Anonymous Coward wrote:

What's with this recurring meme that I've been seeing on Slashdot lately that edge cases should be ignored? If everybody has his own edge case, then why not allow something that handles all the edge cases acceptably?

True, one of the first video games with a 3D perspective (Battlezone) was the ur-first-person-shooter, but 3D games in other genres have been popular since the mid-1990s. Or is every other video game genre "gimmick" and "few tiny edge cases" to you? I'm not getting what you mean by "gimmick"; in the circles where I hang out, "gimmick" refers to a 2D platformer for the NES published by Sunsoft with a design aesthetic similar to that of the Kirby games.

The "3D" in "3D TV" and the "3D" in WebGL are two different things. WebGL just defines a way to project 3D geometry into a display plane. This display plane may or may not be presented with binocular separation, which is what the "3D" in "3D TV" and "Nintendo 3DS" means.

The 1990s, when HTML documents were readable and not stuffed to the gills with ads and social recommendation detritus. Really all a plain-jane HTML document is missing is a max-width:36em on body to make line lengths sane and a width=device-width on the viewport to make tablets not render it zoomed out.

Why the obscenity?

If I disagree with one or more points in a post but would appreciate evidence to the contrary, what is the appropriate way to reply to the other points without incorrectly implying that I agree with the points with which I actually disagree?

If PhilsHobbyShop.com were to block all traffic from BRIC and Ukraine, even ports 443 (HTTPS) and 80 (HTTP), customers in those countries would choose one of Phil's Hobby Shop's competitors. And even if you're referring to blocking SSH and HTTPS administration interfaces and not blocking HTTPS customer interfaces, that still means all the other server technicians need to reconfigure the server every time a technician takes an international vacation (during which he's theoretically always on call for emergencies).

I was referring not to my own situation but to the situations of others.

Not everybody has the luxury of an unlimited electricity budget to keep a box at home from going to sleep after 30 minutes of lack of input.

But will the SSH server implementing a default deny policy know to check the free dyndns.com service to see which IP addresses are allowed to connect? If so, all you've done is added the length of your dyndns.com account's password to your SSH password. And the last time I used a free service similar to dyndns.com, I got a monthly e-mail asking me to click through and solve a CAPTCHA within the next seven days to keep the name active.

Not everybody has the luxury of a home ISP that allows 60,000+ different incoming ports. Some ISPs don't even give home customers a dynamic IPv4 address; all outgoing connections pass through a carrier-grade NAT, and all incoming connections are refused.

All you've done by adding a VPN is added the length of the VPN's password to your SSH password.

The web access part is the interface to specify which IPs are trusted IPs at the moment and which aren't.

Not everybody has the luxury of 1. a home server and 2. an ISP TOS that allows a home server. And even in your case, all you've done is added the length of your home server's password to your SSH password.

How long will the existing tunnel brokers remain free to the general public?

Unless you have someone with physical access to the datacenter, at least some sudoers are going to need high-level privileges.

What's the practical difference between being able to log in to root and being able to log in to a member of the sudoers group?

See replies to macbeth66's post asking the same question.

How does your system determine which IP addresses belong to a particular attacker's botnet?

So how do you predict the IP address of the machines from which you will be connecting in advance? If you expose a web interface to edit the list of allowed IP addresses so that you can connect from an additional IP address, all you've done is added the length of that web interface's password to your SSH password.

Not if the brute force attempts are distributed across thousands of different /24s, or if a botnet member is behind the same carrier-grade NAT as your machine.