rosswilson

This reminds me of https://github.com/jo-m/trainbot, a neat example of stitching together frames of passing trains to form a panorama.

This frontend presents them nicely: https://trains.jo-m.ch

This shouldn't be possible as the server-to-server request to Facebook to exchange the Authorization Code for an Access Token requires the client_id and client_secret to be provided. Facebook should (though I haven't actually confirmed this) verify that the code was issued to the given client_id. If the code was issued for client 123, when client 456 tries to exchange it for an Access Token Facebook should throw an error.

It's called Insulation Resistance Testing and an electrician would typically use a device like a Megger tester.

Here's a good video about it: https://www.youtube.com/watch?v=CsXUuuV4_sw

You have to draw the line somewhere. Otherwise we'd be saying that HTTPS/TLS is not secure since the webpage is rendered to your monitor unencrypted.

I agree with the parent quote:

> I’ve found statements like these to not contribute very much towards solving any practical security problems.

You might be interested in the full list of UK trail delay codes: https://wiki.openraildata.com/index.php/Delay_Attribution_Gu...

Those extenders typically backhaul the traffic over a VPN back to the telco, so your router would never see the true destination (e.g. Facebook).

I think they've always done this redirect. Release artifacts are uploaded to S3 and then their Rails app generates a presigned S3 URL that gives short-term access. This is because the artifacts could belong to a private repo, so access control is required.

You should first consider what you want to achieve from this “revamp”. Are you facing some issue with your existing tech stack?

I’m wary when I hear teams discuss a total rewrite of an existing application.

I’m building a side project that has an enterprise customer, and the Enterprise Ready website was a good intro to the concepts that enterprises value: https://www.enterpriseready.io

From my (limited) experience, one thing that enterprises love is asking you to fill out a 30 page security questionnaire. They take an age to complete so be aware of this if you’re thinking of going down the enterprise-sales path. I think it’s one of the big reasons that “contact us for pricing” exists for very large customers.

The article has quite a nice introduction to deep learning concepts, but the headline claim of building an ID card reader from scratch is little more than "use our API".

Fibre Channel, I think: https://en.m.wikipedia.org/wiki/Fibre_Channel

EC2 instances are now billed at per-second granularity, with a minimum charge of 60 seconds.

If you received a HTTP 502 then DNS must've already resolved. Browsers typically will do a DNS lookup, and then try establishing a TCP connection to one of the returned hosts. Its only if it can't establish a TCP connection to a host will it (sometimes) try another host from the DNS response.

Exposing whether an account exists is a risk, but the alternative is also a hard problem to solve. Sign In screens could throw a generic error that doesn’t reveal whether it was the email address or password that was incorrect, but what about registration flows?

If users can sign up and register to your system, it’s harder to offer a slick user flow without revealing that an account already exists. One way to achieve this is to only capture the user’s email address, send them an email, and they complete the rest of the sign up process as a second stage. A user who already has an account gets sent an email stating that an account already exists.

As a business I assume they’ve decided that the risk of exposing whether an account exists was worth it in exchange for a better user experience.

You’re referring to a mobile application that inherently has a slower release cadence - certainly for Apple with their verification process.

A web app can be released multiple times an hour if the business has confidence in its automated tests and release plan.

You really shouldn't be relying on security by obscurity to prevent attacks to your websites. If you check your access logs you'll see countless attacks that are unconditional, they'll just try the attacks without any kind of sanity checking.

A lot of email providers support aliases using the + symbol. If your email address was foo@example.com, then foo+bar@example.com would also work and be delivered to your inbox.

This is a good way of finding out what company sold your email address too.

Nor for me

How would turning the pinger off for a month help? It just means that the search operation stops for a whole month while they wait for the pings to resume. I don't understand how your proposed idea would benefit a rescue operation.

Read about Nigeria Airways Flight 2120 (http://en.wikipedia.org/wiki/Nigeria_Airways_Flight_2120).

An under-inflated tyre caught fire during take-off, the plane took off unaware of the fire, when the landing gear was retracted the fire spread burning through electrical and hydraulic lines.

A fire "outside of the pressurised part of the fuselage" doesn't mean the same didn't happen here.

"so that it is really obvious to the user if they are directed to mess with things that they shouldn't be messing with"

I think that as soon as an attacker tempts the user with: "follow these steps to access American/UK (substitute a locale that has content your account shouldn't have access to) only films that Netflix don't want you to know!" that the apparent gain for the user will lead them to ignore any warnings. In fact, warning might actually encourage these kinds of attacks since the user could think "that's just Netflix trying to hide something, I'm gonna following [the attackers] guide"

London Underground use a number of signalling systems, here's a good resource to get started learning about them: http://www.trainweb.org/tubeprune/signalling.htm However, ultimately you could develop a super intelligent system using networked PLCs, but at the end of the day you're still going to need relays to actually switch the power to the coloured light signals. The red wires in the photos will lead to a controller somewhere that triggers the relays to switch the mains power on/off to the signals.

Doesn't DSG use their own custom made EPOS system? Eclipse? Do you have any experience with it and their security policies?

I've had quite a few experiences as a customer at PC World when they've had "till failures" - ironic for a computer store. They often blame head office for overnight updates gone wrong.

It's entirely possible that the "crosstalk" happened way before the calls every made it into Skype's domain. Skype will have a PBX somewhere that bridges the gap between Skypes IP protocol and the outside world of POTS and cellular calls.

Sorry no. A service like this isn't something that passes my "can I do it myself" benchmark. Don't get me wrong, if I think a service provides some value that I either can't implement myself or would cost me too much (financially and/or time) to implement myself then I would signup. Sadly I think I could build something like this into whatever product I was developing quite easily.

Here's an idea: instead of targeting developers (e.g. B2B) why not setup your service to be consumer facing. Imagine a service where individuals can upload their photos or files and then have a shed-load of partners they can share those photos/files with (like photo printing services, social networks, community sites, forums). Just an idea.