|
Just as a counter balance from complaining about MVC and facial hair... we're a part of a system / team to help create a world that most people simply live in. It's the scientists that are in labs, cooking up the juju that even doctors read about and use. It's the engineers that help put that to use. And it's the business-minded folks that help bring out the best in scientists and engineers as well.
Not everyone can say they played a part in helping deaf people hear or blind people see or help solve transportation problems, etc. And yet, that's what technology is doing and we play a teeny tiny little part in all of this... even if it's making yet another pie chart to help people better understand their business. We try to make life better and have a hand it as a participator rather than a spectator.
my wife hearing for the first time! its amazing! - YouTube[^]
blind man sees his 13 year old daughter for the first time - YouTube[^]
SFW
Ok, now let's get back to bashing VB and JavaScript.
Jeremy Falcon
|
|
|
|
|
Quote: Ok, now let's get back to bashing VB and JavaScript
But, but, but .... I thought we have bashing Microsoft as a first priority? 
Get me coffee and no one gets hurt!
|
|
|
|
|
No, no - it's defunatley VB and JS first.
MS make themselves just too easy a target...
Bad command or file name. Bad, bad command! Sit! Stay! Staaaay...
AntiTwitter: @DalekDave is now a follower!
|
|
|
|
|
Considering that VB is a Microsoft product, isn't bashing it like getting two birds with one stone? 
"It was when I found out I could make mistakes that I knew I was on to something."
-Ornette Coleman
"Philosophy is a study that lets us be unhappy more intelligently."
-Anon.
|
|
|
|
|
A song I've been singing for years.
I was around when MRI was being developed. Unfortunately for that professor, he came in 2nd in that race - but all the 'medical miracle'? They'd still be chanting spells were it not for the scientist and engineers!
Einstein invented the laser a century ago; put into practice in the late 20th century; fiber optics; all the rest - so they can do their micro-surgery & lasik and the rest, and take the credit for it.
![Elephant | [mastadon]](https://codeproject.global.ssl.fastly.net/script/Forums/Images/elephant.gif)
| Ravings en masse^ |
|---|
| "The difference between genius and stupidity is that genius has its limits." - Albert Einstein | | "If you are searching for perfection in others, then you seek disappointment. If you are seek perfection in yourself, then you will find failure." - Balboos HaGadol Mar 2010 |
|
|
|
|
|
Exactly. It's the same with people that overly glorify doctors. I mean, don't get me wrong... I'm not dissing doctors or their role in society. Someone has to be the consumer facing person, but the majority of them aren't creating the medical science... they're just reading about it in a book or papers... written by scientists.
We need front runners. But it's nice to remember it takes a team, and there are people behind the scenes working some magic. Same thing with a movie... the audio guys/gals never get any love. All the glamour goes to the stars of the movie, but tell just how well you think a movie with do in the box office with crappy sound.
Jeremy Falcon
|
|
|
|
|
It good to live in the future - isn't it?
I'm pretty sure I would not like to live in a world in which I would never be offended.
I am absolutely certain I don't want to live in a world in which you would never be offended.
Freedom doesn't mean the absence of things you don't like.
Dave
|
|
|
|
|
Yes indeed brother.
Jeremy Falcon
|
|
|
|
|
|
BWHAHAHAHAHA!!!
#SupportHeForShe
Government can give you nothing but what it takes from somebody else. A government big enough to give you everything you want is big enough to take everything you've got, including your freedom.-Ezra Taft Benson
You must accept 1 of 2 basic premises: Either we are alone in the universe or we are not alone. Either way, the implications are staggering!-Wernher von Braun
|
|
|
|
|
But but but... I like Laughlin.
Or have you run into Roger?
|
|
|
|
|
PIEBALDconsult wrote: But but but... I like Laughlin.
Well good for you:there has to be someone... 
PIEBALDconsult wrote: Or have you run into Roger?
