Weekend Update 5/30/21

[peteski]

What bugs me is that all these security measures are so one-size-fits-all. There is zero reason for me to use (or pay for) a secure server since no one is sending me any information (sensitive or otherwise). But the simple fact that it's http and not https causes all sorts of red flags to go up with certain browsers.

-Mark

Exactly!  But the developers think  they know better and are protecting us where no protection is needed.  If at least they would display some message (like "unsecure contents") instead of just silently blocking the contents would have been helpful. But no! Not even that.

[BOK]

Mark, which DM&E yard is yours to represent, Waseca?

Thanks,

Barry

[spookshow]

Yes, Waseca (circa 2010, since that's when I took most of my pictures).

-Mark

[Philip H]

I started making the polyolefins plant with a couple of Tomix kits. I also used an online generator Ed turned me on to (http://prr.railfan.net/makesign.html)to wrangle up some signs:

[mmagliaro]

At house for weekend. Wife said quit watching videos and just build it. So on weekends here, we are on. Just build the MF layout.

"Quit watching videos and just build it"

Words to live by.  Life's too short!

[nkalanaga]

mecgp7:  Thank you!  No wonder I never saw the prototype.  I doubt that they came anywhere near Washington state.

[ednadolski]

Exactly!  But the developers think  they know better and are protecting us where no protection is needed.  If at least they would display some message (like "unsecure contents") instead of just silently blocking the contents would have been helpful. But no! Not even that.

Most of them I am sure do know quite a bit better.  At the least, I hope they do since it is their job, after all, and hackers being insidious, pervasive, sophisticated, resourceful, and persistent makes it an enormous undertaking even just to keep abreast of the current issues.   Relying on end users to always 'do the right thing' in the event of warning messages is risibly dangerous as an approach to achieving any acceptable level of security (particularly with users who presume no protection is needed -- these are the first ones to ignore or disable warnings, bypass or disable updates, etc.).

Ed

[peteski]

Most of them I am sure do know quite a bit better.  At the least, I hope they do since it is their job, after all, and hackers being insidious, pervasive, sophisticated, resourceful, and persistent makes it an enormous undertaking even just to keep abreast of the current issues.   Relying on end users to always 'do the right thing' in the event of warning messages is risibly dangerous as an approach to achieving any acceptable level of security (particularly with users who presume no protection is needed -- these are the first ones to ignore or disable warnings, bypass or disable updates, etc.).

Ed

I'm sorry Ed. Not sure what came over me to think that developers wouldn't know better about what's the best for general general public.

So you really think it is better to just leave blank areas where the unsecure images are supposed to be,  instead of providing some useful message like for example "unsecured contents" in their place?  Really? Keep the users guessing? At least if a message was displayed, all  the dumb users would not have to wonder what is wrong.    Dammit, I'm not talking about allowing some easy-one-click to enable the unsecure contents - just provide *SOME* information about why the contents is missing .  As-is, the disenchanted users still find a way to disable that important security feature anyway. It would have been a lot less puzzling if some sort of message was displayed in the first place.  I might be repeating myself now.   

[wcfn100]

So you really think it is better to just leave blank areas where the unsecure images are supposed to be,  instead of providing some useful message like for example "unsecured contents" in their place? 

Unless there's an image link between the image tags it's still going to show as nothing.

So to do what you're saying, someone would first have to know this is a Simple Machines Forum, then remove the image tags around the insecure link so they can then insert some sort of warning message.




Jason

[peteski]

Unless there's an image link between the image tags it's still going to show as nothing.

So to do what you're saying, someone would first have to know this is a Simple Machines Forum, then remove the image tags around the insecure link so they can then insert some sort of warning message.




Jason

We are talkiing about the browser, not the IMG code on the Railwire. When the browser is rendering the Railwire page with that unsecure image, it recognizes that the specific image which is part of the page being rendering  is coming from unsecure source, and blocks it from begin rendered, resulting in a blank space being displayed.  Instead of just blocking the image, why can't the browser replace it with some sort of informational thing?  It could be "unsecure contents" text, or even some small icon (similar to the red-X in a box browser displayed when image source is missing)?  The browser knows the unsecured contents is an image (since the http URL has a .jpg or similar extension), why not replace it with something useful?  Or make it even simpler: have the browser insert the "unsecure contents" text or small icon everywhere the blocked URLs woudl be on the page being rendered.

