81–90 of 99 posts
I get that it's trying to be funny, but is it really no longer possible to create a website with a single arrow that doesn't have to pull down all this cruft ? window.jQuery || document.write(' ')
I'd love to see a ridiculously over-engineered version. Something like a website running in a browser in Windows 95 running in a javascript DOSBOX emulator.
I get that it's trying to be funny, but is it really no longer possible to create a website with a single arrow that doesn't have to pull down all this cruft ? window.jQuery || document.write(' ')
13. Rule of Economy: Programming time is expensive; conserve it in preference to machine time. 15. Rule of Optimization: Prototype before polishing. Get it working before you optimize it.[1] [1] https://www.slingcode.com/ref/ProgrammingPhilosophies.pdf
I get that it's trying to be funny, but is it really no longer possible to create a website with a single arrow that doesn't have to pull down all this cruft ? window.jQuery || document.write(' ')
Yes. But it will hurt your career. How will people know if you keep up with modern development techniques?
Earlier quoted context omitted.
Most likely due to the TSA's efforts! Can you imagine how many would be hijacked if there weren't a TSA?
Ah, the good old days... The history of airport security is somewhat interesting. There wasn't a TSA for long time, and the hijackings/flying to Cuba got annoying, so metal detectors were added. Everything else since then hasn't made much sense.
This left me thinking what could be the simplest implementation I could do, while keeping a good UX. I came up with this in 10mins: https://jsbin.com/xidefopuqe It was a fun experiment and felt very old school.
The argument that will be made against something like this is "We can't use a product that would let the bad guys see how it works!" I know it sounds ridiculous, but in my limited experience, "Security through Obscurity" is a key feature required by everything related to the (ineffective) methods used to secure the airports in the US. I believe this fact was even alluded to in the original article related to the just…
Security through Obscurity is just not a great way of going about it. NIST notes "System security should not depend on the secrecy of the implementation or its components."[1] Kerckhoffs's principle is also a relevant read. As professor Bellovin notes : "It helps, I think, to go back to Kerckhoffs' second principle, translated as "The system must not require secrecy and can be stolen by the enemy without causing trou…
Specifically, if you're talking about ciphers (as Kerckhoffs does), or system software (as NIST does), or anything else, you know in advance who's authorized and who's not. You've solved the hard problem; the rest is simply math, and we're fortunate to live in a time where the math is well-studied. You can give the secret key to the people who are authorized, and not to those who aren't, and your security rests on that key -- and your competence at figuring out who should have been given the key.
The TSA has no such luxury. They have no good way to distinguish me, a random person walking through the airport with a valid boarding pass and too many electronics, from a terrorist, also with a valid boarding pass and many electronics. If they could give me a key in advance, and not the terrorist, they would. (In fact, this is basically what Pre-Check is, and that works okay, although it only reduces the screening because they know Pre-Check can't be perfect.) But there's nothing that reliably distinguishes me and you and hundreds of millions of other non-terrorists from the small number of terrorists, and there's certainly no practical way to publish a key to us hundreds of millions, while keeping it away from terrorists.
So they rely on heuristics, because there is no better option. You cannot build a system that satisfies Kerckhoff's principle, because there is no key separate from the system itself. And any public, keyless system can be gamed trivially. (Think of, say, unkeyed SHA-256 checksums attesting to software integrity. Without a signature, i.e., without a key, anyone can tamper with both the software and the checksum, regardless of how good SHA-256 is.) So the system must be kept private in order for it to work at all... or we give up, and decide that the only people who can fly are those that we can conduct foolproof background checks on. That seems like a worse world.
It is rather like anti-spam and anti-virus. If you could just give a key to all legitimate email or legitimate software, you would. And in fact there are things that attempt to do that. But they can't be complete, and the remainder of the screening works on security-by-obscurity because there is no better option. Either we give up entirely on the ability to receive unsigned mail or run unsigned software (and even that won't be 100% reliable), or we go with the secret heuristics. It's not great, but it's the best we can do.
I get that it's trying to be funny, but is it really no longer possible to create a website with a single arrow that doesn't have to pull down all this cruft ? window.jQuery || document.write(' ')
I get that it's trying to be funny, but is it really no longer possible to create a website with a single arrow that doesn't have to pull down all this cruft ? window.jQuery || document.write(' ')
Agreed. I was curious as to how the random numbers were being generated (math.random()? Something else?), so I went to look at the source code. I expected `assets/js/src/application.js` to be the main file (I mean, look at that name. What else would it be?) I start reading the code, and pretty soon it starts messing with the clipboard, and it even pulls in Flash [1]: > // Config ZeroClipboard > ZeroClipboard.config({…
I admit to thinking the dependency overkill for random arrows was part the joke. A la https://github.com/jezen/is-thirteen
I get that it's trying to be funny, but is it really no longer possible to create a website with a single arrow that doesn't have to pull down all this cruft ? window.jQuery || document.write(' ')
Agreed. I was curious as to how the random numbers were being generated (math.random()? Something else?), so I went to look at the source code. I expected `assets/js/src/application.js` to be the main file (I mean, look at that name. What else would it be?) I start reading the code, and pretty soon it starts messing with the clipboard, and it even pulls in Flash [1]: > // Config ZeroClipboard > ZeroClipboard.config({…
I know not all engineers do this, but this crap is what caused me to buy a new laptop. I was fine with my existing tools and workflow, but websites have gotten so slow and ridiculous. It's largely Javascript's fault.
I used to get angry about walled garden app stores, but lately I find myself hating the web. I don't dislike it, but I think we went on a really lame detour.
As an aside, Javascript ads are worse than Flash ads ever were.