101–110 of 127 posts
Earlier quoted context omitted.
You'd need [required] instead of [minlength] for :valid to work. The other option is :placeholder-shown, to style no-input normally, but it's newer and not as supported.
I wonder if the good old input[value=""] would work. Probably not if you have jQuery.
I just realized: This site was never over HTTPS. It was an HTTP site, and the browser had a regression that broke the site's user functionality. Troy Hunt is attempting to claim this is a feature and not a bug, and that their workaround is "being deceptive", when they never claimed it was secure to begin with . The browser is literally pushing an idealistic philosophy down websites' throats and basically doing damage…
Now users have pretty diverse interests, so browsers don't always get this entirely right, which is one reason it's important to have a variety of browsers so users can pick one that does represent their interests.
What's happening in this case is that the site is doing something that pretty much everyone who understands the issue agrees is harmful to users: having them type their password into an insecure page. Browsers and security professionals spent 10+ years trying to convince web sites to stop doing that. Then browsers spent a few years telling websites that they will start warning users about this behavior and giving specific timelines for when this would happen. Then they started showing those warnings they promised they would show.
To go back to your analogy, it's as if Microsoft had told developers for a long time that some specific API is deprecated due to being "insecure". Then they gave a timeline for the API being removed. Then they removed it. Can there still be applications who didn't move away from that API? Sure. Is it entirely Microsoft's fault that they are now getting lots of support calls? That's a hard case to make. Note that this sort of deprecation is something that Microsoft and Apple have in fact done.
> The only way they get away with it is because they have the biggest market share.
Firefox is showing the same warnings, no?
> businesses would simply shut off access to Chrome browsers and tell them their browsers were faulty
Sure, just like in the Microsoft case businesses tell their users to not install the OS security update, etc. You're right that if Chrome and Firefox had smaller marketshare businesses _could_ threaten to do this or actually do this. But at that point it's not entirely clear who the real "bully" is... In either case there's an exercise of market power to get your way against the (possibly reasonable) objections of others.
Disclaimer: I work for Mozilla, on Firefox.
Earlier quoted context omitted.
> The main threat that HTTPS everywhere secures against is preventing your ISP from analyzing your traffic in order to build and sell an advertising profile on you. That is not true. The main threat it protects against is MitM (man in the middle attacks) that allow someone to redirect all traffic to a website through their machine and thus see all the data including your password. HTTPS when combined with root certif…
MitM is blown out of proportion. Afaik, only dns poisoning attacks will result in MitM as effective as phishing or botnets, and poisoning can be mostly-solved with better resolvers. No criminal anywhere cares about your password going over the wire in a coffee shop.
But if you target is only a single network, packet sniffing is pretty effective and is stopped by HTTPS.
And if you target is a single person or small group of enumerable machines, arp poisoning still works on many (most?) networks.
Personally I am more scared of the damage that can be caused by being a direct target than I am having my info in one of those massive dark-web data dumps.
Edit: Also, the ops post is actually an example of a MitM (where the ISP is the one in the middle). I just expanded it to the superset.
If only we had these kinds of strong warnings in the VOIP industry. Nearly every provider barebacks the internet, throwing unencrypted signaling data (phone number dialed, keys pressed during the call, codec to use) and call media over the internet raw, just hoping that no one eavesdrops or alters their data. HIPPA compliance? Nah bruh, unencrypted UDP is just fine! PCI-DSS says we can't take credit cards over this w…
I've seen PBX people find religion once they wake up Monday morning to a weekend of hacked calls to Africa. Though sometimes that religion is in the form of yelling at upstream providers to please give them refunds. And because of these insecure systems, the more serious issues (all this SIP software is tons of C, and I've found exploits in just 1000 line utilities, let alone protocol level hackery and other fun) get…
Earlier quoted context omitted.
I've seen PBX people find religion once they wake up Monday morning to a weekend of hacked calls to Africa. Though sometimes that religion is in the form of yelling at upstream providers to please give them refunds. And because of these insecure systems, the more serious issues (all this SIP software is tons of C, and I've found exploits in just 1000 line utilities, let alone protocol level hackery and other fun) get…
SIP... doesn't seem like the greatest protocol. Maybe I'm tainted because I've only really dealt with it in the context of the Microsoft IM/telephony platforms (renamed constantly, but always essentially the same), but it appears to be incredibly brittle complicated. On anything less than a local LAN, messages get dropped or mangled or timed out all the time, and that trashes connections, or puts sessions into unreco…
Earlier quoted context omitted.
You didn't just talk about the debate. You stated as a fact that many vaccines have improper testing or substances. If you state something as a fact, you should be prepared to back it up.
> You stated as a fact You're putting words in my mouth. What I said was "...without what many would consider..." I'm still taking about the debate itself and you're trying to make this a binary debate about vaccination.
I just realized: This site was never over HTTPS. It was an HTTP site, and the browser had a regression that broke the site's user functionality. Troy Hunt is attempting to claim this is a feature and not a bug, and that their workaround is "being deceptive", when they never claimed it was secure to begin with . The browser is literally pushing an idealistic philosophy down websites' throats and basically doing damage…
I agree with most of your post, but it's coming from an incorrect assumption.
Earlier quoted context omitted.
I actually have my own Cisco Phone adapter to connect my old analog phone/answering machine. I'd assume that a true SIP phone would work as well. What's questionable is whether I could authenticate from a different network than my home network. I know, however, that both Vodafone and Telekom in Germany offer products that allow connecting VOIP phones from anywhere to a virtual phone appliance.
That's interesting. In the Netherlands, all the telcos (with the notable exception of XS4ALL) lock down the modems and don't give you the settings and logins to use your own equipment (although the Consumer and Market Authority is still researching whether this is actually legal).
No need for the JS, just change the font if the input isn't empty, right?
Earlier quoted context omitted.
It's not an opinion or unrelated but an analogy to another case where there's very strong evidence of a massive benefit with very little downside which is being objected to based on conspiracy theories and lack of concern for the damage to anyone foolish enough to believe them.
As a side note, the debate is not that simple. Vaccines work, but many vaccines are manufactured without what many would consider proper testing, and using toxic substances banned in different countries. The debate is more about sloppy implementations than about the idea of vaccines as a whole. It's like someone is forcing the issue down to choosing poorly-regulated vaccines - or no vaccines at all. A false dichotomy…