Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×

Comment Re:Not too bad... how about 1,000 MBps? (Score 4, Insightful) 119

Actually, despite their advertising, all Virgin have deployed is a fiber backbone, not "fiber broadband", which would include fibre to the home. For the last mile their 50Mb service goes over the same cables they've used all along.

Not that it matters much when you get 50Mbps downstream and nearly 2Mbps upstream.

Comment Re:No he doesn't (Score 1) 229

Put simply, XSS and CSRF can perform actions on behalf of whoever is using the browser without their consent.
In that case the user happened to be using the admin side of cpanel, and the action was to change the root password.
The protection against CSRF is to require re-entry of logon details for all sensitive actions, or to use a unique "key" in the link.

For most web security issues, the fix is trivial, you just have to know about it.

Another "hacking" trick is "session fixation", and it works like this: provide a victim with a link to a site that's using php, passing a php session id in the url. Victim logs in to site, you can now use their (logged-in) session, because you have the session id (you gave it to them!).
The fix is to regenerate the session id on login, or to restrict a session to the IP of the user who started it, or to disable using session ids from the url. Or all of the above.
It also helps to store the last session id used by each user into your users table to stop a user being logged in to multiple sessions at once.

Comment Re:No he doesn't (Score 1) 229

CSRF is when there is a link or even better an image on another site that causes some action on the first site. Image (img tags) work better because they are normally downloaded automatically by the browser, and there is no restriction on them that means the URL they load has to be an image...

It's normally pretty limited as to what they can do though.

Comment Re:Meh... (Score 2, Informative) 509

Windows needs to reboot after most Windows updates, because it needs to restart whatever has just been updated, and the easiest way is to restart.

As for rebooting after an install/uninstall of an application, that is the fault of a shitty app installer, not Windows. 99% of the time they run fine without rebooting, and 99% of the rest of the time you can dig out the commands they've requested to be run on next boot and run them NOW, and they'll run fine after that. The remaining apps tend to plug into the kernel in interesting ways, like antivirus or firewall apps. Even drivers for most devices (including graphics cards in recent versions of Windows) can be installed without a restart.

Slashdot Top Deals

8 Catfish = 1 Octo-puss

Working...