Comments for The Forgettable Mister Ruthsarian http://weblog.bridgew.edu/ruthsarian All manner of web development issues discussed, but with a heavy focus on CSS. Mon, 16 Nov 2009 15:20:56 -0500 http://wordpress.org/?v=2.8.4 hourly 1 Comment on Acrobat Open Parameters by Ruthsarian http://weblog.bridgew.edu/ruthsarian/2009/09/09/acrobat-open-parameters/comment-page-1/#comment-17901 Ruthsarian Mon, 16 Nov 2009 15:20:56 +0000 http://weblog.bridgew.edu/ruthsarian/?p=252#comment-17901 I determined the 300 by trial and error. I'd start at 500 and see how close I was to my target, then add or subtract as needed until I found a value that loaded the page right where I wanted it to be. I determined the 300 by trial and error. I’d start at 500 and see how close I was to my target, then add or subtract as needed until I found a value that loaded the page right where I wanted it to be.

]]> Comment on Acrobat Open Parameters by Peter http://weblog.bridgew.edu/ruthsarian/2009/09/09/acrobat-open-parameters/comment-page-1/#comment-17767 Peter Wed, 11 Nov 2009 20:22:46 +0000 http://weblog.bridgew.edu/ruthsarian/?p=252#comment-17767 HOw did you determine the 300? Is there a way to select a region on a page have the rectangle be determined? HOw did you determine the 300? Is there a way to select a region on a page have the rectangle be determined?

]]> Comment on Ruthsarian Menus and Skidoo Redux Updates by Web Templates http://weblog.bridgew.edu/ruthsarian/2008/09/30/ruthsarian-menus-and-skidoo-redux-updates/comment-page-1/#comment-17761 Web Templates Wed, 11 Nov 2009 13:01:35 +0000 http://weblog.bridgew.edu/ruthsarian/2008/09/30/ruthsarian-menus-and-skidoo-redux-updates/#comment-17761 Thanks for keeping us in the loop about programming changes. Its incredibly frustrating to struggle for something you think YOU are doing wrong only to learn its a bug! Thanks for keeping us in the loop about programming changes. Its incredibly frustrating to struggle for something you think YOU are doing wrong only to learn its a bug!

]]> Comment on Utility Stylesheets by Mike http://weblog.bridgew.edu/ruthsarian/2005/09/02/utility-stylesheets/comment-page-1/#comment-17726 Mike Tue, 10 Nov 2009 00:12:01 +0000 http://weblog.bridgew.edu/ruthsarian/2005/09/02/utility-stylesheets/#comment-17726 Very neat trick, this underscore hack. I am mostly using conditional statements these days, but it's still good to know there is another way Thanks Mr. Ruthsarian. Very neat trick, this underscore hack. I am mostly using conditional statements these days, but it’s still good to know there is another way Thanks Mr. Ruthsarian.

]]> Comment on Washing Client Certs in ColdFusion with SOAP – Part 2 by Washing Client Certs in ColdFusion with SOAP – Part 3 – The Forgettable Mister Ruthsarian http://weblog.bridgew.edu/ruthsarian/2009/10/26/washing-client-certs-in-coldfusion-with-soap-part-2/comment-page-1/#comment-17361 Washing Client Certs in ColdFusion with SOAP – Part 3 – The Forgettable Mister Ruthsarian Mon, 26 Oct 2009 20:13:57 +0000 http://weblog.bridgew.edu/ruthsarian/?p=262#comment-17361 [...] from part 2, I’ve got my SOAP request working, but the solution is limited to the OS platform and I [...] [...] from part 2, I’ve got my SOAP request working, but the solution is limited to the OS platform and I [...]

]]> Comment on Washing Client Certs in ColdFusion with SOAP – Part 1 by Washing Client Certs in ColdFusion with SOAP – Part 2 – The Forgettable Mister Ruthsarian http://weblog.bridgew.edu/ruthsarian/2009/10/26/washing-client-certs-in-coldfusion-with-soap-part-1/comment-page-1/#comment-17359 Washing Client Certs in ColdFusion with SOAP – Part 2 – The Forgettable Mister Ruthsarian Mon, 26 Oct 2009 18:40:45 +0000 http://weblog.bridgew.edu/ruthsarian/?p=257#comment-17359 [...] part 1 I introduced you to basic SOAP consumption in ColdFusion. Let’s see where things go from [...] [...] part 1 I introduced you to basic SOAP consumption in ColdFusion. Let’s see where things go from [...]

]]> Comment on ColdFusion: CFQUERY and Evaluate() by Ronald http://weblog.bridgew.edu/ruthsarian/2006/10/03/coldfusion-cfquery-and-evaluate/comment-page-1/#comment-17358 Ronald Mon, 26 Oct 2009 16:00:32 +0000 http://weblog.bridgew.edu/ruthsarian/2006/10/03/coldfusion-cfquery-and-evaluate/#comment-17358 @Fred: complete and utter bollocks. Your example is the perfect example of going for security through obscurity, while better methods _should_ be encouraged. If the product is commercially available, people have insight in the source code and can know the variable name. If the product was developed in-house, it may still be possible to get to the source code because of other security bugs to view file content or so. Also, did you even wonder about the amount of entropy in coldfusion variable names? Do you encourage developers to use your proposed naming scheme? I doubt it. Even for completely blind attacks the amount of entropy in variable naming is not that big and you might indeed be able to brute force it. Your proposal for 'security' boils down to using plain-text passwords with a non-existent password policy biased to syntactically sugared strings. @Fred: complete and utter bollocks. Your example is the perfect example of going for security through obscurity, while better methods _should_ be encouraged.

