Posts by Steve Roper

PEBKAC

I also use and love NoScript. But as a web developer I can tell you it's trivial to develop a website entirely in Javascript that displays a simple "This site requires Javascript enabled" message to a NoScript user. If that user has been given the impression that the site contains something he or she wants, they'll automatically reach for that NoScript Options button and select "Allow shitsite.com" without a second thought.

Granted, you might be savvy enough to think "Why does simply showing me some info require Javascript?" but depending on how badly you want that info, even you might be prepared to at least "Temporarily allow..." just one time to see what it is. Furthermore, this attack involves form submission. It's far from unusual for forms pages to require Javascript for dynamic option updating and on-enter form validation, and even a tech-savvy user thinking he's signing up for some useful service would be taken in.

NoScript is only as good as the person using it, and with its use becoming more prevalent, the blackhats will become ever more creative in finding ways of meat-hacking people into selecting that much-desired "Allow shitsite.com" option.

Seconded

The Beetle Fart is now the new El Reg standard unit of force!

That, sir, is a bloody masterpiece.

El Reg, you need to repost Graham's comment as an article on your main page. Failing that - Graham, I would like your permission to reproduce your comment on my blog, with proper credit and a link to a website of your choice. Please let me know, if this is OK - how you would like to be credited and what link you want.

Such a well-written discourse on the obscenity that is modern copyright law deserves permanent exposure in places more easily reached than an obscure comments thread.

I think we'll be quite safe from Y10K

As I pointed out in a previous post, 2038 is coming and by then all systems will be on at least 64-bit time if not more. 64-bit time will easily cover us from the Big Bang to well after the end of the Stelliferous Era, at which point anything descended from us won't have any use for computers anyway.

As to using 4 characters to store the year - nearly every database I've worked with stores dates as Unix timestamps, aka the 32-bit integer that's going to wrap in 2038. And most programs I've worked on also compute date differences etc with the integer timestamp as well and only convert to dd-mm-yyyy when it's time to display results to the user. (It's much easier to add 30 days to today by going $expire = time()+(30 * 86400); rather than futzing about with splitting days, months, and years and adding/subtracting from monthday arrays.)

In any case, any computer we're using 7,990 years from now will be as far beyond us as the internet is to Hammurabi, and the likelihood of us still using the current date system then is about on par with us using the Babylonian calendar now, so somehow I don't think it'll be an issue! ;)

Not quite

They're using the old "suppress sexual expression and channel the pent-up emotions into patriotism" routine a la George Orwell. Mind you, seems we're not too far behind them, except that our governments are trying to funnel the repressed sex into hatred of terrorists and paedophiles rather than the more obvious patriotism...

One wonders

if you were Webster Phreaky in a previous life?

So what's the problem?

Given that silicon is second most common element in the earth's crust (at 27.7% by mass), it's not exactly hard to come by, and it's not like we're having to gut the planet to get the required quantity, is it?

To the naysayers who replied to Roger

I work for a publishing company. Although my titular role is IT manager, I do other jobs within the company as well. Since I am also a competent graphic artist, the company has called upon me to design a number of book covers, including the covers for "Are All Men Dickheads?" by Michael Morel, "The Timeless World" by Michelle Stanton, and "The Ultimate Unity" by Nikola Dragovic. I receive a royalty based on sales of these books for the work I did designing these covers.

What we've noticed is that a significant number of sales of our books comes from customers who found them on Google Books. Google does not give the customers the entire book, but what it does do is give the customer enough to see if they want it. That's driven a goodly number of sales to our company and the bookstores who buy from us.

So as an artist who directly benefits from Google's efforts, I strongly deplore this action by the French government. If Google is forced to block access to Google Books in Europe, we will lose sales. Some 18% of our sales are to European countries, and a lot of those come from customers who found our books on Google Books. It's really high time these greedy, nihilist mainstream publishers got their heads out of their arses and started realising that companies like Google, and the Internet at large, are a boon, not a bane, and that by these actions they are hurting, not helping, the very publishers they claim to protect.

I agree with you, Roger, It IS very third-world, the way Big Media and their cronies want to stifle markets for independent publishers like ourselves, because that is what this is really about.

Why is this a problem?

Because it's none of your fucking business who my family and friends are, that's why.

You can't blame Firefox for that

HTML 5 is a specification determined by the W3C, not Mozilla. The W3C is a standards consortium that includes companies like Microsoft, Apple and IBM as well as independent industry experts. ALL new browsers are expected to support HTML 5 if they are to be W3C compliant - and that includes IE, Chrome, Opera, Safari and Konqueror as well as Firefox.

As a web developer myself, I greatly approve of the changes in HTML 5. Most websites these days involve embedding application-level objects and having to rely on third-party proprietary plugins like Flash, Shockwave, Silverlight and Java has been nothing but a joke if not a nightmare. The new <audio> and <video> tags are an absolute boon to web developers because they allow a unilateral cross-platform presentation of multimedia content without having to waste our time and yours on proprietary plugins. Or having to code 4 different versions of a site to work with all the different incompatible solutions out there.

If you're that concerned about Web security in multimedia content, use NoScript, which blocks the new embedding tags unless you explicitly allow them.

Finally, while there will initially be security flaws with the new tags, when these flaws are discovered and corrected, the remedy instantly closes all doors across all sites. Compare that with the old plugin situation, where you could have many different flaws in different platforms and a fix for one did nothing to fix similar vulnerabilities in others. Adobe might fix a memory overrun bug in Flash but that would not fix a similar bug in Silverlight. Also, the standards in HTML 5 are open for anyone to see and fix, while plugins like Flash and Silverlight are closed and rely on their parent companies to fix them.

No, this is much cleaner. It's well past high time a multimedia standard was embraced by the W3C, and this hasn't come soon enough.

Brilliant description, sir!

"There are things without spines lurking in mangrove swamps blowing bubbles that would make better government officials than..."

Absolutely brilliant. If you don't mind, I'm going to steal that description for use in describing Australia's own less-than spineless bubble-blowing mangrove-swamp lurker, Stephen Conroy!

Here's your pint. Cheers!

@Steve 116

Yes, fuzzy matching typed response is certainly a lot better than having a drop-down list, because this again reduces the number of options a bot has to choose from, thereby increasing the chance that the bot will guess correctly. As is pointed out in the article, even a 1% chance gives bots an unacceptable level of success when you're talking about a botnet of several thousand machines making thousands of attempts every second. To conquer this, you really need to set the captcha to give at least a 1 in several million chance of success by brute forcing.

Consider this: if you have a botnet of just 5000 machines each making one attempt per second, that's 5000 attempts per second, which is 18 million attempts per hour. That means that even if your captcha creates a 1 in 18 million chance of success by brute forcing, that's statistically 1 success per hour. You can probably fight this if you IP block any machine that transmits more than say 3 unsuccessful attempts, or more than 3 attempts in less than a minute, for 24 hours.

Keeping the pictures easily recognisable across a wide range of cultures was one of the challenges my student faced. Things like polar bears and penguins would perhaps have been a bit esoteric for some cultures, but commonplace ones like cats, dogs, trees and cars are pretty much recognisable by anyone with access to the Internet.

Finally, I also agree with your points 1 and 2; I also don't like invoking third-party systems on my clients' websites, which is why we wrote all our own tracking, statistics and captcha systems. Not only is the site's behaviour more controllable, it's more secure, it's faster for the visitor and doesn't clutter up the menus of protection addons like NoScript with a slew of domain names.