA:
With video games, "you can play while you are inept," he said. There is also an assumption that players of games are rewarded for "exploring," even if they don't achieve the goal they have set out to achieve. "Lowered consequences of failure" is a key value to embrace, he said.
And in most video games we have what is called "the grind". Or "leveling up".
Do we really want to include THAT in the experience of using the library? I don't think so.
The video game analogy breaks down with the library because in the video game you are given tasks to accomplish. The library will not give you any tasks. It is up to YOU to determine what YOU want to do and how YOU define "success".
There is no 10th level reader or 60th level book browser. There is just a collection of materials available for your use.
By your standard, addictive drugs don't exist because there are some people who don't get addicted to drugs. That's crazy talk.
No. By my standard, a drug would only be considered "addictive" if the people who became addicted to it did NOT share any characteristic OTHER than the use of that drug.
It's called "science".
Here's a crazy theory for you. Take the group of people who are "addicted" to video games and take away their games, but give them access to porn. You'll find that now they are "addicted" to porn.
Now take away the porn and give them something else. They'll become "addicted" to that.
And so on.
The problem is that SCIENCE is being ignored. It isn't about finding out if something IS addictive.
It is now about "proving" that ANYTHING is "addictive"... by finding a group that will claim to be addicted to it. And that means finding the group that can be "addicted" to whatever is being claimed at the moment.
Yeah, and I can spend days and weeks drinking booze and not feel the slightest twinge the next week when I have to be a responsible human being.
So you are not subject to becoming an addict to alcohol.
That doesn't mean alcoholism doesn't exist.
No, that isn't what I said.
Look at the similarities between the members of the groups that DO become addicted and those that DO NOT become addicted.
If the only similarity amongst the addicted group is the substance itself, then that substance is addictive.
If the members of that group share OTHER characteristics (depression, obsessive/compulsive, etc) that the other group does NOT share, then the focus SHOULD be on whether those characteristics are the "addiction" that is being claimed.
In your alcohol example, genetic pre-dispositions HAVE been discovered. But those do NOT account for all of the cases of alcoholism.
You sound like any drug addict or alcoholic: "I can quit any time I want." One of the signs of addiction is denial.
By that "logic", everything is addictive and everyone is an addict.
Here's a free clue, it's not denial if it is factual.
The first definition is the one of interest: 'causing or tending to cause addiction'. So yes, just because someone can become addicted to an object (in this case, playing video games), yes, it does necessarily mean that that object is addictive.
You have that backwards.
Because someone is prone to addictive behaviour does not mean that whatever they focus upon is, in itself, addictive.
Studies have been done, yes. My wife has particpated in such studies, in fact.
Then you should have no problem citing them here. Right? No problem at all.
Except that you won't be able to do so because such studies do not exist.
No one has yet shown that an otherwise mentally healthy individual WILL BECOME ADDICTED to video games after playing them X hours.
But feel free to refute me by citing the studies that your wife has participated in. Go ahead.
Example, take someone who has passed the mental exams and shows NO tendency towards obsessive/compulsive behaviours and then DEMONSTRATE that such a person can become addicted to video games after X hours of playing.
I'm still not buying it. I've played video games and I have no problem leaving them.
I've played slot machines and I have no problem leaving them.
Just because someone can become "addicted" to something does NOT mean that it is addictive. But then, I'm not an "expert" here. Just someone who can try these so called "addictive" activities and still remain un-addicted.
Their planning begins years ahead of time, often working on systems three generations beyond the ones that they're currently installing. Problems with designs can push power usage for a given system much higher than planned, and it can take time to get the power systems in place.
That doesn't matter. They're supposed to have some VERY smart people on staff there. For some reason they cannot plan for possible errors?
NSA is a naturally paranoid agency; they take all of their information sources and know that someone else is looking at exactly those to analyze them, so they don't want anyone to know exactly how much power they're using because that may provide a clue as to the computing capacity that they have.
A better approach would be to use TOO MUCH power so that the "enemy" thinks that you're doing more work than you are.
I have to fight to get the power requirements and AC over engineered where I work. And that's at a company that has to show a profit.
Do you believe that your real friends WOULD make exceptions for you not having a cell phone because you made a deal that got you a million pounds?
Do you believe that the love of your life WOULD make exceptions for you not having a cell phone because you made a deal that got you a million pounds?...
Or is it that you believe that your real friends would not make the EXTRA EFFORT to include you because you don't have a cell phone?
Or is it that you believe that the love of your life would not make the EXTRA EFFORT to see you because you don't have a cell phone?...
Meet a cute girl or boy? Give 'em your landline and hope they call when you're at home (and your parents don't answer and embarrass you, or your stoner roommate doesn't answer and forget to take a message).
Really, if you're worth a million pounds, she'll find you.
Maybe the bigger surprise is that supposedly materialistic youngsters actually recognized the value of friendship over money.
Friends will understand that you don't have the access that they do... but that you have WAY more money.