[Ed Kapuscinski]

We are talkiing about the browser, not the IMG code on the Railwire. When the browser is rendering the Railwire page with that unsecure image, it recognizes that the specific image which is part of the page being rendering  is coming from unsecure source, and blocks it from begin rendered, resulting in a blank space being displayed.  Instead of just blocking the image, why can't the browser replace it with some sort of informational thing?  It could be "unsecure contents" text, or even some small icon (similar to the red-X in a box browser displayed when image source is missing)?  The browser knows the unsecured contents is an image (since the http URL has a .jpg or similar extension), why not replace it with something useful?  Or make it even simpler: have the browser insert the "unsecure contents" text or small icon everywhere the blocked URLs woudl be on the page being rendered.

The issue is that what forums like this do is a bit of an edge case: websites typically host their own images (and can therefore control if they're http/https). In fact, images being hijacked to come from a different domain is a potential attack vector that this behavior is intended to prevent.

Here's the scenario: someone clicks a phishing link in their email. That phishing link leads them to a site that gets them to install something that secretly swaps out an innocuous image on common eCommerce checkout pages with one that comes from a nefarious domain. It'll be so small you'll never notice it's happening while you're entering your billing info. But that nefarious image captures your keyboard entries and records them. From there it's easy to automatically pick out credit card info and anything else they want. At that point, the attackers will take that data, bundle it up with the thousands of other victims info, and resell it in blocks to other criminals who then exploit it.

The browser functionality you guys are complaining about prevents this from happening because it won't load that image from a different server. It shuts the whole thing down at the source.

This is a very basic example, and there are a bunch of things in place to prevent it from happening but threats like this (and its far more sophisticated kin) are the reason why measures like these need to be implemented.

For a super deep dive, this seems like a good explanation of the image as attack vector idea: https://security.stackexchange.com/questions/237715/if-malware-can-be-attached-to-an-image-file-then-why-arent-images-a-common-att

[R L Smith]

Finally completed installing the last 10 feet or so of the double track main on the Southern Tier Division. Still have several dozen feeder drops to connect to the bus, and a few industrial sidings, but mainline trains should be rolling very soon...



Ron

[brokemoto]

That RPO is a new addition.  I picked it up built on eBay but I painted and decaled it.

Nice work....................  I am guessing that it is a hand railing on the roof of that RPO, not a parabolic antenna, although there have been stranger things.  I can not state that I ever have seen a photograph of an RPO with a hand railing on the roof, but if brakemen were still setting the brake wheels for the downgrades and loosening them for level and upgrade in the era that you model, you might need one.  The hand railing does make it unique, thus avoiding that shibboleth of model railroading known as [cue up thunder and echo chamber for basso profondo voice] sommmmmmmmebo-o-o-o-o-d-d-d-d-y elllllllllllllllse's layyyyyyyyyyoutttttttttttt.  It is a nice touch that sets apart a layout from the others.

[brokemoto]

RBB&B canvas truck #254. Deconstructed an Athearn Mack B dump truck for the cab, undercarriage and bogie. Cab steps and rear modified to better represent the prototype. 3D printed body parts.

Nice work............................thank you for the clarification on the body.  When I first saw it, I had thought that you had bashed it from a rib sided ninety ton hopper or a rib sided gondola.

[brokemoto]

I had gotten the old Trix B unit from Jeff Peck a week or so ago.
I've had the Kato A floating around for a while, in Santa Fe cigar band.  I masked the yellow stripe at the sill, and shot some Krylon dark blue from a small rattle can.

Nice work;  that Krylon Blue from the can does make a good B and O Blue for that era.  How does the Trix run with the Kato?  ..........or do you run the two together?   ..................or is the TRIX unit a dummy?