3 ms·

All I get is a spinning blue dot. Your site is unfriendly to people who take their security seriously. That's not a good sign.

by Amadou 13y ago

amirmc 13y ago
Thanks for the feedback. I don't understand your second comment though, how is it 'unfriendly to people who take their security seriously'? You can email me instead, if you prefer.
- pjc50 13y ago
  I'm guessing it doesn't work if you have javascript turned off, due to the unnecessary "splash screen". It does look like you're addressing the right problems with "Signpost" and "Irminsule". Am currently reading your slides.
- Amadou 13y ago
  Pjc50 is correct. Practically every browser exploit over the last decade has had javascript as an essential component. Forcing users to enable javascript to use a site is a bad idea because it makes them more vulnerable. Javascript should be a last resort to provide necessary functionality that is impossible to do in any other way. If you want to use javascript for frills, that's fine as long as the frills don't become obstacles if javascript is disabled. To put it into perspective, NoScript is the 4th most popular add-on to firefox. https://addons.mozilla.org/en-US/firefox/extensions/?sort=users https://addons.mozilla.org/en-US/firefox/extensions/?sort=us... Software like what you are developing needs to be designed with a strong security mindset from the beginning. It is a truism in the industry that security tacked on after the fact never works very well. I was extrapolating from the security naivete of your website design to the likely naivete of your software design.
  - amirmc 13y ago
    Thanks, this is a helpful explanation. The site came from a template and I didn't think too long about the issue you mention (but I agree it's important [1]). Regarding your final para, please be assured that the folks working on the software are 'best-in-class' and do have a strong security mindset as well as a deep background in internet systems. The software is the output of research work being done in the University of Cambridge and I made the site to try and showcase the work and provide more context around it. The front-end of the site may be lacking but that shouldn't reflect on the software we're making (though I do understand why people extrapolate). [1] https://github.com/nymote/nymote.github.io/issues/10 https://github.com/nymote/nymote.github.io/issues/10
nodata 13y ago
WFM

All I get is a spinning blue dot. Your site is unfriendly to people who take their security seriously. That's not a good sign.

by Amadou 13y ago

All I get is a spinning blue dot. Your site is unfriendly to people who take their security seriously. That's not a good sign.

amirmc 13y ago

Thanks for the feedback. I don't understand your second comment though, how is it 'unfriendly to people who take their security seriously'? You can email me instead, if you prefer.

pjc50 13y ago
I'm guessing it doesn't work if you have javascript turned off, due to the unnecessary "splash screen". It does look like you're addressing the right problems with "Signpost" and "Irminsule". Am currently reading your slides.
Amadou 13y ago
Pjc50 is correct. Practically every browser exploit over the last decade has had javascript as an essential component. Forcing users to enable javascript to use a site is a bad idea because it makes them more vulnerable. Javascript should be a last resort to provide necessary functionality that is impossible to do in any other way. If you want to use javascript for frills, that's fine as long as the frills don't become obstacles if javascript is disabled. To put it into perspective, NoScript is the 4th most popular add-on to firefox. https://addons.mozilla.org/en-US/firefox/extensions/?sort=users https://addons.mozilla.org/en-US/firefox/extensions/?sort=us... Software like what you are developing needs to be designed with a strong security mindset from the beginning. It is a truism in the industry that security tacked on after the fact never works very well. I was extrapolating from the security naivete of your website design to the likely naivete of your software design.
- amirmc 13y ago
  Thanks, this is a helpful explanation. The site came from a template and I didn't think too long about the issue you mention (but I agree it's important [1]). Regarding your final para, please be assured that the folks working on the software are 'best-in-class' and do have a strong security mindset as well as a deep background in internet systems. The software is the output of research work being done in the University of Cambridge and I made the site to try and showcase the work and provide more context around it. The front-end of the site may be lacking but that shouldn't reflect on the software we're making (though I do understand why people extrapolate). [1] https://github.com/nymote/nymote.github.io/issues/10 https://github.com/nymote/nymote.github.io/issues/10

nodata 13y ago

WFM