Comment Re: My comments on this (Score 1) 195
Is visiting many ebay pages ad-hoc social?
Instead, openly gay characters are rare to the point of nonexistent in games.
One important part of successfully marketing something is broad appeal. Playing a gay protagonist evidently isn't something that appeals to the vast majority of game enthusiasts. Same for movies. If you were an enterprising individual perhaps you can see a lucrative niche?
The intent was to be shocking, and the casting very much reflected the societal assumption that white is good, dark is bad, and the violated expectation was part and parcel of the affect the movie wanted to have. That movie was released in 2005. Thirty years after the American civil rights movement, Hollywood still taps in to that cultural expectation, despite a generation of heavy political correctness in a much more visible medium than games.
Here's some references which predate the civil rights movement by about a thousand years. How shadow and light are referenced throughout history, having JACK ALL to do with some one's fucking skin. Black has a variety of meanings throughout history and especially to various cultures. Here's another one, the Yin and Yang, notice the colors?
These people and others like them are making the proposition that games should become part of the engine of social engineering that has made such a ham-fisted mess of television and movies, particularly for children.
Think of the children is effective at controlling people, why would there be any exception in today's political climate?
They think that games are for kids, and should therefore be used to condition children the same way they try to use TV. It would be unfortunate if that were to happen.
Do they ignore that the average age of gamers is 30s?
If games are to have any hope of being recognized as art, they have to be culturally relevant, and not be used as a bludgeon against culture.
Implying they're not works of art already is hilarious. Not every movie, just like games or that chunk of "pottery" made for mom, is a work of art either, but this is where taste comes in. Taste is highly subjective.
I am not defending AT&T. I think they should be heavily fined and hopefully someone go to jail. I also think that someone who exploited the hole should also be sent to jail and heavily fined. The only people I am defending are the ones who had their information stolen.
Jail I believe should be for violent offenders exclusively, jail time for accessing something, even millions of times is ridiculous. If he obtained protected information (cardholder data, SSNs) maybe, but if it isn't "protected" (say an email, first and last name, type of phone etc.) or doesn't come with any terms, it's fair game and the blame for the boring disclosure resides solely with the company since each request was authenticated by them. We have far too many people in Jail as it is. We're the world leader's in incarcerations and it's a dirty ass privatized business which I don't want to support when we can put these people to work, and fines do a wonderful job along with some community service. If that's the case Google needs to go to jail for indexing, and bing too since bing fed itself off of google. There was no exploit, this was the system operating as intended, supply it with an IMEI and get info. You want someone in jail for randomly trying publicly accessible page, incrementally, much like what google does with google maps mapping vehicles. Why isn't this illegal, it's occurring on public roads, too!? They make copies of the data accessible at these locations, or to use your words, they "steal the information" (addresses are personally identifiable information, but also public).
There are some authentications that do not use user/password. For example, Paypal Payflow uses a signature which is a single long number that identifies that account and gives authorization for access. It is a single number somewhat like an IMEI.
Authentication is a fuzzy thing, quick google returned: Authentication is the act of confirming the truth of an attribute of a datum or entity. By entering the IMEI this satiated the authentication, pretty shitty authentication. "Yup, address is good!". In regards to the paypal thing, btw paypal isn't a bank in the majority of the countries they do business in. In order to obtain this signature you need to create an account though, which requires a few pieces of information something an IMEI doesn't require. The signature seems like a token and is part of an authentication scheme, not simply a (terrible) username. The first 8 digits of the IMEI are assigned to manufacturers and made public (pretty good for something "private"!), and Apple, for instance, tends to do 'batch' naming for the rest, so if you have one iPhone IMEI you can guess all the others from that batch just by incrementing. That's a terrible authentication idea there, lou.
That is one URL and not millions of different URLs.
So if each person (in a large pool of say 250k) accesses one URL, with an IMEI that was generated, it's cool? Rape is cool the first time around then too, eh? This conflicts with below
Yes, if the IMEI does not belong to you or you have not been authorized by the owner to use it.
Why would I need permission since they can be derived? It's not something that's secret, or is protected, or has any expectation of privacy, it's even broadcast (to the carrier). Otherwise sites like this http://www.imei.info/ wouldn't exist. Think they burn all of those "passwords"?
Don't you see how this is very different from trying millions of different password combinations? One of the precepts of law is intent. It is pretty easy to show no intent when typing in a few incorrect characters. It is easy to show intents when you create a script that generates millions of possible IMEIs and spams a server with them.
I asked this specifically to nail down what an IMEI number is. An IMEI is not a password or a username any more than using a credit card number or social security number is. Unlike SSNs or CC#s it's an identifier for a device which doesn't even identify an owner in many cases (see prepays). These are similar to VINs on cars. How is it illegal to generate and try different combinations of this series of numbers, especially since portions of these numbers are public knowledge, on a website that is/was publicly accessible without any terms of use or limitations imposed by the operators for any clients which request info using a valid IMEI?
So no online banks, credit card companies, etc. Just because it is on the web does not mean it is public.
Absolutely it does, it's implicit when it's on the web (short for World Wide Web) especially without authentication (doesn't that usually involve username + password?). Ultimately I believe you're arguing about intent of the organization, something the web server and client know nothing about. Requests (not demands) are received, and the web server replies. Private networks are just that, not publicly accessible. This is the digital equiv. of driving down various streets (publicly accessible addresses) incrementally and being provided with information at the end.
How is an organization not responsible for what they put online, after all are they not the ones solely authorized to determine what they want to provide others access to? It's not like this involved a username and password like the online banks or credit cards do.
