@Xander Oh thanks but I'd be a bit more critical about mine as it's merely an overview... that's why I first flagged the question to be moved to SO (wanted to answer it more in web application context), but @JeffFerland was told it's OT there, so it stays here. This is something that's really difficult to answer in a generic way IMHO
@TildalWave I actually think it's a reasonable topic here. Securing voting systems has been a discussion in InfoSec for as long as there have been e-voting systems.
@TildalWave But I do understand wanting to tackle it from a more application specific way as well.
@Xander I don't disagree, it is on topic also here, but I wanted to tempt OP to disclose a bit more detail and then answer it with how I'd go about it and what it takes for each approach
@Xander I've written a few of such systems, but they're all application specific and not even closely related to one another really
Of course, they all come at cost... stricter rules filter crude out better, but also rise more false alarms... and vice-versa
I'm downloading Kali now (VM image)... any experience with it besides @Polynomial's crash testing?
@TildalWave. There certainly are technology solutions that could potentially work. The issue I see is that the US government has all kinds of maddeningly, bizarrely arbitrary laws about what constitues interstate commerce so that they can essentially regulate anything they please. So, you really need a lawyer who is familiar with the SEC to explain how they actually interpret intrastate only for the purpose of enforcing that regulation, because what they thnk is all that matters in practice.
@M'vy Thanks! Made it myself ;) Not really a graphics designer by profession but I just start like with the rest of things... complicating first, then removing unneeded parts :) I made more of these for different occasions and I got lucky with some hehe
@Ladadadada I was hoping OP will be more active with his question in the comments, as it is it's way too broad to answer more directly IMO. But I consider click-through fraud different enough to voting where you can't really track true impressions only to satisfy the requirements. Google doesn't have to care if we have more accounts, they only need to filter out robotic crawlers. And unique user detection in e.g. analytics is still way too basic to serve as a ballot.
@D3C4FF and after the Talkative badge you can look forward to getting the Outspoken badge ;) That's like reserved for us star whores :))
@Adnan ?tab=activity&sort=badges (on user profile)
@Adnan @AviD on Jul 14, @RoryAlsop Jul 18, @ScottPack Jul 29 2011 (so you don't have to search ;)
Electorate: Voted on 600 questions and 25% or more of total votes are on questions. This description seems a bit ambiguous
Oh I see they changed the display of SE-wide rep here to only sum the relevant reputation and not just a sum of all of them even if we're not active on some sub-sites but have association bonus there... nice I think that's a lot better :)
@TildalWave I thought so too. Getting the badge clarified it for me. It actually means when you hit 600 questions voted for you have voted for no more than 1800 answers.
@TildalWave To get the badge, you must have voted (up or down) on at least 600 different questions (votes on the question itself, not on an answer) and at least 25% of your votes must be on questions (as opposed to votes on answers).
Since you can vote up to 40 times per day, you can have the badge in 15 days.
Provided that you accept to make about 120 clicks per day.
@Ladadadada @ThomasPornin Yeah I remember some discussion a few months back on exactly this badge... but the description is still the same :O I would've thought you guys have more influence here :P ;))
@ThomasPornin I thought that's 30? Or it varies depending on rep?
If I remember correctly, if you vote for 10 questions first, you can still vote for 30 answers, but if you vote for 30 answers first, that's it for the day.
@Ladadadada I so wanna ask if that's what she said? :))
@Ladadadada BTW this site has some interesting ideas about persistent cookies: samy.pl/evercookie Some of it could be considered browser-wide but there's still ways to circumvent this, especially with VMs it's really easy and I imagine many that would want to bypass it would realize that
It also brings forth all kinds of legal concerns, especially in the EU with our cookie laws
@TildalWave Indeed. I'm trying to convince our devs to implement evercookies to help track spammers. The bots are easy to detect but we have actual real people in the Philippines spamming us too. Those I want to track with evercookies.
Heh. Cookie laws were written by idiots. Probably only apply to actual cookies, not HTML5 data storage or Flash cookies or anything else he does.
@Ladadadada the most effective method I use for such is bad neighborhood policies... I honestly didn't have a clue that can be so effective
@Ladadadada That's exactly it. I was looking for more explanation and asked questions around and came to conclusion that's exclusively for HTTP cookies, whereas they have no clue about other ways of achieving the same, or even more invasive
Oh, and it's probably good practice to automate banning on individual IPs too when they hit a restrictive policy... just in case you change your policy and would suddenly allow them to pass through
My current crude count: 15670 records (that's filtering out roughly 10% of the internet)
@ThomasPornin I feel the same way. I typically don't answer a question unless I found the question interesting or felt like it was something that deserved an answer. In either case it meets the requirements for me to upvote it.
@ThomasPornin While we're at it... you didn't up-vote my only question yet I accepted your answer! :P Not saying I expect fair or even preferential treatment,... just saying that there's weight to each and every word you said, especially tend to in this case :P
@TildalWave Bear #1 does not vote for questions (or answers to questions) to which bear #2 answered; and bear #2 does not vote at all. That's part of the "ethical sockpuppet" thing.
@Adnan They have a test tool on their home page which is fun as well. In the half-dozen or so times I've tried it, across various machines and browsers, I've never not had a unique fingerprint.