Nope. Thought he was further east.
|
|
|
|
|
Only slightly. Just across the river.
|
|
|
|
|
Bullhead City? Wish I'd known. 
|
|
|
|
|
|
...that MVC does not provide default out-of-the-box support for encrypted requests. It should not only be implemented, it should be turned on by default.
SMFH...
".45 ACP - because shooting twice is just silly" - JSOP, 2010
-----
You can never have too much ammo - unless you're swimming, or on fire. - JSOP, 2010
-----
When you pry the gun from my cold dead hands, be careful - the barrel will be very hot. - JSOP, 2013
|
|
|
|
|
But, HTTPS, right?
I mean, there's a lot to just including encrypted data.
Both ends have to know how (algorithm used) they are encrypted and all that.
So, I'm thinking if you just apply HTTPS then you solve this at the layer above MVC (communication layer) and you let that layer handle it all.
Otherwise there'd be all the protocol setup stuff that you'd have to do yourself instead of just letting the browser and server do it automatically like you get with HTTPS.
Just thinking out loud. Maybe you are encountering something different?
|
|
|
|
|
First, https has been proven to be almost as insecure as plain text.
Second, using https does not encrypt query strings.
".45 ACP - because shooting twice is just silly" - JSOP, 2010
-----
You can never have too much ammo - unless you're swimming, or on fire. - JSOP, 2010
-----
When you pry the gun from my cold dead hands, be careful - the barrel will be very hot. - JSOP, 2013
|
|
|
|
|
John Simmons / outlaw programmer wrote: First, https has been proven to be almost as insecure as plain text.
Did I say https wrong? Should I have said TLS? or whatever the current standard is?
So I guess you don't buy anything online, right?
Also, I believe querystrings are encrypted via HTTPS.
If you set up HTTPS properly, everything between browser and server are encrypted:
Here's just one of many answers you get when you google that:
ssl - Is an HTTPS query string secure? - Stack Overflow[^]
Here's a quote from the top answer that is returned:
google knows quote: remember, SSL/TLS operates at the Transport Layer, so all the crypto goo happens under the application-layer HTTP stuff. The entire transmission, including the query string, the whole URL, and even the type of request (GET, POST, etc.) is encrypted when using HTTPS
|
|
|
|
|
raddevus wrote: everything between browser and server are encrypted
Apart from the domain name, which needs to be sent unencrypted for SNI:
Server Name Indication - Wikipedia[^]
"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer
|
|
|
|
|
Richard Deeming wrote: Apart from the domain name, which needs to be sent unencrypted for SNI
Ah, good additional information.
So an attacker could at least know which domain you are going against. Interesting.
But of course the rest of the info specific URL, querystrings, etc are safe.
Thanks for the addt'l info. 
|
|
|
|
|
raddevus wrote: Also, I believe querystrings are encrypted via HTTPS.
link
URLs are stored in web server logs - typically the whole URL of each request is stored in a server log. This means that any sensitive data in the URL (e.g. a password) is being saved in clear text on the server
|
|
|
|
|
That's not relevant though. Of course the server can see the decrypted data.
Otherwise it couldn't use the data.
The point is whether someone along the route of the Internet would be able to read the data.
If the server saves the data somewhere after the fact in cleartext has nothing to do with HTTPS.
That could be true for __any__ encryption scheme.
EDIT
Although it is a good point about the IIS logs having querystring values decrypted -- and that is a bit nuts but there may be a setting to handle that on IIS.
Ah, just found it. You just turn it off for specific fields (URI Query (cs-uri-query)) then the password via querystring woldn't be logged at all? A gotcha to know though:
Select W3C Fields to Log (IIS 7)[^]
modified 6-Nov-17 15:00pm.
|
|
|
|
|
Hidden fields within the form data are the way we go here. They are encrypted with the form, but not logged. You should never be able to reproduce a users password (thus the 1 way comparisons in the DB). If it was safe to have plain text passwords anywhere, there would be no need for this.
|
|
|
|
|
Agree! Great, interesting discussion.
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
