devRant - A fun community for developers to connect over code, tech & life as a programmer

Search - "transport layer"

26

Kimmax

11247

6y

So I have seen this quite a few times now and posted the text below already, but I'd like to shed some light on this:

If you hit up your dev tools and check the network tab, you might see some repeated API calls. Those calls include a GET parameter named "token". The request looks something like this: "https://domain.tld/api/somecall/..."

You can think of this token as a temporary password, or a key that holds information about your user and other information in the backend. If one would steal a token that belongs to another user, you would have control over his account. Now many complained that this key is visible in the URL and not "encrypted". I'll try to explain why this is, well "wrong" or doesn't impose a bigger security risk than normal:

There is no such thing as an "unencrypted query", well besides really transmitting encrypted data. This fields are being protected by the transport layer (HTTPS) or not (HTTP) and while it might not be common to transmit these fields in a GET query parameter, it's standard to send those tokens as cookies, which are as exposed as query parameters. Hit up some random site. The chance that you'll see a PHP session id being transmitted as a cookie is high. Cookies are as exposed as any HTTP GET or POST Form data and can be viewed as easily. Look for a "details" or "http header" section in your dev tools.
Stolen tokens can be used to "log in" into the website, although it might be made harder by only allowing one IP per token or similar. However the use of such a that token is absolut standard and nothing special devRant does. Every site that offers you a "keep me logged in" or "remember me" option uses something like this, one way or the other. Because a token could have been stolen you sometimes need to additionally enter your current password when doings something security risky, like changing your password. In that case your password is being used as a second factor. The idea is, that an attacker could have stolen your token, but still doesn't know your password. It's not enough to grab a token, you need that second (or maybe thrid) factor. As an example - that's how githubs "sudo" mode works. You have got your token, that grants you more permissions than a non-logged in user has, but to do the critical stuff you need an additional token that's only valid for that session, because asking for your password before every action would be inconvenient when setting up a repo

I hope this helps understanding a bit more of this topic :)
Keep safe and keep asking questions if you fell that your data is in danger
Reeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee

rant devrant security

5
11

shelladdicted

4382

6y

CS Teacher today:
"Transport Layer provides Security and Encryption to the communication" (TCP/IP stack)

me: WTF? Encryption is provided on the *top* of the transport layer (aka Application) ( and below [Network Layer] there is IPsec)

Teacher: no, it's wrong.

me: so Wikipedia it's wrong, RFC 5246 is wrong, and you have right?

Teacher: Yes.

me: Ok. (aka fuck you!)

rant wtf networking tcpipstack

2
6

CaptainRant

3553

3y

In reply to:
https://devrant.com/rants/3957914/...

Okay, we must first establish common ground here. What do we understand about "showing"? I understand you probably mean displaying/rendering, more abstractly: "obtaining". Good, now we move on.

What's the point of a front-end? Well, in the 90's that used to be an easy answer: to share information (not even in a user-friendly way, per se). Web 2.0 comes, interaction with the website. Uh-oh, suddenly we have to start minding the user. Web 3.0 comes, ouch, now the front-end is a mini-backend. Even tougher, more leaks etc. The ARPAnet was a solution, a front-end that they had built in order to facilitate research document-sharing between universities. Later, it became the inter(national) net(work).
First there was SGML to structure the data (it's a way of making it 'pretty' in a lexicographical way) and turn it into information (which is what information is: data with added semantics) and later there was HTML to structure it even further, yet we all know that its function was not prettification, but rather structure. Later came CSS, to make it pretty. With its growing popularity, the web started to be used as a publishing device.
source:
https://w3.org/Style/CSS20/...

If we are to solely display JSON data in a pretty way, we may be limiting ourselves to the scenario of rendering pretty web pages using aesthetic languages such as CSS. We must also understand that if we are only focusing on making a website pretty with little to moderate functionality, we aren't really winning. A good website has to be a winner in all aspects, which is why frameworks came into existence, but.. lmao, let's leave that to another discussion.

Now let me recall back my college days.. front-end.. front-end.. heck, even a headset can be a front-end to a pick-order backend. We must think back to the essence, to the abstract. All other things are just implementations of it (yes, the horrendous thousands of Javascript libraries, lol).

So, my college notes say:
"Presentation layer: this is the UI.

In this layer you ask the middle tier for information, which gets that information from a database, which then goes back to middle tier, back to presentation. In the case of the headset, the operators can confirm an order is ready. This is essentially the presentation tier again: you're getting information from the middle tier and 'presenting it' as it were.
The presentation layer is in essence the question: how do I bring my application data to my end users in a platform-and solution-independent way?"

