Stack Exchange
log in

Falco

 Discussion on answer by Ja1024: Is SQ…

Imported from a comment discussion on security.stackexchange.c...
Falco
Dec 20, 2024 16:28
The major takeaway: There is a reason, why SQL-injection is still in the top threads in 2024. It is easy to get wrong. Depending on your combination of programming language, database engine, driver and system configuration there can be gaps and history has shown writing your own function can easily fail.
 

 Discussion on answer by Ja1024: argon…

Imported from a comment discussion on security.stackexchange.c...
Falco
Oct 30, 2024 12:34
@Ja1024 exactly - as I said you are right. It is just difficult since the attacker needs to reliably trigger more login attempts than legitimate users, which can be made harder by efficient rate limiting and the addition of random delays to all requests. With this the attacker would need a lot of things to work in their favor to generate a large enough sample to denoise the random delays, while also keeping the cache manipulated without crashing into the rate limit or getting the cache changed by legitimate logins.
Falco
Oct 30, 2024 12:34
@Ja1024 you are right, this could make a difference, if the attacker generates a lot more login attempts than legitimate users. Since the DB will also cache the names of users who recently logged in legitimately. So you cannot be sure, if you have just hit an account with a recent login, or the dummy.
Falco
Oct 30, 2024 12:34
There are various ways one can lead the execution down the exact same path, even if a user does not exist. One easy way: Create an additional example user in the database with a random hash - if a user does not exist, set the username variable to this example user and execute the login procedure with it.
 

 Discussion on answer by nvoigt: Hourl…

Imported from a comment discussion on workplace.stackexchange....
Falco
Jul 5, 2024 19:38
@Fattie the upvotes and nvoigts anecdotal evidence (seen it work) suggest that a lot of people don't care about someone "fucking with" their money, as long as they come out on top. But your opinion also shows that some people will care a lot and may fight any of these solutions malignantly not about the actual money, but about principle. If one has employees like that, this solution will probably not work at all.
 

 Discussion on answer by Allure: Why i…

Imported from a comment discussion on physics.stackexchange.co...
Falco
Mar 3, 2024 17:13
@Allure can you include this argument in your answer? It seems a vital point for your analogy to hold to explain why we assume the patches of sky to be disconnected instead of parts of a homogeneous mass, like the OP suggests.
 

 Discussion on question by Trioxidane:…

Imported from a comment discussion on worldbuilding.stackexcha...
Falco
Jan 29, 2024 21:22
If we had this thing we would obviously use it to construct a space elevator. This belt will remain geo-stationary at any distance to earth. We could use it to get so far as the moon being only a small jump away.
 

 Discussion on answer by Kate Gregory:…

Imported from a comment discussion on workplace.stackexchange....
Falco
Oct 30, 2023 20:03
A good example which many people accept is dress code on client sites. One doesn't have to like/appreciate professional clothing - it is simply a business requirement to respect the dress code when at the client site. And similarly there is a code of conduct which includes what comments are considered inappropriate - like a "verbal dress code" which they have to adhere to in a professional setting
 

 Discussion on answer by Kilisi: Is wo…

Imported from a comment discussion on workplace.stackexchange....
Falco
Oct 20, 2023 20:34
@Kilisi while I honestly respect your experience in your field, the situation is very different and you are actually both arguing the same point: The people actually doing the job should be listened to how the job is best done. Unless you argue people like regularly cutting themselves, management should listen to them, if they have suggestions how they could do their work better/safer.
 

 Discussion on answer by Nosajimiki: W…

Imported from a comment discussion on worldbuilding.stackexcha...
Falco
Aug 4, 2023 18:29
If the heroes are smart, they will slowly move while fighting. Probably into the direction with least resistance, or where the most effective hero is fighting. So they will leave a wide trail of corpses, but they will only have to step over few at a time. Because even just 3 bodies piled over each other will be so slippery with body-fluids and unstable, you cannot reasonably fight on.
 

