Weekend Update 5/30/21

[spookshow]

The issue is that what forums like this do is a bit of an edge case: websites typically host their own images (and can therefore control if they're http/https). In fact, images being hijacked to come from a different domain is a potential attack vector that this behavior is intended to prevent.

I'm no web security expert (or even amateur), but I don't see how https is going to prevent "evil" pictures from causing trouble on TRW. As I understand it, all https does is make sure that the data that transfers between a website and a browser is encrypted (so that it can't be monitored and/or manipulated by evil third parties). But, what's to stop me from switching my website to https, loading all my images up with all sorts of hidden evilness, and then posting links to said pictures here? Just curious.

-Mark

[wcfn100]

But, what's to stop me from switching my website to https, loading all my images up with all sorts of hidden evilness, and then posting links to said pictures here? Just curious.

Nothing, but then at least we would know it was you doing it.


Jason

[spookshow]

Nothing, but then at least we would know it was you doing it.

Well, sure. But by then I've buggered off to Costa Rica with all your train money 

-Mark

[u18b]

I know this drifted a bit... but alas... I'm also one who cannot see your photos Mark.
No icon, no error message.

Just nothing but the text you wrote.

[ednadolski]

At least if a message was displayed, all  the dumb users would not have to wonder what is wrong. 

Actually I'd bet that most 'dumb' users wouldn't understand the message or know what to do about it.  A missing image is a fair enough clue that "something broke".

When it comes to adding warning messages and other such notifications, it's really important to think through who the consumers of the message are and what, if anything, you expect them to do about it.   Excess verbosity from a program is itself often a service call generator.

Ed

[C855B]

I know this drifted a bit... but alas... I'm also one who cannot see your photos Mark.
No icon, no error message.

Just nothing but the text you wrote.

Bottom line? Don't use Chrome. Or, recently, Safari, it's being locked-down this way as well.

https://www.therailwire.net/forum/index.php?topic=50723.msg684824#msg684824

[Chris333]

I got Chrome. I saw the pics. 

[chuck geiger]

Finally a minute to catch up after long weekend. So we are retiring over the next few years in Yuma, AZ at the new house. We call it HERMOSA HACIENDA. There is a one bedroom, one bath casita or small house off the patio which will be my home office/studio and the new layout. I started on it this past weekend. http://conrail1285.com/wp-content/uploads/2021/04/2021-04-11-13.05-ductwork.jpg I got the idea for this design from Ed. Using shelf brackets, splice plates for the particle board and foam over the board. It runs 11' down one wall with a 3' return on one end and 4' on the other. I have never done a point to point so this will interesting. I am looking at several track plans based on:

AT&SF GRAND CANYON DIVISION
AT&SF ESCONDIDO BRANCH
AT&SF SAN JACINTO BRANCH

I am worried about warpage or uneven, level surfaces, even though it shows level not using support for the boards on the brackets. Do I need to use stringers?

[bbunge]

...all https does is make sure that the data that transfers between a website and a browser is encrypted (so that it can't be monitored and/or manipulated by evil third parties)...
-Mark

Actually it's a bit more.  When a browser connects to a website using TLS/https, it is exchanging digitally signed certificates that ensures the remote server is who they say they are.  This could prevent things like a spoofed/poisoned DNS from pointing to a different website with unauthorized or bad stuff on it.  Not so important with images on RW, but really important with, for example, an online banking website or a local government website that is displaying weather warnings off the NWS website that might save lives.

This is an often overlooked benefit of TLS/https. 

Bob

[spookshow]

I got Chrome. I saw the pics. 

Me too.

-Mark

[John]

[peteski]

Whatever.  I don't give a crap anymore (ESPECIALLY SINCE SOMEONE AGAIN HAS DOWN-VOTED ALL MY RELATED POSTS).  What was so bad in them that they deserved that?  Me stating that it would be helpful to have some sort of indication provided why the images are not being displayed.  Give me a break.    Whoever is doing that - you ****!

[jereising]

Just as a FYI re the missing photo issue - I use a browser called Brave - a clone of Chrome but with a very robust ad suppression.  The command line that is provided for Chrome works with Brave as well, although now when I invoke the browser I get a message that I'm now insecure and may have problems.  I can live with that.  And I can see the photos.

[CRL]

@chuck geiger - I’ve been meaning to ask, why’d you decide to move from Page to Yuma for your retirement. It’s been a lifetime since I’ve been to Page & Yuma, which was when I was about 8 years old. I was born in Phoenix and we moved to Texas in 1961 and I’ve only been back once. We visited Page to see the Glen Canyon Dam being built, and that made an impression, but Page was mainly a construction town at the time. As far as Yuma is concerned, I remember sand dunes, an Air Base of some kind, lots of farming close to the river and that’s about all that impacted my little kid brain.

[dem34]

Network security is a useless obstacle to ease of use, until you experience a total breach. Wherein many discover that a couple seconds to log in a password or tap a thumb scanner far outweighs having your accounts wiped out in an evening.