What's JSON? A way to transport data between the middle tier and the presentation tier. Is that what frontend development is? Displaying it in a pretty way? I don't think it is, because 'pretty' is an extra feature of obtaining and displaying data. Do we always have to display data in a pretty way? Not necessarily. We could write a front-end script (in NodeJS perhaps) that periodically fetches certain information from a middle-tier is serves a more functional role rather than a rendering one.

The prettification of data was a historical consequence of the popularity of the web (which is a front-end) (see second paragraph with link). Since the essence of a front-end is to obtain information from the back-end (with stress on obtaining), its presentation is not necessarily a defining characteristic of it, but rather an optional and solution-dependent aspect, a facet.

rant reply-to-another-post too-long-to-comment

4
5

Awlex

18362

6y

This person suggests that youtube went down, because somethign went wrong while moving to different transport layer network protocol.

https://twitter.com/fahadjax/...

rant

1
2

LucaScorpion

4229

6y

The fucking Unity Transport Layer API documentation is horrible! There's a bunch of information missing, and whenever I try to send data I just get a "NoResources" error. All the docs say about that one is: "No internal resources ro acomplish request.", nothing on forums or google... Worst part is, I've not even started dev that long and Unity has already given me quite some trouble. I hope that's just inexperience, and not Unity being a bitch.

undefined docs networking fml unity transport layer

2
0

yallacustom

0

1y

How to Create Beautiful and Durable Pie Boxes

Whether you are looking for a unique gift to give, or you are looking to protect the delicate items you hold, there are many ways to do so with the right pie boxes. By using a custom designed box, you can capture the essence of the delicacies you are storing and protect them for a longer period of time.

Protect delicate items
Using pie boxes is a good way to protect delicate items such as pies, cakes and desserts. However, you need to be sure that the box is the right size and shape to ensure that your item is safely packed. If you don't pack your delicate products properly, they could suffer from moisture and change in temperature.

Before you begin packing your goods, consider whether you should use bubble wrap or paper. While bubble wrap provides an extra layer of protection, it can also leave your product vulnerable to scratching. Choose paper to wrap your items, as it will prevent scratches and will keep them from shifting during transport.

When wrapping fragile items, you need to use a lot of packing tape to secure your package. You should also fill any empty space in the box. You can do this by using bubble wrap, or by adding extra padding. Make sure to mark your box as fragile and to place a label with your name and delivery address on all sides of the box.

Once you've completed the packaging process, you need to seal the box and place it in the shipping box. Besides bubble wrap, you may also want to include ice packs to add extra protection. A cushioned ice pack is another option for additional protection.

You should also use quality packing tape, and make sure to cover all the openings of your box. You can also use zip-up bags to help you keep your things in place.

It is important to know the best way to protect delicate items, so you can prevent them from damage during the shipping process. There are many ways to do this, but you should use the right tools for the job. Purchasing a box that is the right size and shape for your items is the most effective way to do it.

When you use custom pie boxes, you can rest assured that your pies, chocolate pies and other edibles will be safe. They're manufactured with modern equipment and environmentally friendly printing techniques.

Make a gift
Whether you are giving a pie for a birthday, wedding, or as a thank you gift, you can make pie boxes that are beautiful and durable. Several pie box designs are available online, but you can also create your own. Here are some simple instructions to make a simple, yet elegant box.

The first step is to print out a template of a pie box. You can use a piece of scrap paper or decorative paper for your design. If you are using decorative paper, cut out a rectangle the size of your box. If you are using colored cardstock, you will need to cut out a pie filling layer. Once you have a pie filling layer, copy it for several boxes. You can also add other designs or embellishments to your boxes.

Next, place your colored cardstock on your cutting mat. With your x-acto knife, cut out a rectangle that is as large as your box. You will need to fold it on the dotted line. If you are using an x-acto knife, it will be easier to fold the box. Alternatively, you can use a scoring stylus. If you have a Cricut, you can score the cardstock to make a scalloped box top. You can also use burlap ribbon or twine to wrap your box.

Once you have the box finished, you can decorate it with other decorations or embellishments. You can even use calligraphy or other techniques to make the box more special. To close the box, you will need a sticker or piece of tape. You can decorate the lid with patterned paper and a clear plastic screen. This will allow you to see the contents of your pie. You can also use embellishments such as ribbon, glitter, or other materials to make the box more fun.

If you are giving a pie for a holiday or party, you can decorate your box with a festive theme. For example, you can have a holiday tree on the front of your box. Or, you can dress it up for a tailgate party.

rant pie boxes

2