Jump to content

Ciccioo

Member
  • Posts

    1,329
  • Joined

  • Last visited

Reputation Activity

  1. Agree
    Ciccioo reacted to colonel_mortis in Webpage Security and DBMS   
    If you're creating a website where users can have accounts, you are almost certainly going to want to use a database. Among other things, in that database, you will have table for users, which will contain, at a minimum, their username/email and a representation of their password. Never, under any circumstances, store the plaintext password anywhere. For more details on different password storage mechanisms and their weaknesses, you can watch Tom Scott's video about how not to store passwords, but in short, you should store a salted hash of the password. What that means is that you add some random data to the password (or using some algorithms the random data is actually used separately from the password), then pass it through a one-way "encryption" algorithm, which will always give the same output given the same input, but can't be reversed without just brute forcing different combinations. To do that in PHP, the most secure, and strongly recommended, method is to use the built in password_hash and password_verify methods (which will handle secure salts and hash algorithms for you):
    // When creating an account $thingToStoreInPasswordColumnOfDatabase = password_hash($passwordEnteredByUser, PASSWORD_DEFAULT); // When they come to log in $isCorrect = password_verify($passwordEnteredByUser, $thingFromPasswordColumnOfDatabase); PLEASE don't try to hash/encrypt/process the passwords yourself, because getting it wrong is very bad.
     
    When you are using the database, the naive thing to do is to write a query like
    $query = "SELECT * FROM users WHERE username='" . $usernameEnteredByUser . "'"; However, this is vulnerable to an SQL injection attack, where the user enters something like "admin'; DROP TABLE users;--", which would result in the following query being run:
    SELECT * FROM users WHERE username='admin'; DROP TABLE users;--' resulting in two queries being run, the second of which deletes your users table.
    To protect against this, you need to use prepared queries, which are where the query that can be executed is sent separately to the data. I'm not going to give all the code needed for prepared queries in this post, because it would make it significantly longer, but you should be using the PHP library PDO for it.
    When using prepared queries, you should never have any variables in the prepared query (no "SELECT * FROM users WHERE " . $anything) - any variable, even if you think it is trusted, should be used as a prepared parameter, to avoid risk of inadvertently adding an SQL injection vulnerability.
  2. Agree
    Ciccioo reacted to Godlygamer23 in Does operating system stay on storage?   
    It'll retain the original settings present on the hard drive.
  3. Like
    Ciccioo reacted to zMeul in 4K HDR Blu Ray - Is it worth it?   
    see my updated post, I originally though you asked something else
    you aren't actually seeing HDR
  4. Agree
    Ciccioo reacted to zMeul in 4K HDR Blu Ray - Is it worth it?   
    actually it won't - both will be 8bit 
  5. Agree
    Ciccioo reacted to DevBlox in What can cause maintenance down times?   
    A website has as much potential downtime as is it is complicated. A simple website can easily survive even a hosting service restart, because it takes less than a second, while a bigger project might be more dangerous to restart, causing all sorts of business losses along the way.
     
    If a system is complicated there may be more ways than one to experience downtime. What I'm trying to say, only a part of the system may experience downtime at one point, while, let's say, the front facing system is fine (ever seen some message of downtime on some big site that still seems to function? Chances are, they are doing maintenance in their backend or something not nice is going on there, some features may not work, while others will work just fine). It's not just the database that can mean downtime, some systems have their data travel many servers to from backend to frontend, with all sorts of processing happening along the way, some can have nothing to do with the database at all. It's all to to with the architecture of a system. With such large systems, there are also cunning ways of avoiding downtime, dealing with large load and so on.
     