Remember those folks who would share out their entire drives on file sharing networks? It's not up to a client to determine validity of who is or isn't authorized - that's the job of the people configuring the server. It is up to the entity operating the server to ensure that data is protected, authentication isn't anything new, especially robust systems. Would you defend the government for making a system where simply using a street address would allow one access to information (taxes etc.)? How about your Bank? Explain your reasoning, please.
Defending people who exploit negligence does not improve things either.
What does this have to do with my point, you think I like this asshole? Are you under the impression that making an example out of this guy will somehow improve things? If that were the case simply putting a guy through the system, the first time, would've sent the message loud and clear! If you're a customer of this company after this, you're crazy but I can understand how you'd be upset; although you should really focus on WHY THIS HAPPENED. You're ready to punish him for what amounts to an embarrassment. Also, you included email addresses in your rant, FYI email addresses are not private information. They're as private as a phone number is (something listed in directories and/or published in books).
You make a point of mentioning that this occurred thousands of times. What if you clicked on a link via a URL shortening service that directed you to one of these links, do you think you should be put in jail? Is it an exploit only if you do it x number of times? Do you think you should be liable for fraud for entering IMEI#s? What about accessing a website or service when its really busy (DDOS)? What about visiting slashdot and typing in an account name that's a misspelling of yours which happens to have the same password? Swap out slashdot with your bank of choice. Is it criminal now since it's "unauthorized access" of a computer system?
Lazy/incompetent/unprofessional people get no sympathy from me, they've earned this, and the company (developers, sysops, and managers in charge of these systems) need to own up to their shitty half baked design and policies. They deserve to get their feet held to the fire. If they're unable to perform, there isn't a shortage qualified people who would jump at a chance to take their places in a fucking heartbeat.
Sorry but these are very different things. The Netflix database was meant to be public while the iPad one was not.
The fact is both were on web servers. The entire point of a web server is to handle requests, if you don't want something publicly accessible, begin by not putting it online. How are we to determine what is or isn't authorized? If you put something online, and later say that someone wasn't supposed to access it, who is liable?
The data is designed to be used by the owner of the phone as identified by the IMEI and not anyone who can spam enough possible IMEIs to fins a valid one.
If only there were some way to flag and block repeated attempts... this is about as brilliant as those folks who decided using a Social Security Number as a means of identification.
TL;DR Defending negligence will not improve things.
I wrote a perl script to take a sample of websites -- part of the same list that I had used to find websites that were mis-blocked as 'pornography' by Smartfilter — and attempt to resolve them using both Comcast's main DNS server (75.75.75.75) and one of Google's public DNS servers (8.8.8.8). (You won't be able to do this experiment yourself unless you have a Comcast Internet connection, because while Google's DNS servers accept queries from anywhere, Comcast's DNS servers will refuse queries from any IP address not assigned to one of their customers.)
The script ran through a few hundred hostnames and flagged anything that failed to resolve on Comcast but resolved correctly on Google , although most of these were false positives caused by Comcast's DNS servers being temporarily unresponsive. But after running through the list of false-positives repeatedly, I found the first website that consistently failed to resolve on my Comcast Internet connection while resolving on Google: http://www.021yy.org/.
Kudos to the Konqueror team for making their rendering engine pluggable, though!
Indeed! To clarify, my point wasn't to slam KHTML, or the GP, but to objectively see where the issue lies. After all Slashdot is frequented by movers and shakers, which the NSA even targets
Except that I find more websites work when I enable the KWebKitPart plugin in Konqueror than when I use KHTML for the renderer.
Is this due to webkit specific markup or missing features KHTML side? Have an example page we can examine to see where the issue lies?
So, while they may have had similar origins, WebKit seems to be getting more love.
That's how forks work, it was split not simply for the awesomeness, but because they wanted to add features. If they were so satisfied with KHTML they wouldn't have forked it.
It's just a disfunctional Chrome with Opera branding now.
Chrome is just a dysfunctional Webkit, which is just a dysfunctional Khtml....
While losing Presto, which has been around since the early days, sucks it's not exactly cheap "me-tooing" the other guys. Besides, one of the reasons for the lack of popularity was the obscure rendering issues occasionally encountered with pages. "Whelp, my banking site just doesn't work, gotta switch browsers" type situations weren't exactly uncommon and arguably speak more about the markup than the engine itself but an end user might not be so understanding. Operas approach makes a lot of sense from a technical standpoint. One could dream about an opensource Presto but with the whole software patent blight I don't see that occurring any time soon.
It died when they abandoned their own codebase.
Seems more like a fork, doesn't it? Feature branch the engine, keep the UI. Granted it's still under heavy development, I'm excited about seeing it mature - I'd like to see how their development tools will be integrated (element inspection and whatnot) since the "old" Opera is known for having many useful features baked in. I'd like to see a webkit with some sweet extensible architecture so we might have Firefox level plugins, see Adblock. I realize this is available now but the effectiveness varies from Chrome to Firefox due to how webkit handles network requests, I'd like to think there is an opportunity here. If development time is ultimately saved as a result, hopefully additional features will once again be the focus instead of reinventing the wheel.
It's fine if your page stops growing at 1920 pixels, but you can't expect a tablet or mobile user to fit in 1920 pixels
You could expect it if were a tablet such as the iPad3 for example, came out late 2012 and features 2048 x 1536px. Your point still stands, keep fighting the good fight. For fun if these "designers" use frameworks try removing the doctype, or moving a submit button outside of a form, change selector cAsEs (.content-holder ->
"The four building blocks of the universe are fire, water, gravel and vinyl." -- Dave Barry