If the product is commercially available, people have insight in the source code and can know the variable name.

If the product was developed in-house, it may still be possible to get to the source code because of other security bugs to view file content or so.

Also, did you even wonder about the amount of entropy in coldfusion variable names? Do you encourage developers to use your proposed naming scheme? I doubt it. Even for completely blind attacks the amount of entropy in variable naming is not that big and you might indeed be able to brute force it.

Your proposal for ’security’ boils down to using plain-text passwords with a non-existent password policy biased to syntactically sugared strings.

]]> Comment on Inkscape by Colin http://weblog.bridgew.edu/ruthsarian/2009/02/23/inkscape/comment-page-1/#comment-1954 Colin Mon, 16 Mar 2009 01:35:11 +0000 http://weblog.bridgew.edu/ruthsarian/?p=238#comment-1954 I wonder if this article about Fluid Grids will inspire the next Skidoo update... http://www.alistapart.com/comments/fluidgrids/ eg. max-width: 61.75em; /* 988px / 16px = 61.75em */ It sounds as though they have greatly reduced the number of IE hacks required, but still have bugs with images. I'm grateful your first fluid Skidoo persuaded us to make our site "Fluid". We have since upgraded to your latest version, and I've recently viewed it on various tiny mobile devices for the first time; it looks great thanks to you. The first thing you have to do reading a site on an iPhone type device is increase the font size. That's when you see the benefit of letting go of tables, fixed widths, and font sizes, as you encouraged us to do. I look forward to a Skidoo refinement based on Fluid Grid thinking too. Colin I wonder if this article about Fluid Grids will inspire the next Skidoo update…
http://www.alistapart.com/comments/fluidgrids/
eg. max-width: 61.75em; /* 988px / 16px = 61.75em */

It sounds as though they have greatly reduced the number of IE hacks required, but still have bugs with images.

I’m grateful your first fluid Skidoo persuaded us to make our site “Fluid”. We have since upgraded to your latest version, and I’ve recently viewed it on various tiny mobile devices for the first time; it looks great thanks to you.

The first thing you have to do reading a site on an iPhone type device is increase the font size.
That’s when you see the benefit of letting go of tables, fixed widths, and font sizes, as you encouraged us to do.

I look forward to a Skidoo refinement based on Fluid Grid thinking too.

Colin

]]> Comment on Inkscape by Colin http://weblog.bridgew.edu/ruthsarian/2009/02/23/inkscape/comment-page-1/#comment-1913 Colin Sun, 15 Mar 2009 00:47:15 +0000 http://weblog.bridgew.edu/ruthsarian/?p=238#comment-1913 Eric, I wonder if this article about Fluid Grids will inspire the next Skidoo update... http://www.alistapart.com/comments/fluidgrids/ eg. max-width: 61.75em; /* 988px / 16px = 61.75em */ It sounds as though they have greatly reduced the number of IE hacks required, but still have bugs with images. I'm grateful your first fluid Skidoo persuaded us to make our site "Fluid". We have since upgraded to your latest version, and I've recently viewed it on various tiny mobile devices for the first time; it looks great thanks to you. The first thing you have to do reading a site on an iPhone type device is increase the font size. That's when you see the benefit of letting go of tables, fixed widths, and font sizes, as you encouraged us to do. I look forward to a Skidoo refinement based on Fluid Grid thinking too. Colin Eric, I wonder if this article about Fluid Grids will inspire the next Skidoo update…
http://www.alistapart.com/comments/fluidgrids/
eg. max-width: 61.75em; /* 988px / 16px = 61.75em */

It sounds as though they have greatly reduced the number of IE hacks required, but still have bugs with images.

I’m grateful your first fluid Skidoo persuaded us to make our site “Fluid”. We have since upgraded to your latest version, and I’ve recently viewed it on various tiny mobile devices for the first time; it looks great thanks to you.

The first thing you have to do reading a site on an iPhone type device is increase the font size.
That’s when you see the benefit of letting go of tables, fixed widths, and font sizes, as you encouraged us to do.

I look forward to a Skidoo refinement based on Fluid Grid thinking too.

Colin

]]> Comment on ColdFusion: CFQUERY and Evaluate() by Fred http://weblog.bridgew.edu/ruthsarian/2006/10/03/coldfusion-cfquery-and-evaluate/comment-page-1/#comment-1871 Fred Fri, 13 Mar 2009 21:00:53 +0000 http://weblog.bridgew.edu/ruthsarian/2006/10/03/coldfusion-cfquery-and-evaluate/#comment-1871 The example to obtain admin privileges is not very good since how would you know the "isadmin" variable was the one to set!? Answer, you would not. Sure you could fire away hundreds of them but if the variable was called "admin3453454524lk343423423sdsdsdsksuryfndc" then would you find it then? The example to obtain admin privileges is not very good since how would you know the “isadmin” variable was the one to set!? Answer, you would not. Sure you could fire away hundreds of them but if the variable was called “admin3453454524lk343423423sdsdsdsksuryfndc” then would you find it then?

]]>