samuelkadolph

Without WEP or WPA, yes insecure wireless is insecure.

Probably relying on the claim by some that it was completely undetectable unless you have full packet capture which for the CRA is pretty much a guarantee.

Did you read the article? He was arrested for stealing 900 social insurance numbers from CRA (Canada Revenue Agency, Canada's IRS).

If you are geolocating, I would suggest spending $370 to buy the MaxMind GeoIPCity database. There's an nginx module for it and any major language will have code to run queries against it.

http://www.maxmind.com/en/city http://nginx.org/en/docs/http/ngx_http_geoip_module.html

Actually this is very much illegal. You cannot charge someone for a product and then not deliver it. Kickstarter doesn't charge you for a product, you pledge or donate to a project on Kickstarter and if it's successful, you get the item(s) for the level you pledged to for free.

I've found ifconfig.me to be excruciatingly when I actually need it. Like takes 10-30 seconds for a response just to get my IP. Sucks that someone got the vanity domain and put a shitty server behind it.

Google has their own intermediate certificate. The root they use is Equifax.

Having the private key of a trusted root CA lets you create leaf certificates (or intermediate CAs) that your computer will trust implicitly (because the root is trusted). This would allow someone to man-in-the-middle your connection to, say, gmail (with help of your ISP) and you would not be able to easily detect it.

Gibson Research Corporation created a page that shows the real signature for some common websites (and lets you check any site you want). You can then connect to them and view the signature in your browser and compare them. This is what you would have to do to know if you were being MITMed with a "real" certificate.

https://www.grc.com/fingerprints.htm

Not using attr_accessible is a lot different than not using reset_session after authenticating a log in. It's very easy to forget or not notice a model missing some whitelisting but to roll your own authentication code with zero security investment is just stupid and I would be extremely surprised if GitHub doesn't do it.

You offered no proof that this actually works and being defeated by a reset_session makes it way more likely it doesn't work.

What a load of crap. The chances that github doesn't call reset_session are zero which means this doesn't work.

Sounds like someone didn't read the guidelines for this. Raising the $185k is peanuts compared to what else you need. Over the 6+ months you have to prove to ICANN that you have the technical and financial ability to run a registrar which will be able to handle the number of customers you expect.

No group of donators will be able to do this without the support of a major company.