Slashdot Mirror


User: Red+Flayer

Red+Flayer's activity in the archive.

Stories
0
Comments
7,881
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 7,881

  1. Re:How does this change userland? on New Firefox Standard Aims to Combat Cross-Site Scripting · · Score: 1

    If you're slightly paranoid like I am, how would you know to trust the provided list of "trusted script serving sites"?

    At some point, you need to trust *someone* to tell you who else you can trust... and that'll always be a problem.

  2. Re:How does this change userland? on New Firefox Standard Aims to Combat Cross-Site Scripting · · Score: 3, Insightful

    How are *you* going to know that it is ok to run scripts on Slashdot.org that originate from slashdotscripts.com and not scriptsforslashdot.com? Even if you are a lunatic and micromanage the trusted sources of these scripts, how would selectively running any of them do you any good?

    Dare I say it?

    Site XXXX is attempting to run a script on site YYYY.
    (C)ANCEL or (A) LLOW?

    All snark aside, why would I allow either of those domains to run a script on slashdot.org? Since I trust slashdot to a certain extent, I would allow from scripts.slashdot.org. But allowing scripts from a completely different domain? No way.

    The point is that my security policy is annoying to implement. For site mybank.com I need to enable scripting. But if things were perfect, I could enable only for scripts from $SUBDOMAIN.mybank.com, so I don't get hosed by scripts from $HACKERSITE.bankmy.com. And if legitimate sites are hosting their scripts from an entirely different domains... well, that would have to change. Instead I have to take an all-or-none approach, since the sites I need security the most on are the ones where I need to enable scripting. That just sucks.

  3. Re:Old Standard to Prevent All Attacks on New Firefox Standard Aims to Combat Cross-Site Scripting · · Score: 1

    Don't depend on user-generated content, since it's shit. If your site can't provide it's own content, at least properly filter incoming user content down to plain ol' text.

    Hey! It doesn't need to be plain ol' text.

    As a theoretical, it could be hamstrung html that pisses off some users by not recognizing UTF-8 in order to prevent malicious posting.

    Or something. I'm sure we could figure out a decent implementation.

  4. How does this change userland? on New Firefox Standard Aims to Combat Cross-Site Scripting · · Score: 4, Insightful

    I will still run with noscript installed because I've yet to see a good XSS-preventing implementation that will allow *me*, as a user, to easily define what sites can run scripts on the sites I visit. And when I visit a site where I need to disable noscript, I have no other tabs/browsers open.

    I'm sorry, but NO site can be trusted 100% from a user's perspective... and giving site owners the tools to help prevent XSS from their side doesn't help with the fact that users still shouldn't trust absolutely.

    The reason something like this scares me is that it lulls users into a higher level of trust... and doesn't protect them from hacked sites, or sites that choose not to implement this.

    Of course, I'm slightly paranoid. And of course, this isn't transparent to Joe Sixpack, so he's going to trust|!trust based on whatever it is he's basing it on now. And for security-critical sites like banks, this is a good thing... but I try very hard to make sure my friends & family are a bit paranoid too, so they'll take precautions.

  5. Re:...it's probably more effective... on China Bans Gold Farming · · Score: 1

    Sometimes treating your employees like crap is more about shoring up your own inferiority complex than it is smart business decision. If you haven't experienced it directly, go reread Thomas More and George Orwell to get the gist of it.

    Of course, in a competitive system, the people who make smart business decisions end up being the successful businesses. And gold farming is a competitive business.

    Just to note, I've worked my share of crappy jobs... I just knew enough to get the hell out. It became a lot easier once I had experience under my belt and knew I would land on my feet no matter what.

  6. Re:BMI Is not a Good Measure on Being Slightly Overweight May Lead To Longer Life · · Score: 1

    Once again I am reminded that the text format conveys sarcasm very poorly.

  7. Re:More room but---- on Graphene Could Make Magnetic Memory 1000x Denser · · Score: 1

    So one day the atoms might just realize that they've been tricked and you'll end up with your computer on fire because your benzene chains have all broken and you end up with 2-methyl-1,3,5-trinitrobenzene

    Meh. That'll only be a problem for the overclockers with liquid nitrogen cooling. The rest of us will just end up with a pile of cobalt and a bunch of hexamethyl chickenwire.

  8. Re:BMI Is not a Good Measure on Being Slightly Overweight May Lead To Longer Life · · Score: 1

    BMI is a nice quick rule-of-thumb, but the better test is to see how long it takes for you to get winded running at a moderate pace.