@ThomasPornin I didn't think of this, yup that explains it :) In case you're wondering, I actually left that checking in my filters but only has effect when DNS record spoofing is detected, so in the 3rd example case I was describing. I think that's fairly reasonable and since it doesn't produce much lag with caching, it's worth even for those few rare cases when it detects anything.
So the CTF room got frozen for inactivity... can it be thawed later on?
@Polynomial The diamond next to the padlock means there's an access list panel available in the mod menu to control who gets in. Yeah it'll be a mod only feature then, it'd be in the room menu.
Indeed but Google has been deep into gaming performance in HTML5 before, and even building HTML5 gaming engine... forgot its name but I was playing with it a bit... and the main conclusion was that it's not fast enough due to some underlying things in WebKit... but still a lot faster than on other engines anyway.
In HTTPS, the actual URL is sent only after the SSL handshake has been performed. What outsiders can observe is:
The server name (which is given plainly in the server certificate).
The length of the request from your browser, from which the length of the URL can usually be inferred to some exte...
@ThomasPornin I think another thing to consider here is protocol-less linking.
If you're accessing a page via HTTPS and some content is either linked to also HTTPS or without declared protocol i.e. //somewebsite.com/somescript.js then the Referer header will be sent to a HTTPS linked resource
Assuming the other end accepts HTTPS requests... otherwise it'll default to HTTP... at least it should, but that's for user agents to deal with
From wiki: If a website is accessed from a HTTP Secure (HTTPS) connection and a link points to anywhere except another secure location, then the referer field is not sent.
My hot tip of the day - Trying to work with 5 VMs all housed on a single spinny disk simultaneously can result in long disk queues and sub-optimal response times.
@TildalWave Probably want to check with a real sysadmin on that, but I don't see why not. I'm a big fan of SSDs these days, so that's what I'm moving too wherever I can.
I guess what I was asking is if it's the hard disk that's the bottleneck or the controller? I have those on Matrix which is way lamer than proper HW RAIDs
With RAID1, since both disks have all the data, an intensive read-only task can work on one disk without completely killing the performance for other tasks
my main motivation for RAID1 was to avoid losing data in case of harddisk failure, but I did notice better responsiveness under load (at least for the kind of things I was doing)
@lynks frankly I'm not even sure if 10 = 1+0 actually
anyway, I have them in 1+0 with IIRC 64k clusters
found benchmarks :) OK for 1+0 it's 1.3GB/s burst rate with 104MB/s sequential throughout and 8.3ms avg. access time.... for same 4 disks in striped 0 array it's 1.9GB/s, 194MB/s and 8.7ms respectively
Oh and CPU usage is 10% and 7.2% but that's on an old C2D that's long gone
@TildalWave Usually, yes, access latency is more important for "perceived performance" than throughput
parallel access latency, actually
With RAID 1+0 (or 0+1), every data byte can be obtained from two distinct disks, so this supports (generally) two concurrent I/O tasks (at least for reading)
@ThomasPornin I'll move them to 1+0 then... I even copied those results a bit wrong and the access latency on 0 array is 12.1ms on average. That's a lot bigger difference.
"An internal Drug Enforcement Administration document seen by CNET discusses a February 2013 criminal investigation and warns that because of the use of encryption, "it is impossible to intercept iMessages between two Apple devices" even with a court order approved by a federal judge."
@David Downside in some ways, upside in others. You may not have as many class or scheduling options, any maybe not as many resources, but you'll likely have more direct access to the faculty and more access to the resources that the school does offer.
I always feel weird about posting exactly what somebody just wrote as a comment before deleting a post... but thanks for the comment, @Adnan. Saves me the time of writing / finding one to post :D
@JeffFerland I can name at least 6 that he doesn't have on this site. :-) I could have sworn that a week or two ago he was working on some badge for answering 200 questions with the same tag, but I can't find it now, so I may be mistaken.
8. I miscounted.
Ah! It was a badge specific to the tag. Not on the list. 1000 upvotes on a 200 answers for questions with a given tag.
Gees I've reached daily voting limit of 40 for the first time... now what do I do for the next two hours? I can't read new questions even, I'll be tempted to vote. Any good movies out? :)
I am developing a webapp that does not reveal record count, because it hides the primary key. I am looking for a better way to do this.
My favorite idea is to encrypt the ID itself with a block cipher, because that would require not additional tracking tables, and if the block size is equal to t...
The other day, we notice a terrible burning smell coming out of the server room. Long story short, it ended up being one of the battery modules that was burning up in the UPS unit, but it took a good couple of hours before we were able to figure it out. The main reason we were able to figure it o...
@TildalWave The more traditional form is "I aim to please." Meaning, I do attempt to make my clients happy. I, however, rather enjoy the implications of the other form.
Pleasure, while meaning a form of happiness, is typically used specifically for sexual joy.
Hmmm.... would't fire extinguishers in server rooms use Xenon gas? So... xenon gas, heat,... you just need anode, cathode and a reflector and it should produce nice lighting effect, probably violet-blue :)))
Neah it's probably halon gas, I just got it mixed up again... I'll shut up
In HTTPS, the actual URL is sent only after the SSL handshake has been performed. What outsiders can observe is:
The server name (which is given plainly in the server certificate).
The length of the request from your browser, from which the length of the URL can usually be inferred to some exte...
