2,021 reputation
416
bio website netrek-apsillers.rhcloud.com
location United States
age 25
visits member for 1 years, 7 months
seen Apr 12 at 20:06

"The problem, when solved, will be simple."

Conway's Game of Life

  Controls:
  Step Random Noise
  Clear Random Feature
  Click a cell to toggle it.
  View source


Oct
1
revised Can older or custom web browsers override the same origin policy?
added 117 characters in body
Oct
1
revised Can older or custom web browsers override the same origin policy?
added 117 characters in body
Oct
1
comment Can older or custom web browsers override the same origin policy?
Could you clarify what you mean by "overhauling my site"? Are you concerned that a site will perform a cross-origin Ajax fetch of your site, overhaul the appearance, and present the altered version to the user? Or are you concerned about a large number of requests overwhelming your site? The first case is much more applicable to SOP concerns, but I now suspect the second case is closer to what you meant. (As noted below, any group of machines capable of participating in network activity could overwhelm your site.)
Oct
1
comment Can older or custom web browsers override the same origin policy?
@PeterStuart I initially misunderstood your threat model, and have added an additional paragraph. Assuming the SOP will protect your site is like assuming that because a person has seat belts in his car he can't get out and attack you. (The seat belt is there to protect the driver of the car, not you.)
Oct
1
revised Can older or custom web browsers override the same origin policy?
added 555 characters in body
Oct
1
answered Can older or custom web browsers override the same origin policy?
Sep
30
answered Does Google's SSL encryption for searches thwart NSA spying?
Sep
30
comment Does Google's SSL encryption for searches thwart NSA spying?
Regarding your redirect-to-HTTPS comment, it's worth noting to the OP that Google uses HSTS, which eliminates the redirect entirely, after the first visit. (Of course, the first visit is still vulnerable in the way described here.)
Sep
17
awarded  Yearling
Sep
9
comment What do the dots and pluses mean when OpenSSL generates keys?
I'm curious: where did you get this information? I don't doubt it's correct, but I haven't been able to find a manual page or other documentation about it. I did a Google search for "A potential prime number was generated" and found a blog that has the exact same verbatim information, so I assume it's quoted from somewhere, but I haven't found any official source (maybe source-code comments?).
Aug
20
revised How do WPS (Wi-Fi Positioning System) databases have the MAC Addresses of the networks?
added 333 characters in body
Aug
20
awarded  Disciplined
Aug
20
comment How do WPS (Wi-Fi Positioning System) databases have the MAC Addresses of the networks?
@AlfredoOsorio Ah, yes, your latest edit makes the password concern much clearer; I think I started my answer before that edit. I'll look up IEEE 802.11 rules and make an edit.
Aug
20
revised How do WPS (Wi-Fi Positioning System) databases have the MAC Addresses of the networks?
added 130 characters in body
Aug
20
answered How do WPS (Wi-Fi Positioning System) databases have the MAC Addresses of the networks?
Aug
12
awarded  Autobiographer
Aug
6
awarded  Enthusiast
Aug
5
comment Get info encrypted across a MITM proxy
@EricDong From my reading of your comment, you've identified two undesirable outcomes of the SSL bad-cert warning: 1) the user ignores it or 2) the user doesn't ignore it and the communication fails. I don't think either of these problems is solvable (and certainly eliminating both in the same protocol seems quite impossible). The insolubility of problem #1 is obvious enough: users can always send data when they shouldn't (e.g., by violating the protocol!). Problem #2 is also insolvable: if an attacker can intercept a connection, they can quite easily stop communication completely.
Aug
5
awarded  Nice Answer
Aug
4
comment Is it safe to disable SSH host key checking if key-based authentication is used?
@Adnan Just to speak from personal experience, I've seen that error message many times when connecting to different machines that used the same dynamically-assigned IP on a local network (e.g., my SheevaPlug was 192.168.1.101 yesterday, but today that address refers to my laptop), which seems to be a direct analogue to what the OP is doing here. From tthat experience I personally don't find anything suspicious, but -- having read your comment below -- I can see how your reading of the spec would make you suspect misrepresentation.