    For testing health? Bah. Better test would be to see how long it takes you to get winded screwing at a medium pace.

    Besides, I'm not as concerned about my health in re: longevity. What's important is my evolutionary health.

    And I can pretty much guarantee that I'll have many more chances to sire crotch potatoes on random women if I'm at the "ideal" weight instead of "slightly obese".

  9. Re:Keep telling yourselves that on Google Claims They "Just Aren't That Big" · · Score: 1

    Other posters have pointed them out, if you browse through the comments you'll see them.

    Besides which you conveniently ignore my main point, which is that ANY web service is a competitor to Google.

    So yeah... let me know if you still stand behind your contention that Google is acquiring companies that in no way compete with them. And if you do still believe that, can you please explain why you believe it? Because I'm in need of a chuckle this afternoon.

  10. Re:Why? I don't get it... on China Bans Gold Farming · · Score: 1

    Also - the big question - why would this become illegal? People do what they want with their money. If Blizzard was smart - they'd offer Gold at a price matching the market and get a cut on this.

    Once they start doing this, then they run afoul of banking regulations. Suddenly they are running an currency exchange board using a 'phony' currency... lots of countries would have issues with this.

    China is trying to clean up its image regarding currencies, and one of the things necessary is that they limit certain transactions, especially ones involving other countries' currencies, that screw with international trade. Especially so in light of their recent request to the IMF that a 'supercurrency' is created.

  11. Re:Keep telling yourselves that on Google Claims They "Just Aren't That Big" · · Score: 3, Insightful

    What about Youtube and Google Video, among others?

    Oh I'm sorry, you chose only to mention products without prior competing (and publicly known!) projects from Google.

    At any rate, Google's model depends on information-gathering. Any online service used by people is competition to Google, as it limits their ability to collect data which they can use to target advertising. You do realize that all of Google's "products" are really just info-gathering services, right? And that their real product is targeted advertising?

    ANY web service is a competitor to Google. Period.

  12. Re:China seems to want to enhance its image... on China Bans Gold Farming · · Score: 5, Interesting

    Your bosses will constantly be pushing you to maximize your per hourly gold yield.

    My understanding is that most of the gold farmer "workers" work on a quota system. Of course the quota will get moved up depending on possible performance. It's not about maximizing yields, it's about hitting the quota dependably.

    When labor is that cheap, it's probably more effective to hire additional workers than it is to squeeze every last drop out of the ones you have.

    Anecdotally, back when I played MMOs, I was once asked to hold onto some surplus in-game cash for a farmer. He wanted to set it aside so if he had a bad day, he could use it to get over quota and avoid punishment.

    I recall reading an article about this somewhere (Gamasutra?)... the gold farmers didn't want to make too much gold for their bosses, or their coworkers would get mad. Excess earnings in a session were hidden to (1) save for a bad day (2) sell independently for income or (3) play the game themselves. It was a really interesting look inside gold farming at the basest level.

  13. Re:blindsided? on Amazon Cuts Off North Carolina Affiliates · · Score: 1

    I think your home state would crack down on that pretty hard. That's tax avoidance, plain and simple. If you're in NJ, for example, you'd still be responsible for paying sales tax in NJ on your NJ sales -- regardless of whether or not you're registered in DE, and do all your banking through DE. Setting up DE banking simply makes it harder for you to get caught... but eventually, you will get caught.

    I hope you don't use that lawyer again. He has advised you very poorly. That kind of advice can get lawyers sanctioned.

  14. Re:blindsided? on Amazon Cuts Off North Carolina Affiliates · · Score: 1

    I have no idea why you think that owned servers used to count as 'physical presence'.

    Probably because we maintained a small staff to maintain them... this was not via a hosting service. IIRC, there was also order processing done at that location.

    First of all, there is almost certainly no 'physical presence' in 99% of these cases. These are mostly guys who are putting links on their blogs to Amazon, not actual retail companies.

    The small operators who run these businesses from their garage certainly are not exempt from sales tax in the state they live (which would be the only state they have a presence in, if their fulfillment also happens from the garage).

  15. Re:Keep telling yourselves that on Google Claims They "Just Aren't That Big" · · Score: 1

    It doesn't matter how they acquired their competitors. It doesn't matter if the companies were sold willingly. The point is that when there is an interesting product or service that Google wants, it buys it. Whether it's to prevent competition or just to add to their portfolio of products/services is a question for debate.