Believe it or not, we used to be able to get together and even find mates before cell phones and pagers. Even before answering machines.
Rather, I'm betting that this "survey" didn't have the cash in hand when they asked that question.
Emphasis on the light, please.
on
Vertical Farming
·
· Score: 4, Insightful
Anyone who's worked in even the most windowed office building knows that only the spaces next to the windows get the light.
Plants need light to grow. The windows can only supply so much. So the other light has to be artificially produced (which eats energy).
The soil, the water, fertilization, etc can all be handled fairly naturally. But some of it will have to be imported. This is not "self sustained" by any means.
But the biggest factor is energy consumption. Is it cheaper to spend the energy to move crops from 100% natural light into the city or is it cheaper to spend the energy on artificial light and grow the crops inside the city?
Slashdot Mirror
the 9/11 terrorists had legitimate ID's.
This does nothing to stop terrorists or terrorism.
While that does happen, it probably would be extremely rare.
And the "attacker" would have to pre-craft the page. This would be easily defeated by simply dynamically generating each page and giving a short time to live.
The attacker would need to know the dynamically generated ID
and
He'd need to know it before that page expired
and
He'd need to get that code into his webpage that you were looking at.
Sure, this "attack" would work on static pages. Or pages that use a guessable format (based upon "screen name" or some such). But that's about it.
You'll be looking for the solution to a problem on a web page and trying it on your firewall.
In that rare instance, I can see this as being a potential problem.
I may be wrong, but I think Amazon already implements something like that. I cannot bookmark my "shopping cart" page ... and then go into it from a different computer with a different IP address. Even if I'm logged into Amazon on both computers.
... weird.
There seem to be a lot ways to defeat this "sleeping giant" of a vulnerability. And most of them seem to related to basic security practices by the websites themselves.
"Solving" this at the firewall level just seems
Wouldn't this be easily killed by simply having the webpage dynamically generate a page with a life of 15 minutes or less?
Or even by using some basic encryption that involves the IP address of the original request?
sheesh!
If they're dangerous enough to be on a "watch list" why aren't we arresting them when we catch them?
Oh, too dangerous to be allowed in
You've been rejected at this border point. Please try another border point for entry.
Yeah, just like in the old King's Quest games. Or just about anything from Sierra's old line.
Again, just like the old games. If you're looking for the "armourer", you look for the shop with the say saying "armourer".
It's like a trip down Memory Lane.
Just like in the old games. You walk up to EVERY person you see and you talk to them.
The ONLY difference (and this is a BIG one, folks) is that you do NOT pick up everything you find and put it in your pack to see if you can use it later. Aside from that minor point, using the library is EXACTLY like the old video games.
You're in an unfamiliar place.
...... so, where's the problem?
You see a person behind a desk.
Go to desk.
Say "hi"
Hello. How may I help you?
Say "book".
Yes, we have many books here. May I help you find a particular one?
Say "dragon."
Yes, we have a few books on dragons. Would you be interested in any particular subject such as fantasy dragons or pictures of dragons or hunting dragon?
Say "hunting".
Yes, here is a book on how to hunt dragons. If you spend the next 2 hours reading it, you will gain a level in your dragon hunting skill. I will check this book out to you. It is due back in 2 weeks.
Leave.
You have left.
Get soda.
You have a soda.
Seeing as how the subset of "Librarians" is selected from the set of "everyone", why would they know any less, on average, than the average person?
In fact, in my experience they have a deeper understanding of how to SEARCH for information than the average person. It comes from getting requests like "it's that book that was on Oprah a while ago".
And
So what if the librarian's Google-fu is weak? You've already exploited the Internet and have found the exact book you want. So you go to the tech-ignorant librarian and give him/her the exact title, author, publisher, date, etc.
I'm not seeing the problem here.
The only time there WOULD be a problem is:
#1. The person cannot find the book s/he wants.
#2. The person cannot find it on the Internet.
#3. The person cannot effectively communicate WHICH book it is to the librarian.
#4. The librarian cannot understand what that person is saying.
And again, given that librarians are used to vague requests, I'm not seeing that #4 would be much of a barrier.
But libraries haven't changed much in the past 2,000+ years. They worked for everyone else. Why have they failed now?
This probably isn't directed at me because I'm old and I live 2 blocks from the local library. I search online to find the book I want, then I place "hold" on it and I receive an email when it is ready for me to pick up.
But I can still find the section in the library where the book WOULD have been shelved and I can go to that location to find what OTHER books are there.
From TFA:
And in most video games we have what is called "the grind". Or "leveling up".
Do we really want to include THAT in the experience of using the library? I don't think so.
The video game analogy breaks down with the library because in the video game you are given tasks to accomplish. The library will not give you any tasks. It is up to YOU to determine what YOU want to do and how YOU define "success".
There is no 10th level reader or 60th level book browser. There is just a collection of materials available for your use.
And there are no cheat codes. You learn it.