 Discussion on answer by Steve: Does 3…

Imported from a comment discussion on softwareengineering.stac...
Falco
Jul 28, 2023 15:54
@Steve yes but asking questions about the non-existent boss or salary is undecidable. "boss.age > 20" cannot be answered with TRUE or FALSE, it's NULL - no answer possible, because the question doesn't make sense. Other languages would throw a null-pointer exception if boss is null. This is why I think a CASE should early-exit and evaluate to NULL if a condition returns NULL. Because it is neither TRUE nor FALSE but not decidable/not applicable.
Falco
Jul 28, 2023 15:54
Now if I have a new prospective employee whose salary is not decided yet, his salary may be "NULL" until the contract is signed. When selecting employees and grouping by salary band, the question in which salary band this employee falls is "undecidable" until we know how much he earns. He will fall into one definitive band once his contract is signed, but right now we don't know what that will be - data:NULL = unknown and CASE:NULL = undecidable.
Falco
Jul 28, 2023 15:54
@Steve My reasoning for "undecidable" goes like this: In tabular data NULL usually means unknown, not existent or not applicable/irrelevant. For example every employee has a boss, except the CEO at the top, his boss = "NULL". Now if I ask for every employee if they are longer at the company then their boss - the the result is "not applicable" for the CEO.
Falco
Jul 28, 2023 15:54
I would even argue a NULL-consistent CASE statement should evaluate to NULL as soon as it encounters a single condition evaluating to NULL. Because it cannot decide if this condition is undecidable, making all other conditions moot.
Falco
Jul 28, 2023 15:54
@Steve but the missing syntax for NULL-results makes it very hard to write certain conditions. I think it is very inconsistent to NULL being infectious in most other constructs. Because it is hard to rebuild CASE to a three way logic - on the other hand you would just need NVL(...,FALSE) to make a true three-way-logic CASE behave like the current CASE.
Falco
Jul 28, 2023 15:54
I think CASE is very inconsistent to three-value logic, because it behaves like a usual IF/ELSE statement, lumping a Boolean NULL together with FALSE under ELSE. Consequent language design should have CASE WHEN .. ELSE ... UNDECIDABLE (the UNDECIDABLE is like a CATCH if any condition evaluates to null)
 

 Discussion on answer by Weather Vane:…

Imported from a comment discussion on law.stackexchange.com/qu...
Falco
Jul 17, 2023 20:30
@DmitryGrigoryev If it happens seldom enough, it's probably just a few hundred dollars a month. Maybe you can collect it and just sometimes pay wares for your restaurant in cash as well to get rid of the money without depositing it into a bank account.
Falco
Jul 17, 2023 20:30
@WeatherVane nice - this greatly improves the answer. Thank you
Falco
Jul 17, 2023 20:30
I think Maxime has a valid point to include in the answer. Because if one wants to open an essentially "card only" restaurant in France, they could still go this way. Say you only accept card and if someone insists on paying cash, you demand they pay the exact amount, because you don't have any change. In this way you don't need a cash register and for the few customers who will pay in cash exactly without change you can just deposit the money once a month with the bank.
 

 Discussion on answer by Flater: Is Pa…

Imported from a comment discussion on softwareengineering.stac...
Falco
Jul 12, 2023 12:19
@Flater I don't think being hacked is a tradeoff, because it is the same risk for a doorman as for a lock. My point is that a physical key/s is not a good solution if you need to open many doors and password/s are not a good solution if you need to login to many pages. Humans are fundamentally not good at remembering complex strings and on the other hand a password can easily be replicated and reused if you see it once (stored or in transit).
Falco
Jul 12, 2023 12:19
@Flater If I use a public/private key system, I never share my private key. The host only stores the public key to verify my identity. Nothing secret is ever stored or sent to anybody. Even if the connection and the database are compromised the attacker will not get anything which allows him to replicate my private key.
Falco
Jul 12, 2023 12:19
@Flater a password is not a key, a key is something you have (it can be lost., found, stolen). But you are right - the problem is many doors. So either put everything of value behind a single door/single key (Like OpenID) or use something better - like a robotic doorman at each door, which can recognize you by your look, behavior etc. and open the door automatically for you, with a variety of tests depending on the sensitiveness of what's behind each door.
Falco
Jul 12, 2023 12:19
I would also argue that passwords (a secret string which a human has to remember and input via keyboard into a field) are not a good solution for the goal "authenticate this user". Why? All reasons why we use password-managers, which is a crutch to essentially roll a kind of secret-stire authentication over a web-interface, because passwords are a bad solution to the problem.
Falco
Jul 12, 2023 12:19
@Flater this is what laws are for. If you create a very transparent company with regular audits and a clearly stated goal in your contracts, you can make sure that no data is sold or used for anything else than the designated purpose.
 