    Microsoft has been lambasted for buying out competitors. A lot of those acquisitions happened in a very similar way to Google's acquisitions. Hell, it's a known business model:

    1. Begin developing an idea
    2. Get noticed by Microsoft (now Google)
    3. There is no "3. ????"
    4. Profit!

    At any rate, whether or not Google gives us the warm fuzzies inside because they claim to not be evil, they are a megalithic corporation that dominates the market of targeted advertising, and may also dominate the market in personal informatics (how long until the credit bureaus use Google to validate credit)?

    And totally unrelated to the topic: Damn it, it's Monday. Every damn Monday there is a perfect article for a Googol the Destroyer episode, but I never have the time to write one on Mondays. And then the rest of the week there aren't any good ones.

  16. Re:They're not big. on Google Claims They "Just Aren't That Big" · · Score: 1

    That's all well and good.

    But it has nothing to do with the fact that abuse of their dominant position is undesirable, and the DoJ is tasked with ensuring they do not abuse their position, no matter how they got it.

    You can be the nicest kid on the block, and everyone buys candy from you because you're a nice guy, and you have low prices, and your quality is good. But once all the other candy-sellers leave for greener pastures, you can't use your new-found dominance to keep them from coming back via defined uncompetive behavior, like paying the candy manufacturers to not sell to your competitors.

    Or something. Dammit, my kingdom for a car analogy.

  17. Re:Apple makes good hardware on The Open Source Design Conundrum · · Score: 1

    Actually, just over half of the nipples are found on men. Check yourself.

    Not if I limit myself to the nipples I have touched...

    No, that's still just over half.

    Your mom's regular two nipples (female, I hope.)
    Your regular two nipples (male, I assume).

    Add in your superfluous third nipple (which is small and doesn't count as a full nipple), and that makes just over half the nipples you have touched are male.

    I suppose that actually, on men, all nipples are superfluous. I'm not sure why they only refer to "extra" nipples as superfluous. I do know a guy with six nipples, but I'm not sure if he had plastic surgery to add the extra four or not, he's kind of serious about the whole "I wanna be a female kitty and go cosplaying" thing.

  18. Re:Anonymous Coward on NASA Requests Help With Von Braun's Notes · · Score: 0, Troll

    Read all about it here: http://en.wikipedia.org/wiki/Djvu

    Discuss.

    Any post that ends with the command, "Discuss", should be taken out back and shot.

    It's pretentious, annoying, and detracts from whatever valid points (if any) are contained in the post.

    If the topic of the post is worth discussing, it'll be discussed. If not, it will be ignored.

    And just to note, djvu is better for file size... at the cost of lossy compression. In my experience, the lossiness isn't really that bad, but we are dealing with handwritten notes. For something of historical value like this, I'd rather a lossless format being available in addition to djvu and/or pdf.

  19. Re:blindsided? on Amazon Cuts Off North Carolina Affiliates · · Score: 1

    I'm an accountant who has handled sales taxes for a large company with physical presences in 16 states and 11 countries... trust me on this one :)

    Regardless of where your corporation is registered, if you have a physical presence in a state, and taxable sales in that state, you have to pay tax on those sales. So if you're in NC, registered in DE, and have sales via Amazon in NC... you have to pay sales tax to NC. If delivery of the good is taken in a different state, it's not taxable (the recipient is responsible for use tax, however, if applicable in their state).

    Re: your situation... don't let a lawyer confuse the issue, he gets paid more the longer it takes him to resolve the issue. The shop is in state "A", registered in state "B", and the server is in state "C". Sales tax in state "C" is independent of which state "B" is. What matters is if there are sales in state "A" or "C", where the owner has a physical presence. Now I'm not sure if the web servers have had their definition changed as a physical presence in the past few years... but for owned servers, they definitely used to constitute a physical presence. This is one reason why it's advantageous to locate warehouses, server farms, etc in tax-favorable states. It's also important to note that different states have different tax codes, and some sales that are taxable in one state are not taxable in another, all else being equal.

  20. Re:The way it should be on Domain-Name Wars, Rise of the Cybersquatters · · Score: 1
    .

    They should make it where the price of a domain doubles for each domain you have registered.

    1. $35
    2. $70
    3. $105 ...etc.

    $70 * 2 = $105? Maybe for extremely small values of $70 :)

    I think yoyu mean that the cost for all your domains doubles each time you add another domain. This formula would be:

    Cost = $35*2^(n-1) where n = the number of domains registered.

