I rarely check logs...too time-consuming and I know what I'm gonna see: 5 billion attempts at common exploits from China, Romania, Russia, Cote d'Ivoire, Texas, etc etc etc.
I just don't have time to paw through all that stuff. I used to, but I just don't bother with it any more.
Oh well, off to the buffet at Sno Falls, the wife is buying, woo hoo!
Note to burglars: Not really, I'll be sitting at home in the dark, cleaning my guns and petting the dobermans.
That'll be super popular here in Seattle Washington where the rainy season is from February to January (with a week or so of dry weather in June or July).
Now if they could just get it to generate electricity from "gloomy days" we'd be the world's #1 producer of electrical power.
If you believe words convey accurate information over IM, you know shit about words and IM.
Perhaps you missed the part about "when used properly"?
I've had very little trouble communicating clearly and accurately over IM and other text-based channels, but there's always some imbecile who can't grasp the meaning of words, or who deliberately misconstrues them. Like you, perhaps.
Now, we both know I like ya well enough and I think you're a great guy and all but are you really sure of that? . . . Do you really *know* that you're better than that or is it that their code is distributed to a much wider scope of people?
I've no doubt that these companies face way more hackers and attempts than I do, and probably by people way more skilled than those who attack my sites. I'm sure that more capable hackers are trying to get into the DOD than to any of my sites (but who knows?). But with that said, I still see unbelievably dumb stuff done by large companies that should know better, coding up egregiously bad holes that I know I'd never leave open.
On my side, I do what I can to prevent naughty mischief from occurring.
One of my standard, baked-in bits of code is a sanitizer function. It can be set to allow some stuff in but not others. For example, "allow only numbers and nothing else", or "allow only alphanumeric chars and nothing else", or "allow only alphanumeric and standard punctuation", and so on. So a var coming in that's *supposed* to be only numeric gets set to "only numeric".
It also screens out all sorts of XSS tricks, converts all brackets to HTML entities, cleans up any octal shit or base64 that someone tries to send back, escapes the living shit out of everything, etc etc etc. It limits the length of whatever is coming in to a programmable limit- if I'm expecting 10 chars, it truncates everything down to 10 chars (why would I allow more?). It removes NULL chars, UTF16 two byte encoding, stops directory traversal, defangs URL decode crap, etc etc. It screens for a host of other tricky shit- javascript commands, img lowsrc junk, CSS naughtiness, and so on, including some stuff I won't mention here.:)
I apply this screening function to every bit of data coming in, as well as what comes back out of the database (just in case someone does manage to bypass my input screening and manage to get something directly into the database).
I won't say my sanitizer is perfect, but it's stood the test of time so far. Maybe someday someone will manage to bypass it, but it's taken a pretty good beating so far and hasn't been spoofed to my knowledge. (The usual "I can't know what I don't know" caveats apply.)
My point is, at least I'm trying...whereas some of the exploits I see large companies allow are so mind-numbingly simple/stupid that they make my head spin. They aren't even trying, it's like they're oblivious to some of the oldest and most basic hacks that exist.
Maybe I'm just getting old, but I reached a point in my life 2 or 3 years ago where I no longer felt a need to tell people what an interesting person I am, or how interesting my life is. I don't need FB (etc.) to validate myself, nor do I feel any desire for the whole world to know that I'm currently in $country having $food for $meal.
I must have gotten old at a young age, because I never, ever felt like telling thousands of strangers (or even friends) the minutiae of my life. As if anyone would give a damn what I had for breakfast or what brand of toilet paper I use.
Facebook is the leading cause of narcissism as near as I can tell. It's an endless stream of self-absorbed braggarts spewing their shitformation that no one really cares about, but that they feel compelled to keep up with and respond to. Is it the fear of missing out, or fear of appearing ordinary?
It astounds me that I, a minimally-skilled guy coding away in a home office, apparently have better security practices than huge, multi-billion dollar companies like Motorola, Twitter, Facebook, IBM, Sony, Home Depot, Target, JPMorgan, Instagram, Premera Blue Cross, etc etc etc.
I see this ALL THE FUCKING TIME, and it never ceases to amaze me. I'm basically Joe Shmoe, and yet my lame-ass code routinely screens out these kinds of abuses and exploits. Am I that smart, or are they that dumb??
I would never dream of coding something that included this kind of blatant security hole; it just baffles the hell out of me when I see SQL-injection exploits, GET request exploits, or query-string stupidity like this in modern day code or design.
I mean, HELLO, has no one heard that there are people called "hackers" on the interweb?
As someone else said above, this is 2016- when will these corporate dumbfucks learn to write even minimally secure code??
I'd love that, but sadly a lot of sites won't work worth a crap (or at all) without javascript. That's not the way it should be, but it's the way it is.
Most of my sites run fine with javascript turned off, but a few do rely heavily on jQuery, and there's no good way around that. If you want some useful AJAX response or some nice, clean effects coupled with functionality, sometimes javascript is the way to go.
Windows 10 could come with 10 free blowjobs and I still wouldn't use it.