    Usually that means more than just pushing to master and immediately testing it on the site. I understand if some things may be harder to comprehend without witnessing, it takes some time to learn :). Though that's a giant topic/topics that would take hours to explain in depth, seriously, you could write a whole book about that stuff, i bet people have, I did not read them though, I learned all that in the field, so I don't know where to point you to :).
  6. Like
    Ciccioo got a reaction from capdauntless in e8400 not supported in Windows 10   
    did you try to update your mobo bios?
  7. Like
    Ciccioo got a reaction from Bensemus in So Why Is Apple "The best" in some peoples eyes?   
    This is comparing an AIO with a full tower, which isn't fair. The iMac is infinitely easier to install, use and place, and it's just more forward thinking. Big computer boxes are already outdated for the average user. Now it's all about laptops, tablets and AIOs.Apple offers sweet design and great technology, sacrificing a bit of performance or upping a bit their prices. This works nicely because the average gamer doesn't really need all the power in his rig, let alone the average user.
  8. Like
    Ciccioo reacted to Nineshadow in bfc - Brainf*ck compiler in C++ and assembly [WIP]   
    UPDATE 0.9 :
    The long awaited moment ( by no person ever) has arrived! This brainfuck
    compiler now has support for loops. You can now use any number of
    brackets that you'd like.
     
    @Ciccioo
     
    I gotta say my work is 90% complete right now. Only need to change the array in which you can move the pointer to the type that brainfuck uses. Currently it's working with integers.
     
    And the jumps weren't even all that hard. You just needed to have some knowledge of assembly, which I kinda lacked. After I had worked for like half an hour on the instructions for a jump, it just crashed.Then for the next 3 hours I kept debugging.Heck , I even made a version in C. Only to go back to the C++ vesion to discover that I had to change 1 letter and 1 instruction.I feel like an idiot.
    This is what I'm talking about, from this :
    cmp %eax , 0je endLoop+countID to this:
    testl %eax , %eaxjz endLoop+countID
  9. Like
    Ciccioo reacted to linuxfan66 in clarificaiton on the effects of managed languages on buffers   
    this particular controversy came up in a thread i was in early and never got resolved according to this you cannot buffer overflow on a manage language setup like .net or java because enforces limits on buffers that cant be easily crossed. 
    the other way to prevent them listed is to use safety libraries with c/c++.
     
    this begs a question for me why do why write security relevant libraries with beffer overruns/underfaults/faults are are major threat(heartbleed, all sort of browser drivebys, and stagefright library) in languages that are inherently vulnerable if making it managed prevents it from happening as suggested above.
     
    can someone who qualified answer and cite their sources?
     
  10. Like
    Ciccioo reacted to SImoHayha in Do you believe in different dimensions and the multiverse   
    But there is another universe where you do believe in multiple universes
  11. Like
    Ciccioo got a reaction from 0ld_Chicken in $9.99 MICHAEL   
    $0.50 CURTIS
  12. Like
    Ciccioo got a reaction from GoldSrc in [PopCorn Time more bad news] 75,000 users will be getting a surprise in the mail this fall   
    link to such law?
     
    ...it's not like it didn't happen before...
     
    i think that the vast majority of those who pirate do it from home. those who pirate using a free wifi are probably those who live in the range of said wifi, but sure, nobody will ever try to sue somebody who offers free internet, and if they try they will surely fail miserably.
    but again, most people do that stuff from home because they don't really feel threatened at all, making a lawsuit much more viable.
  13. Like
    Ciccioo got a reaction from burnttoastnice in [PopCorn Time more bad news] 75,000 users will be getting a surprise in the mail this fall   
    link to such law?
     
    ...it's not like it didn't happen before...
     