    The problem with this is that legitimate companies' costs would skyrocket for no reason. Consider a small US firm with three brands. Just based on the company and the three brands, there are four domains in each of several TLDs they need to register. At a bare minimum, they need to register the domains in .com and in .net. So that's 8 domains, or $35*2^7, or $4480.

    Now consider that the same company likely needs to register another 16 or 24 domains (both defensively and to help ensure they get all the visitors trying to reach them). The cost quickly gets astronomical.

    Now consider that if they have trademarked their brands. Now they are required by law to defend against people using similar domains as possible competitors, or they lose their trademark. Uh-oh. Now, in addition to the $350/hr they pay to a law firm for trademark protection, they've got to pay tens or hundreds of thousands to protect their trademark.

    In short... nice idea, but it harms legitimate businesses to much.

  21. Troll mod? Really? on Fake News Scam Sites Advertising On Real News Sites · · Score: 1

    Troll mod for me, and not for the blatantly obvious troll of the parent?

    I guess the OP in the thread was right... the conservatives have mod points, and they are not afraid to use them inappropriately.

    Or maybe I pissed off some liberals, too.

    That's my problem, really... I'm an equal opportunity troll[1]. I somehow always manage to piss off the libtards AND the conservidiots in the same post.

    Or I manage to bash Apple, Linux, AND MS in a MS-bashing thread.

    [sigh]

    [1] And now I'm sure I've gone and pissed off the partisan conservative nutjobs again, by taking good trolls away from hard-working blue-collar down-home folks and giving them to minorities who are less qualified.

  22. Re:blindsided? on Amazon Cuts Off North Carolina Affiliates · · Score: 1

    Oh, that's right, NJ has no good restaurants, community theatres, parks, museums, or anything else. Never mind the proximity to Philly and NY.

    If you lived in NJ for 4 years and didn't explore any of it... well, your loss.

    I sure hope you didn't live in NE NJ, SW NJ, or the shore... if you did live in one of those cultural wastelands, I pity you.

  23. Re:"ideas like effective government action" on Fake News Scam Sites Advertising On Real News Sites · · Score: 1

    And your post, while funny, serves to illuminate my point very clearly.

    For some reason you choose not to explore the possibility of effective government action, which I can chalk up to several possible reasons:

    (1) Focus on examples of ineffective government action
    (2) Knee-jerk reaction due to preconceptions you have chosen not to challenge
    (3) Inability to accurately analyze examples of effective government action
    (4) Willful disregard of counter-examples to your beliefs.

    I'm sure there are other possible reasons. But it amuses me greatly that your response to my post, while possibly intended to refute it, instead serves as a perfect example of my point.

    It's nothing against you personally... I find you to be one of the funnier slashdotters around... I just think that you would personally benefit from applying your wits to potentials you choose not to consider.

  24. Re:blindsided? on Amazon Cuts Off North Carolina Affiliates · · Score: 1

    Just think how much nicer NJ would be if people were valued for their humanity rather than just as sources of "income & property tax revenues".

    Just how could I value these people for their humanity, when I have no idea if they are selfish twats or if they are decent human beings? The only thing I can judge them on, from the information available to me, is their monetary value to the people who live in NJ. They could be rapists or worse, for all we know.

    And as for NJ having a bad business climate... surely that's the reason so many businesses have moved to NJ, despite our tax climate being bad for decades?

    We have a bad tax climate for business. On the other hand, we have great business climate in other areas, such as: education system, workforce quality, proximity to NY, proximity to ports, culture, etc.

    But go ahead, harp on NJ. The more people that talk negatively about it, the better my chances of having beautiful rural NJ never overrun by midwestern suburban transplants.

  25. Re:blindsided? on Amazon Cuts Off North Carolina Affiliates · · Score: 1

    Which wouldn't help them, since they have a physical presence in NC and thus must pay NC sales tax.

    There are many many thousands of corporations registered in DE for business purposes, but don't think for a second that those corporations are not required to file and pay sales taxes in the states where they have a physical presence.

    And don't try to evade sales taxes that way either -- you'll either get nailed and have to pay fines and interest (or even get prosecuted for willful tax evasion), or at the very minimum you're a drain on state resources because you don't contribute your fair share (which I know is optimistic on my part, to think that people would pay taxes out of some moral reason, instead of just fear of reprisal).