Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.prolog > #14198

Re: comp.lang.prolog Frequently Asked Questions

Show all headers | View raw

Since spoofing GIT content is so easy and
non-sandboxed Prolog code is a rather sensitive
thing, I guess this is why bother with HTTPS

and a HSTS (HTTP Strict Transport Security)
policy could be important. SWI-Prolog packs are
non-sandboxed, unlike SWISH notebooks, right?

Here is what ChatGPT says:

An HTTP to HTTPS redirect vulnerability occurs
when an insecure HTTP connection is used to
redirect users to a secure HTTPS connection,
but the initial HTTP request is not adequately
protected. Here’s how this vulnerability might be exploited:

- Man-in-the-Middle Attack (MitM): Since HTTP is
unencrypted, an attacker intercepting the
initial HTTP request could manipulate the
redirection process before the user reaches
the secure HTTPS site. This could involve:

* Redirecting the user to a malicious site that
looks identical to the intended destination.
* Modifying the content in transit, such as
injecting malicious scripts.

- Downgrade Attacks: Attackers could attempt to
keep users on an HTTP connection instead of
redirecting them to HTTPS, leaving communication
vulnerable to eavesdropping or tampering.

The severity of an HTTP to HTTPS redirect
vulnerability can vary depending on the
context, but it is generally considered
moderate to high, depending on the following factors:

- Moderate: For non-sensitive sites where the
main risk is traffic manipulation (e.g., content
modification or ads injection) without
significant consequences.

- High: For sites handling sensitive user data
(e.g., financial services, medical information),
especially when users are likely to connect
over insecure networks like public Wi-Fi.

Back to comp.lang.prolog | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

comp.lang.prolog Frequently Asked Questions Markus Triska <triska@logic.at> - 2024-09-16 04:59 +0000
  broken and insecure links (Was: comp.lang.prolog Frequently Asked Questions) Mild Shock <janburse@fastmail.fm> - 2024-09-20 10:02 +0200
    Re: broken and insecure links (Was: comp.lang.prolog Frequently Asked Questions) Mild Shock <janburse@fastmail.fm> - 2024-09-20 10:39 +0200
      Re: broken and insecure links (Was: comp.lang.prolog Frequently Asked Questions) Mild Shock <janburse@fastmail.fm> - 2024-09-20 10:42 +0200
        Re: broken and insecure links (Was: comp.lang.prolog Frequently Asked Questions) Mild Shock <janburse@fastmail.fm> - 2024-09-20 10:59 +0200
          Re: broken and insecure links (Was: comp.lang.prolog Frequently Asked Questions) Mild Shock <janburse@fastmail.fm> - 2024-09-20 11:19 +0200
  Re: comp.lang.prolog Frequently Asked Questions Mild Shock <janburse@fastmail.fm> - 2024-09-20 14:04 +0200
    Re: comp.lang.prolog Frequently Asked Questions Mild Shock <janburse@fastmail.fm> - 2024-09-20 20:38 +0200
      Re: comp.lang.prolog Frequently Asked Questions Mild Shock <janburse@fastmail.fm> - 2024-09-20 20:41 +0200

csiph-web