Well now I feel compelled to read everything this person has ever written.
When you browse Instagram and find Tony Abbott's passport number
281–290 of 354 posts
Re: When you browse Instagram and find Tony Abbott's passport number
#282What is the big deal of knowing Tony Abbott's diplomatic passport number?
Re: When you browse Instagram and find Tony Abbott's passport number
#283Nice. Here's a similar personal story with a PSA that sometimes blurring is NOT sufficient. A friend of mine posted on Instagram a picture of a U.S. visa (or something similar; it was probably five years ago) to announce her trip to the U.S., and she took care to blur out sensitive information such as her passport number. But a Gaussian blur is easy to reverse and I successfully unblurred it and told her my discovery…
Sometimes a black bar or even cropping isn't sufficient. You still have to trust the editing software.
There was a scandal around 2003 when a TV host took a topless photo, cropped it and shared the cropped photo online. Unfortunately, the software (Photoshop—I think CS3) she used to crop the photo stored the original photo as metadata if you didn't change the original filename. The original (uncropped) photo could be seen in the "Open File" preview dialog when opening the cropped version.
Re: When you browse Instagram and find Tony Abbott's passport number
#284Earlier quoted context omitted.
There are of course two errors that the developer of the backend made. The first is not filtering what came back from the Amadeus API, but the second one - the one I am referring to - is using an Amadeus API key with too much access. Amadeus filters the booking record depending on the level of access that the user accessing it has (the user being the backend in this case). In a previous life for another airline, I ha…
The API key shouldn't change what type of data an API call returns. The developer should explicitly request data and that either succeeds or fails based on authorisation. Making assumptions about the use case from the key will of course lead to this kind of error.
This is pretty standard when fetching entire complex objects from many backends. You get the full object with all of the fields the authorization layer allows you to see.
Something like "GET /reservation/" would rarely require you to specified the 50 fields that you would like included in the response. Many offer fields to explicitly filter for specific things, but the default is almost always to return the full object as much as the caller is allowed to see.
Re: When you browse Instagram and find Tony Abbott's passport number
#285Earlier quoted context omitted.
Hint: try ROT13.
Quick posix shell rot13 tip: pipe it into: tr '[A-Za-z]' '[N-ZA-Mn-za-m]'
Also sometimes useful is vim: `g?` ... it's useful to have "scrambled" lines in notes for protection against casual disclosure.
Vim used to have a (terrible) encryption capability, but lately I've been fairly happy with `pass` (passwordstore.org) for basic local encryption.
Re: When you browse Instagram and find Tony Abbott's passport number
#286Re: When you browse Instagram and find Tony Abbott's passport number
#287Earlier quoted context omitted.
My all-time favourite recommendation is "print, cut out the sensitive parts with an exacto knife, rescan". Firstly because it's a nice mix of analog and digital, and secondly because it's short enough to fit in a tweet - yet extremely secure.
This is how military redactions have been done forever. If a soldier writes home to his family and includes classified details (“I watched the sun rise over Mt Vesuvius yesterday but today we are moving west”) the censors just cut out the text with a knife.
Wouldn’t that mean they were marching into the gulf of Naples?
Re: When you browse Instagram and find Tony Abbott's passport number
#288Nice. Here's a similar personal story with a PSA that sometimes blurring is NOT sufficient. A friend of mine posted on Instagram a picture of a U.S. visa (or something similar; it was probably five years ago) to announce her trip to the U.S., and she took care to blur out sensitive information such as her passport number. But a Gaussian blur is easy to reverse and I successfully unblurred it and told her my discovery…
Sure. I would go a step further - just don’t post any photos of these sorts of documents ever. The risk and reward ratio is too skewed.
That is my argument against using any social media in a nutshell - the risk and reward ratio is too skewed.
Re: When you browse Instagram and find Tony Abbott's passport number
#289The power of Inspect Element. This is exactly how I found out I was underpaid[1]. A company I worked for used a software called erecruit to manage my contracts. When you click on a clients name, it makes an ajax request to fetch the data. Being a web developer, I inspected the data returned. I'm pretty sure all the developer did was: echo json_encode($queryResult); I saw how much I was getting paid vs how much they w…
Every consulting firm pays their employees way less than the hourly rate they bill clients. That's how the firm exists. Good for you that you were in a situation to dictate your compensation.
Re: When you browse Instagram and find Tony Abbott's passport number
#290Earlier quoted context omitted.
That reminds me of this legendary comment: https://news.ycombinator.com/item?id=9224
Ha, I knew what that comment was before I clicked. (“Is it that rsync/ftp comment? Yup.”) ((EDIT: but it was curlftpfs, not rsync))
I never realized how low that comment's ID was until now. We've all said a lot since then :)