Path: csiph.com!aioe.org!.POSTED!not-for-mail From: "R.Wieser" Newsgroups: comp.lang.php Subject: Re: Ecommerce site - how? Date: Tue, 27 Jun 2017 11:24:33 +0200 Organization: Aioe.org NNTP Server Lines: 125 Message-ID: References: NNTP-Posting-Host: XSLsI1Jcl7NultOj/0AyIg.user.gioia.aioe.org X-Complaints-To: abuse@aioe.org X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2615.200 X-MSMail-Priority: Normal X-Priority: 3 X-Newsreader: Microsoft Outlook Express 5.00.2615.200 X-Notice: Filtered by postfilter v. 0.8.2 Xref: csiph.com comp.lang.php:17498 J.O. > No, it's not an issue with ISP, it's the e-commerce site which is the issue. Ofcourse it is ! I guess when your bike has a flat tire you will complain to the brick-and-mortar store too ? /s > So you mean that ISP should provide the worse possible customer > experience so that badly designed e-commerce sites would keep on > working? One) Nope (who the heck said that ? I'm rather sure I didn't). But as you are amadant that problems (knowingly!) created by your ISP (and others) should be solved by whomever you want to connect to -- of which an e-commerse site is just one, as I've been trying to explain a few times now -- I don't think we have anything to discuss anymore. Two) Its your ISP with its "lets change IPs whenever we like it"* who is the one who is be causing the "worst possible customer experience", no matter what site/server you connect to. SSL connections will be dropped, logging in will be broken for the same reason. *something I do not even believe they do, as also explained. > Yes, it will be part of the same http post, but that don't mean it will > be automatically added to CSRF request. The are part of the same http request, but not of the CSRF request ? You have to explain that one to me I'm afraid. And no, I'm not going to scour that site in search of what you might be thinking of. Either you link to or quote it, or I'm going to consider this matter closed (don't want to waste more time at it as I've already done). > Yes, if he finds current one, he will find the previous one too, Nope. And believe me, as thats my experience with searching the interwebs speaking there. Sometimes you can, but more often you don't. > unless using some obscure search engine that just index one message in each thread. That must be it ! Now I understand. Google is just one of those "obscure search engine"s you're talking about ! /s > It's just extra work on your posts with deleting and by the way the your > news client modifies the "original" text. Yes, it does. It follows the RFC for NNTP messages, but does not attempt any kind of reflow (as it doesn't make any presumtions about the "quote chars" the different newsgroup clients might be using). Blame MS for that. :-) But hey, what are you doing there ? I *told* you you could stop at the indicated line, but you ignored it and than still complain ? You're really a piece of work you know. :-D Regards, Rudy Wieser -- Origional message: J.O. Aho schreef in berichtnieuws ere866Fn9ftU1@mid.individual.net... > On 06/26/17 22:29, R.Wieser wrote: > > >> What about the case when it's time to renew your lease and you > >> happen to be shopping and your ISP decided it's time for you to > >> switch to a less busy network. > > > > Than you have a problem with your ISP, and not the e-commerce site. > > No, it's not an issue with ISP, it's the e-commerce site which is the issue. > > > Don't be as stupid to expect such a site to solve all the quirks the > > intermediate ISPs have (purposely, often in full disregard to their > > customers needs) inserted in their networks. > > So you mean that ISP should provide the worse possible customer > experience so that badly designed e-commerce sites would keep on working? > > >> Also keep in mind that IP can also be spoofed in a number of ways, > >> so keeping track of the IP is no way a good method, it's better to use > >> request verification tokens. > > > > Lol. I could explain to you that CSRF attack and link hijacking defense > > methods must-and-are rather different (the first is done within your > > browser, the second definitily not), but as you are the one suggesting it yu > > must have an idea how its applicable. So, be my guest and explain. > > > > And a hint: *both* parts of that "token" are placed in the same HTTP > > request. > > Yes, it will be part of the same http post, but that don't mean it will > be automatically added to CSRF request. So just make a second visit to > OWASP and start reading. > > > >> PS. Stop that stupid bottom posting of the previous post, even a > >> second grade news reader like outlook can manage to keep track > >> of threads. > > > > You're an arrogant, short-sighted shit Your here-and-now is not the only > > thing thats important you know. Just imagine someone searching the web for > > a certain answer, and all he can find is the current message. For that > > reason I keep a copy of the origional post to at the bottom of my reply. > > Yes, if he finds current one, he will find the previous one too, unless > using some obscure search engine that just index one message in each thread. > > > And if you do not like it, you *could* just stop at the line where I mention > > It's just extra work on your posts with deleting and by the way the your > news client modifies the "original" text.