And that is different from anyone else
Haven't us guys ALWAYS been accused of skipping the instructions? Be it stereo or bicycle or whatever.
Apparently everything old is now new.
No. By my standard, a drug would only be considered "addictive" if the people who became addicted to it did NOT share any characteristic OTHER than the use of that drug.
It's called "science".
Here's a crazy theory for you. Take the group of people who are "addicted" to video games and take away their games, but give them access to porn. You'll find that now they are "addicted" to porn.
Now take away the porn and give them something else. They'll become "addicted" to that.
And so on.
The problem is that SCIENCE is being ignored. It isn't about finding out if something IS addictive.
It is now about "proving" that ANYTHING is "addictive"
Yeah, sure you can. So why don't you just do that? Hmmmmm?
I'm sure that Jack Thompson would just LOVE to have such a study to boost his cases.
So, until you actually get around to posting it, I'll just leave you here with your claims. kthxbuy
So you are not subject to becoming an addict to alcohol.
No, that isn't what I said.
Look at the similarities between the members of the groups that DO become addicted and those that DO NOT become addicted.
If the only similarity amongst the addicted group is the substance itself, then that substance is addictive.
If the members of that group share OTHER characteristics (depression, obsessive/compulsive, etc) that the other group does NOT share, then the focus SHOULD be on whether those characteristics are the "addiction" that is being claimed.
In your alcohol example, genetic pre-dispositions HAVE been discovered. But those do NOT account for all of the cases of alcoholism.
By that "logic", everything is addictive and everyone is an addict.
Here's a free clue, it's not denial if it is factual.
You have that backwards.
Because someone is prone to addictive behaviour does not mean that whatever they focus upon is, in itself, addictive.
Then you should have no problem citing them here. Right? No problem at all.
Except that you won't be able to do so because such studies do not exist.
No one has yet shown that an otherwise mentally healthy individual WILL BECOME ADDICTED to video games after playing them X hours.
But feel free to refute me by citing the studies that your wife has participated in. Go ahead.
Example, take someone who has passed the mental exams and shows NO tendency towards obsessive/compulsive behaviours and then DEMONSTRATE that such a person can become addicted to video games after X hours of playing.
I'm still not buying it. I've played video games and I have no problem leaving them.
I've played slot machines and I have no problem leaving them.
Just because someone can become "addicted" to something does NOT mean that it is addictive. But then, I'm not an "expert" here. Just someone who can try these so called "addictive" activities and still remain un-addicted.
That doesn't matter. They're supposed to have some VERY smart people on staff there. For some reason they cannot plan for possible errors?
A better approach would be to use TOO MUCH power so that the "enemy" thinks that you're doing more work than you are.
I have to fight to get the power requirements and AC over engineered where I work. And that's at a company that has to show a profit.
Why have they failed to do so?
But it would be interesting to see some players form a non-profit company whose only assets were in-game.
Does the government REALLY understand what it's getting into? I don't think so.
What about theft? Or ganking? If it is taxable, does the loss of it reduce your taxes?
The degree is good, but it isn't worth any where as much as the demonstration of your coding skills and how well you can work with others.
Just graduating is sufficient IF you can show solid code, good practices and the ability to work with others on that project.
I'd lead with the project and just leave everything else as resume filler.
Remember the anthrax mailings?
Did those count as an attack?
What was done? Who was caught?
Here, let me make it a bit easier for you.
...
...
Do you believe that your real friends WOULD make exceptions for you not having a cell phone because you made a deal that got you a million pounds?
Do you believe that the love of your life WOULD make exceptions for you not having a cell phone because you made a deal that got you a million pounds?
Or is it that you believe that your real friends would not make the EXTRA EFFORT to include you because you don't have a cell phone?
Or is it that you believe that the love of your life would not make the EXTRA EFFORT to see you because you don't have a cell phone?
Is that clearer for you?
Really, if you're worth a million pounds, she'll find you.
Friends will understand that you don't have the access that they do
Believe it or not, we used to be able to get together and even find mates before cell phones and pagers. Even before answering machines.
Rather, I'm betting that this "survey" didn't have the cash in hand when they asked that question.
Anyone who's worked in even the most windowed office building knows that only the spaces next to the windows get the light.
Plants need light to grow. The windows can only supply so much. So the other light has to be artificially produced (which eats energy).
The soil, the water, fertilization, etc can all be handled fairly naturally. But some of it will have to be imported. This is not "self sustained" by any means.
But the biggest factor is energy consumption. Is it cheaper to spend the energy to move crops from 100% natural light into the city or is it cheaper to spend the energy on artificial light and grow the crops inside the city?
Gotta agree with that. If they were competent, they'd have their own house in order.
Just as anyone here who's competent with a computer has their systems up-to-date and tuned.
I'm so bleeding smart that I don't know the basics about what I've just claimed to be so smart about.
Check out Amazon's "One Click" patent. Go ahead.