 Discussion on question by Nepene Nep:…

Imported from a comment discussion on worldbuilding.stackexcha...
Falco
May 20, 2023 03:41
@user253751 I don't know if the need for safety can be any bigger than a parent or a teacher has for his kids, when we are talking about children not dying. My argument is about there being a maximum of safety our society can balance while still living normal lives. For example a mother will not protect her own child "more" because she knows he might stop the apocalypse - this would imply the mother was taking risks because her child was not important enough before.
Falco
May 20, 2023 03:41
Frame Challenge: Current schools already have the goal of being a place where no child dies. Almost every parent has a child which is like the prophesized one for them (they will do anything to keep their child safe) - so giving one more reason why children should not die, should realistically not change drastically how we operate schools or anything.
 

 Discussion on question by lollo259: H…

Imported from a comment discussion on worldbuilding.stackexcha...
Falco
Apr 7, 2023 08:53
@gs the same reasons which stop most disgruntled people from armed rebellion. Humans are social creatures, throughout most of human history being exiled or shunned was the worst form of punishment. Most humans would rather take bodily harm than being publicly shamed and exiled from the group. And if your revolutionary group is big enough, you don't even need the weapons - it is probably easier to just declare yourself leader, without also overthrowing the religion.
 

 Discussion on answer by KerrAvon2055:…

Imported from a comment discussion on worldbuilding.stackexcha...
Falco
Feb 27, 2023 09:30
The big gap in reasoning I'm still missing is how these small differences in raw strength, body size etc. actually translate into reduced combat effectiveness and on what scale. If a mixed gender army would e.g. be 3% less effective than an all male army, this difference would be completely irrelevant and not even measurable in a medieval setting, because other factors would be dominating the equation when comparing armies between different countries.
Falco
Feb 27, 2023 09:30
@Questor My understanding is this: The load which a soldier needs to carry is usually as much as the average soldier can carry reliably and sustainably without reducing his combat effectiveness too much. So if women can in fact carry less, the army would reduce the overall weight of stuff they need to carry and this would probably be the disadvantage of a mixed gender army, they having less stuff (or lighter weight armor)
Falco
Feb 27, 2023 09:30
@Questor I was referring to this article from the Uinversity of alaska. But they don't give an original source. uaf.edu/news/women-may-have-advantage-in-the-long-run.php
Falco
Feb 27, 2023 09:30
@Graham the olympic games (like most sporting events) have a long selection bias in favor of males. E.G. the male top athletes are usually selected from a much wider group of males trying to be successful in sports. On the other hand fencing is a good example of body/muscle mass not having a significant impact. There are no weight-groups in fencing and the fencing champions are usually not the largest fencers - in fact articles who looked at this came to the conclusion "there is no correlation between size and success in fencing
Falco
Feb 27, 2023 09:30
Exactly - I'm not contesting this. What I'm contesting is if raw strength matters enough in a military like e.g. the Roman Army to make a mixed gender army actually perform measurably worse in war.
Falco
Feb 27, 2023 09:30
Regarding "pulling their weight" - modern studies suggest females may actually possess superior stamina, endurance and resilience to males. This is why women often run on par in very long-distance runs and similar activities. For typical army activities endurance could very well be more important than strength.
Falco
Feb 27, 2023 09:30
I think many societies operated like this a small professional core (later often nobles or knights) and depending on the situation a varying number of rather untrained farmers with weapons. The military elite of such a society could as well be mostly female, while the call-to-arms to defend your homes could reach more males than females.
Falco
Feb 27, 2023 09:30
And even with predominantly melee warfare (so mainly spears) I've yet to see convincing numbers about men consistently outperforming women in a complex task like fighting, where coordination, morale, group cohesion, dexterity play a bigger role than raw peak-strength.
Falco
Feb 27, 2023 09:30
For 3: You don't even have to go mechanized. Even fighting from horseback is already a discipline where better technique and better coordination with the animal easily outperforms stamina and strength.
Falco
Feb 27, 2023 09:30
While 1 is a completely valid point for hunter-gatherer tribes or an all-out-war, it is quite irrelevant if we talk about professional soldiers. A standing army with full-time soldiers comprise only a small fraction of the population, because it has to be supported by a lot of farmers and other jobs. So it shouldn't really make a difference if this 2-3% of the workforce is male or female.
 

