Amazon to Sell E-Books for iPhones->
Link to Original Source
|
|
I've had to administrate sites in Typo3, Joomla, Drupal, and other CMSs. I've written some Typo3 extensions because there was nothing out that did exactly what I needed. Nonetheless, I cannot stand Typo3 and its irritating TypoScript psuedo-language. I'll take Joomla any day over that.
It may be a mistake from our perspective, but Apple shareholders don't mind too much that the iPod and iTMS are incredibly successful.
Many other companies have tried to break into the same markets (hello Microsoft?) with not much success. And they had even better DRM than Apple's! (from a lock-in perspective)
My favorite line from the MS site is: "If you would like to receive information when the Elevate America resources become available in your state, please follow us on Twitter: http://www.twitter.com/elevateamerica."
Oooh boy, I'm standing by for my Microsoft Tweet!
No, If any part of a page is not encrypted then an attacker can effectively strip all encryption from the entire page.
You're right, and thanks for the links. Though, this seems to be more a problem with scripting vulnerabilities and MITM attcks than with HTTPS specifically.
I also thnk that browsers just should not allow a form on a not-fully-HTTPS page to submit to a HTTPS URL.
Designers then started breaking this. To avoid an extra https serve, particularly on a front page or popular page. For the sake of "Design", including putting a sign in form on the front page.
Errr... you really think the DESIGNERS cared about extra HTTPS hits??? They were probably told to put the login on the home page. Then, the sysadmins balked at the idea of an increased SSL load, but still said the login could be done securely if the form action was HTTPS.
The real problem is browsers. They should have been designed so that only HTTPS forms could submit to HTTPS actions. No HTTP form should be accepted.
Really, you should already be wary when a site asks you for login information over HTTP rather than HTTPS.
Maybe. The login form might be located on an HTTP page, but as long as the form submits to an HTTPS page, your login credentials are still SSL-encrypted. Conversely, if you have an HTTPS login form, but the form action goes to an HTTP site, your credentials are NOT encrypted.
FTA: "In fact it is more like a puzzle that you get to solve. It told me to go to Windows Update and do a bunch of incantations."
Finally, someone at Microsoft admits that you have to use magic to make Windows work right... I would comment more, but I am on my way to my daily Ballmer goat and bull sacrifice.
If you push the "extra ice" button on the soft drink vending machine, you won't get any ice. If you push the "no ice" button, you'll get ice, but no cup.