Hmmmm, I dunno...that would be a pretty compelling feature if you ask me. But first you'd have to explain to the Microsoft Dev Teams what a "blowjob" is cuz I'm fairly sure they're not familiar with them.
How about this: Brave can be viewed as illegal and deceptive, as long as the executives of every company that has either created, paid for, or distributed an advert that had psychologists involved in its design goes to prison.
Or if the executives of every company that has either created, paid for, or distributed an advert that infects my computer is willing to pay for the entire cost of cleanup and data recovery, including punitive damages as well as compensation for pain and suffering, lost business, emotional trauma and whatever else my lawyers can dream up. Then I'll view their ad-laden pages.
NAA says Brave Software "should be viewed as illegal and deceptive by the courts."
Lol, wat?
Seriously, is this grasping at imaginary straws, or what? Let's be clear here: what I do with MY browser on MY internet connection is MY business, not yours. If I choose not to display certain content or (GASP) swap it for other content, that's MY choice and is not reason to try and drag anyone into court.
Then: Users: hey can you give us less intrusive and annoying ads Advertisers: screw you here is your ad
Oh yes, Facebook users are not sharing enough of their petty social drama and that's a "big problem", (for very small values of 'problem').
Never mind all the wars and starvation and the Panama Papers and other shit going on in the world, pay attention because Facebook users aren't sharing enough! OMG whatever will we do???
Oh millennials, is there anything you can't fuck up?
Now if they phrased it such that "the weather is being oppressed by culturally-appropriated microaggressions", you'd see them all rally around the cause and tweet tirelessly until #ClimateChange was fixed.
Slashdot Mirror
"He fell on his head, and he wasn't wearing a helmet,..."
Sounds like a genius to me, who could possibly have foreseen an accident using this stable, proven technology? Oh, wait...
April 1st was over a week ago, but nice try.
The key being "when used properly"... which is actually the same problem as described in this research.
I don't understand what you're saying, could you explain it again using emojis? :)
I rarely check logs...too time-consuming and I know what I'm gonna see: 5 billion attempts at common exploits from China, Romania, Russia, Cote d'Ivoire, Texas, etc etc etc.
I just don't have time to paw through all that stuff. I used to, but I just don't bother with it any more.
Oh well, off to the buffet at Sno Falls, the wife is buying, woo hoo!
Note to burglars: Not really, I'll be sitting at home in the dark, cleaning my guns and petting the dobermans.
That'll be super popular here in Seattle Washington where the rainy season is from February to January (with a week or so of dry weather in June or July).
Now if they could just get it to generate electricity from "gloomy days" we'd be the world's #1 producer of electrical power.
If you believe words convey accurate information over IM, you know shit about words and IM.
Perhaps you missed the part about "when used properly"?
I've had very little trouble communicating clearly and accurately over IM and other text-based channels, but there's always some imbecile who can't grasp the meaning of words, or who deliberately misconstrues them. Like you, perhaps.
Now, we both know I like ya well enough and I think you're a great guy and all but are you really sure of that? . . . Do you really *know* that you're better than that or is it that their code is distributed to a much wider scope of people?
I've no doubt that these companies face way more hackers and attempts than I do, and probably by people way more skilled than those who attack my sites. I'm sure that more capable hackers are trying to get into the DOD than to any of my sites (but who knows?). But with that said, I still see unbelievably dumb stuff done by large companies that should know better, coding up egregiously bad holes that I know I'd never leave open.
On my side, I do what I can to prevent naughty mischief from occurring.
One of my standard, baked-in bits of code is a sanitizer function. It can be set to allow some stuff in but not others. For example, "allow only numbers and nothing else", or "allow only alphanumeric chars and nothing else", or "allow only alphanumeric and standard punctuation", and so on. So a var coming in that's *supposed* to be only numeric gets set to "only numeric".
It also screens out all sorts of XSS tricks, converts all brackets to HTML entities, cleans up any octal shit or base64 that someone tries to send back, escapes the living shit out of everything, etc etc etc. It limits the length of whatever is coming in to a programmable limit- if I'm expecting 10 chars, it truncates everything down to 10 chars (why would I allow more?). It removes NULL chars, UTF16 two byte encoding, stops directory traversal, defangs URL decode crap, etc etc. It screens for a host of other tricky shit- javascript commands, img lowsrc junk, CSS naughtiness, and so on, including some stuff I won't mention here. :)
I apply this screening function to every bit of data coming in, as well as what comes back out of the database (just in case someone does manage to bypass my input screening and manage to get something directly into the database).
I won't say my sanitizer is perfect, but it's stood the test of time so far. Maybe someday someone will manage to bypass it, but it's taken a pretty good beating so far and hasn't been spoofed to my knowledge. (The usual "I can't know what I don't know" caveats apply.)
My point is, at least I'm trying...whereas some of the exploits I see large companies allow are so mind-numbingly simple/stupid that they make my head spin. They aren't even trying, it's like they're oblivious to some of the oldest and most basic hacks that exist.
Maybe I'm just getting old, but I reached a point in my life 2 or 3 years ago where I no longer felt a need to tell people what an interesting person I am, or how interesting my life is. I don't need FB (etc.) to validate myself, nor do I feel any desire for the whole world to know that I'm currently in $country having $food for $meal.
