|
A thought regarding some slight mitigation of someone trying to get at a resource they don't have access to is to say there is no resource. Any one else implemented this, or just always return forbidden everything user does not have privileges?
Some case yes, say not enough privileges if said resource is ok for them to go get the right privileges then come and retry.
but sometimes I'm think, well, this user should never be able to get this resource, like wrong 3rd party contractor, so just go away, that resource does not exist (for you).
This more just ranting on a friday.
|
|
|
|
|
It is nonsense, based on the assumption that if access is forbidden and the attacker "hence" knows the item is there and "probably" can be read one way or the other - and that is the nonsense, unless you keep your secrets in the filename, and not the file itself.
So, you're trading this tiny advantage for some serious trouble in debugging; can it find the file, or is it just acting like it can't find it?
Bastard Programmer from Hell 
If you can't read my code, try converting it here[^]
|
|
|
|
|
Basically good security is when you tell nothing to the user. Like you do not tell one who tries to break in your site that what part of the identification was wrong, the same way you do not tell someone nothing about resources, who not authorized to do such a request on the first place... Bang him with 403, if one is legitimate, one will contact the proper way to ask for what one want...
Skipper: We'll fix it.
Alex: Fix it? How you gonna fix this?
Skipper: Grit, spit and a whole lotta duct tape.
|
|
|
|
|
Contrarywise, why not send 403 for both? 
|
|
|
|
|
I'm starting the pasta diet: you walk pasta the fridge, you walk pasta the chocolate, ...
Bad command or file name. Bad, bad command! Sit! Stay! Staaaay...
AntiTwitter: @DalekDave is now a follower!
|
|
|
|
|
I guess this is the opposite of the see food diet? 
Everyone is born right handed. Only the strongest overcome it.
Fight for left-handed rights and hand equality.
|
|
|
|
|
I have no beef with that.
throughout my life, my two greatest assets have been mental stability and being, like, really smart.
modified 20-Oct-19 21:02pm.
|
|
|
|
|
What a waist! Salad a nonsense, but you noodle that would be my response.
| Ravings en masse^ |
|---|
| "The difference between genius and stupidity is that genius has its limits." - Albert Einstein | | "If you are searching for perfection in others, then you seek disappointment. If you are seek perfection in yourself, then you will find failure." - Balboos HaGadol Mar 2010 |
|
|
|
|
|
That diet is the best ever, orzo they would have you believe.
"the debugger doesn't tell me anything because this code compiles just fine" - random QA comment
"Facebook is where you tell lies to your friends. Twitter is where you tell the truth to strangers." - chriselst
"I don't drink any more... then again, I don't drink any less." - Mike Mullikins uncle
|
|
|
|
|
Kylie Jenner 'sooo over' Snapchat - and shares tumble - BBC News[^]
Do-Nothing celebrity tweets negatively about a company, and 1.3 BEEELION is wiped off the value of that company.
This is an indictment both of celebrity culture and of the underlying uselessness of these tech giants and their crapplications.
One morning I shot an elephant in my pajamas. How he got in my pajamas, I don't know.
|
|
|
|
|
This was just confirmed, Kim K "really likes Sander's new software company!"
...
...
...
Nope, still 0 on my bank account 
|
|
|
|
|
Mel Padden wrote: the value of that company.
Perceived value, really.
This is why if I were ever to build an app that becomes hugely successful, I'm cashing out as soon as I can. 
Everyone is born right handed. Only the strongest overcome it.
Fight for left-handed rights and hand equality.
|
|
|
|
|
|
You say that like there's another kind.
|
|
|
|
|
madwilliamflint wrote: You say that like there's another kind.
Sure. Companies that provide a necessary product definitely have an actual value.
Everyone is born right handed. Only the strongest overcome it.
Fight for left-handed rights and hand equality.
|
|
|
|
|
All value is "perceived" value.
|
|
|
|
|
I've never used Snapchat and never will. Oops, there goes another $1B of worthless valuation.
Darn. I wish I had that kind of influence over social media shares. I could make a fortune shorting stocks everywhere!
Latest Article - Code Review - What You Can Learn From a Single Line of Code
Learning to code with python is like learning to swim with those little arm floaties. It gives you undeserved confidence and will eventually drown you. - DangerBunny
Artificial intelligence is the only remedy for natural stupidity. - CDP1802
|
|
|
|
|
Marc Clifton wrote: Oops, there goes another $1B of worthless valuation.
You just confessed you are sharing the same impressive physical attributes as Kyle Jenner :p
Pretty disturbing.
"I'm neither for nor against, on the contrary." John Middle
|
|
|
|
|
Who is Kylie Jenner, and why should I care? 
"Go forth into the source" - Neal Morse
|
|
|
|
|
kmoorevs wrote: Who is Kylie Jenner, and why should I care?
I was just going to ask that same question.
I was also gonna ask, WTF is snap chat???
If it's not broken, fix it until it is.
Everything makes sense in someone's mind.
Ya can't fix stupid.
|
|
|
|
|
kmoorevs wrote: ... and why should I care?
Depends on how much Snapchat stock you or your 401K own.
If you think 'goto' is evil, try writing an Assembly program without JMP.
|
|
|
|
|
what's snapchat?
Signature ready for installation. Please Reboot now.
|
|
|
|
|
Mel Padden wrote: Do-Nothing NON-celebrity
FTFY
".45 ACP - because shooting twice is just silly" - JSOP, 2010
-----
You can never have too much ammo - unless you're swimming, or on fire. - JSOP, 2010
-----
When you pry the gun from my cold dead hands, be careful - the barrel will be very hot. - JSOP, 2013
|
|
|
|
|
Stock value is such a bogas thing. the 1.3 loss is of its potential dollar value. It is not worth nothing until sold.
As soon as you have converted your dollars to stocks, you have 0 dollars and only the potential of the stocks.
Hell you can be frozen out of selling stocks for a year. So for a year you have changed 100 dollars into 0 dollars, with the hope that in 1 year time the potential sell value of the stock is higher then when you traded.
Hell most paper notes are worthless, they just say the bank will honor the 10.
Those banks in Italy using parmasan cheess as collatoral have the right idea. You go bust, we still have a good chance of selling the cheess. but Stock, or even building value, nah.
|
|
|
|
|
I need a new laptop...
Should I get a quad-core or just a hard-core?
... such stuff as dreams are made on
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