    i think that the vast majority of those who pirate do it from home. those who pirate using a free wifi are probably those who live in the range of said wifi, but sure, nobody will ever try to sue somebody who offers free internet, and if they try they will surely fail miserably.
    but again, most people do that stuff from home because they don't really feel threatened at all, making a lawsuit much more viable.
  14. Like
    Ciccioo got a reaction from jameshumphries47 in mysql not working!   
    good ol'
    echo $sql="INSERT INTO `shopping`(`Item`,`Shop`,`Priority`,`Status`,`Cost`,`Quant`)VALUES('".$_POST['Item']."','".$_POST['Shop']."','".$_POST['Priority']."','".$_POST['Status']."','".$_POST['Cost']."'.'".$_POST['Quant']."')";
  15. Like
    Ciccioo got a reaction from jameshumphries47 in mysql not working!   
    well, take that query, go to phpmyadmin, and run it
     
    or just echo mysql_error() instead of "could not add data"
     
    edit: there is a dot instead of a comma between the last two values
  16. Like
    Ciccioo got a reaction from jameshumphries47 in mysql not working!   
    so... what's the error?
    that's because when you first open the page you use the HTTP GET method, so the $_POST superglobal is empty, and when you access it you get errors. be sure that the variables you access are defined, using the method you already learned
  17. Like
    Ciccioo got a reaction from dalekphalm in [PopCorn Time more bad news] 75,000 users will be getting a surprise in the mail this fall   
    do you guys really think that if you have a dynamic ip address you're untrackable? and that they need to find out who was sitting in front of the computer downloading movies?
     
    ISPs know exactly who had ip address X at time Y, and the rights alliance simply needs to sue the fuck out of whoever signed the contract with the ISP.
    the very minor percentage of those 75k users who was behind a VPN may be safer, but guys don't think that you're the uncatchable masters of the internet because you downloaded a vpn client and pushed a button.
  18. Like
    Ciccioo got a reaction from ChineseChef in [PopCorn Time more bad news] 75,000 users will be getting a surprise in the mail this fall   
    do you guys really think that if you have a dynamic ip address you're untrackable? and that they need to find out who was sitting in front of the computer downloading movies?
     
    ISPs know exactly who had ip address X at time Y, and the rights alliance simply needs to sue the fuck out of whoever signed the contract with the ISP.
    the very minor percentage of those 75k users who was behind a VPN may be safer, but guys don't think that you're the uncatchable masters of the internet because you downloaded a vpn client and pushed a button.
  19. Like
    Ciccioo reacted to CydiaDash in The Most Pain You've Ever Endured.   
    This is a brilliant conversation starter
  20. Like
    Ciccioo got a reaction from lol1290 in Do you consider gaming a sport?   
    this poll has surprising results
  21. Like
    Ciccioo reacted to BOT Edward in Do you consider gaming a sport?   
    No way! No gaming is a proper sport and neither is Chess IMO.
     
    A sport to me is for promotion of physical activity not shitbuckets and doritos
  22. Like
    Ciccioo got a reaction from Hackzzila in My JS isn't working   
    the space after the dot and before nav-toggle
     
    next time please report the error that you get, or even better a jsfiddle
  23. Like
    Ciccioo got a reaction from Flight1sim in So Why Is Apple "The best" in some peoples eyes?   
    "trusted advisor" is a title restricted to a subject, smart guy. Learn how to internet before wasting keystrokes
  24. Like
    Ciccioo got a reaction from Flight1sim in So Why Is Apple "The best" in some peoples eyes?   
    This is comparing an AIO with a full tower, which isn't fair. The iMac is infinitely easier to install, use and place, and it's just more forward thinking. Big computer boxes are already outdated for the average user. Now it's all about laptops, tablets and AIOs.Apple offers sweet design and great technology, sacrificing a bit of performance or upping a bit their prices. This works nicely because the average gamer doesn't really need all the power in his rig, let alone the average user.
  25. Like
    Ciccioo got a reaction from Travercraig in CSS/HTML - Help with div positioning, follow up question.   
    how about this?
    i don't know what you mean by "the boxes aren't where they should be", now that i fixed the sizes and alignments it looks fine to me, i can't see the teamspeak logo because it's lacking the image but it should be fine if you use a square image (maybe 45x45 already).
     
    yes it's not coded the right way at all, as i said it would be much preferred to use floats, but the result in the link above is achieved by just editing 3 or 4 lines of css, so that's quick for sure
     
    edit: added random image to see if it fits
×