I must have gotten old at a young age, because I never, ever felt like telling thousands of strangers (or even friends) the minutiae of my life. As if anyone would give a damn what I had for breakfast or what brand of toilet paper I use.
Facebook is the leading cause of narcissism as near as I can tell. It's an endless stream of self-absorbed braggarts spewing their shitformation that no one really cares about, but that they feel compelled to keep up with and respond to. Is it the fear of missing out, or fear of appearing ordinary?
If you can't express yourself with pure text, you are an idiot anyway.
Agreed. Emojis are the confetti of the internet.
Well then maybe, JUST MAYBE....people shouldn't use emojis for actual communication where meaning might be important.
I've heard that there are these things called "words", which, when used properly, have the amazing ability to convey information accurately.
I swear, soon we'll be back to grunting and painting pictures of animals by smearing our feces on cave walls.
Not good enough. A foot-thick plate of this stuff still wouldn't protect me from my ex-wife's "Stare Of Death".
That bitch could galvanize a battleship with just a look. You guys know the look I'm talking about.
It astounds me that I, a minimally-skilled guy coding away in a home office, apparently have better security practices than huge, multi-billion dollar companies like Motorola, Twitter, Facebook, IBM, Sony, Home Depot, Target, JPMorgan, Instagram, Premera Blue Cross, etc etc etc.
I see this ALL THE FUCKING TIME, and it never ceases to amaze me. I'm basically Joe Shmoe, and yet my lame-ass code routinely screens out these kinds of abuses and exploits. Am I that smart, or are they that dumb??
I would never dream of coding something that included this kind of blatant security hole; it just baffles the hell out of me when I see SQL-injection exploits, GET request exploits, or query-string stupidity like this in modern day code or design.
I mean, HELLO, has no one heard that there are people called "hackers" on the interweb?
As someone else said above, this is 2016- when will these corporate dumbfucks learn to write even minimally secure code??
Someone needs to be penalized for this, but I'd bet a million dollars no one will be held accountable in any significant way.
flushing money down the toilet can be a good strategy for tax purposes if nothing else
My philosophy on getting rid of unwanted money boils down to "hookers and blow". It's been pretty damn effective so far.
By disabling JavaScript.
I'd love that, but sadly a lot of sites won't work worth a crap (or at all) without javascript. That's not the way it should be, but it's the way it is.
Most of my sites run fine with javascript turned off, but a few do rely heavily on jQuery, and there's no good way around that. If you want some useful AJAX response or some nice, clean effects coupled with functionality, sometimes javascript is the way to go.
Windows 10 could come with 10 free blowjobs and I still wouldn't use it.
Hmmmm, I dunno...that would be a pretty compelling feature if you ask me. But first you'd have to explain to the Microsoft Dev Teams what a "blowjob" is cuz I'm fairly sure they're not familiar with them.
even if the SCO suit dies, we'll still have Microsoft's mobile *giggle* strategy *snort*.
Lol, you mean the "Wait for us- we're the leader!" strategy, or the "That looks good, let's make a shitty copy of it" strategy?
And by " less important" they mean "content for which the owners haven't paid us not to interfere with".
The Yahoo directors couldn't fight their way out of a wet paper bag with a chainsaw in each hand, so it's hard to see how it could get any worse.
Wait, you say Verizon is going to buy it? Holy shit, prepare to hit bottom and plunge to the center of the Earth.
I'm curious....what kind of head injuries do the people at Verizon have, anyway?
It's like they all got together and said, "We have a shitload of money...how can we flush it down a toilet to best effect?"
Yep. For me it's:
Forbes: Please disable your adblocker
Me: (clicks on Close Window button)
How about this: Brave can be viewed as illegal and deceptive, as long as the executives of every company that has either created, paid for, or distributed an advert that had psychologists involved in its design goes to prison.
Or if the executives of every company that has either created, paid for, or distributed an advert that infects my computer is willing to pay for the entire cost of cleanup and data recovery, including punitive damages as well as compensation for pain and suffering, lost business, emotional trauma and whatever else my lawyers can dream up. Then I'll view their ad-laden pages.
NAA says Brave Software "should be viewed as illegal and deceptive by the courts."
Lol, wat?
Seriously, is this grasping at imaginary straws, or what? Let's be clear here: what I do with MY browser on MY internet connection is MY business, not yours. If I choose not to display certain content or (GASP) swap it for other content, that's MY choice and is not reason to try and drag anyone into court.
Then:
Users: hey can you give us less intrusive and annoying ads
Advertisers: screw you here is your ad
Now:
Advertisers: hey please don't block our ads thanks
Users: screw you
Oh yes, Facebook users are not sharing enough of their petty social drama and that's a "big problem", (for very small values of 'problem').
Never mind all the wars and starvation and the Panama Papers and other shit going on in the world, pay attention because Facebook users aren't sharing enough! OMG whatever will we do???
Oh millennials, is there anything you can't fuck up?
Now if they phrased it such that "the weather is being oppressed by culturally-appropriated microaggressions", you'd see them all rally around the cause and tweet tirelessly until #ClimateChange was fixed.