 Discussion on answer by Mon: At what …

Imported from a comment discussion on worldbuilding.stackexcha...
Falco
Feb 26, 2023 19:38
@KeithMorrison That is only really the case for small or decisive battles. As soon as the individal soldier in a row (e.g. phallanx) cannot see most of the battle line, his decision of fight of flight is mainly influenced by his immediate surroundings and what he believes to be true. Several units broke, because they believed e.g. their leader had fallen even when they did not.
Falco
Feb 26, 2023 19:38
But all these points can be quite important, because group-cohesion, leadership and morale are fields in which females could have a natural edge compared to male units.
 

 Discussion on answer by JBH: How diff…

Imported from a comment discussion on worldbuilding.stackexcha...
Falco
Nov 17, 2022 21:07
@Stef you can even take UX one step further. Military equipment is often also designed to be easily repaired in the field. This means it is easy to disassemble and reassemble without breaking anything. If you take it two steps further: Maybe the device was constructed for agents which may be stranded in a pre-industrial civilisation and have to repair it, so all parts are designed to be easily replaced/replicated, even with a lower level of technology.
 

 Discussion on question by BinarSkugga…

Imported from a comment discussion on security.stackexchange.c...
Falco
Apr 19, 2022 07:38
@nobody The correct tools are pretty self-explanator these days - and you don't even need to buy the hardware anymore. You can book password-cracking as a Service on a per Use Basis and pay just for the used CPU cycles.
Falco
Apr 14, 2022 17:44
Using up-to-date password cracking techniques is the best way to check if a password is truly weak and probably the best proof in court, to demonstrate a password being weak.
Falco
Apr 14, 2022 17:43
On the other hand, passwords may look weak with certain metrics, but are in fact quite strong - example a short password with very complex UTF-8 characters or emojis can have a high entropy. Or a password with only lowercase letters can be very long and thus strong.
Falco
Apr 14, 2022 17:41
A password may look strong, but is in fact weak - in the top 1000 passwords, there are some which look very random, but are in fact certain patterns on the keyboard, or some easy to remember rhyme, which are used by a lot of people world wide and are easily known by password-cracking-dictionaries.
Falco
Apr 14, 2022 17:39
@BinarSkugga But if you have no experience how a password can be cracked, how will you decide if a password is "weak" - when weak should mean "easy to crack". I think to make the decision if a password is weak, you have to know how passwords can be brute-forced, and what are currently used dictionary-techniques.
Falco
Apr 14, 2022 11:59
My question remains: Why do you need to store the weak-flag? If a password really is weak, you can just brute-force it yourself and discover the original password. If you cannot brute force it yourself, then it was not weak.
Falco
Apr 13, 2022 12:35
Frame Challenge: If an account gets hacked, just put the DB Hash of the hacked account into a brute-force password-cracking tool and see if it can be cracked easily. Case and Point you have the proof you need: If the password is weak in practice. You don't need to store a flag, since with a weak password, you can just crack the password yourself - and if you cannot, then it is by definition not weak.
 

 Discussion between Bass and David A. …

Imported from a comment discussion on puzzling.stackexchange.c...
Falco
Dec 3, 2021 09:38
Or rather "239,003" "73" "133,003" and wathever appears off-screen - maybe 333 ?
Falco
Dec 3, 2021 09:34
This would combine the easiest rule "just count 3s" with the most common error "delimiter collision"
Falco
Dec 3, 2021 09:32
I think you're both right: It is a separator Problem - but leading Zeroes are omitted in the Print. The Broken Numbers are: "239,003" and "73,133"