6 ms·

Kickstarted a Python course (now 2, soon to be 3 courses) - RealPython.com

by fheisler 13y ago

Nicholas_C 13y ago
My work VPN blocks this as porn. Ha!
- deleted 13y ago
  [deleted]
- fheisler 13y ago
  Oof, good to know... Any other false positives you've had so I can maybe figure out why? Edit: Never mind, I think your censorware might just have a more inventive sexual imagination than I do when it comes to domain names...
  - veidr 13y ago
    Not sure it would be related, but python.com used to be a startling high-res extremely NSFW spread that you really didn't want to accidentally visit in a public setting when you really wanted python.org... (They are now 'no longer accepting new affiliates' though, and the pictures are gone.)
  - Nicholas_C 13y ago
    None that I'm aware of.
  - Nicholas_C 13y ago
    This was also blocked at work: >http://blogs.sfweekly.com/foodie/2013/12/amazonfresh_has_launched_in_ba.php http://blogs.sfweekly.com/foodie/2013/12/amazonfresh_has_lau... But the main site (http://www.sfweekly.com/ http://www.sfweekly.com/) and the blog site (http://blogs.sfweekly.com/ http://blogs.sfweekly.com/) aren't blocked. I'm going to guess my work filter is just screwy.
- mh- 13y ago
  do you work at a ruby shop?
  - Nicholas_C 13y ago
    Har har. I work in finance.
jsnk 13y ago
Isn't the website payment system vulnerable to MITM without without using https?
- sync 13y ago
  Technically, no. The payment happens within an iframe secured with https: https://www.simplegoods.co/embed/PKGTEISN https://www.simplegoods.co/embed/PKGTEISN
  - DaCapoo 13y ago
    The issue with it however is that the initial page is delivered over an insecure connection, which allows any part of it to be modified in the usual MITM style. Nothing prevents an attacker from changing the link that is served to the client with something else that looks like that payment system and functions the same, but logs the payment information. There's a reason Firefox now disallows mixed HTTP/HTTPS content by default[0] [0] - https://blog.mozilla.org/tanvi/2013/04/10/mixed-content-blocking-enabled-in-firefox-23/ https://blog.mozilla.org/tanvi/2013/04/10/mixed-content-bloc...
  - throwaway125 13y ago
    In other words: yes, it's vulnerable to SSL stripping.
  - jafaku 13y ago
    If the main page is insecure, then everything is insecure.
- deleted 13y ago
  [deleted]
- fheisler 13y ago
  Simple Goods (our provider) does use https via an iframe, so it's secure although not best practice - that said, we'll be moving to Stripe soon!
cstrat 13y ago
Oh awesome, I backed both of your courses. Wish I could say that I have had enough time to go through them both...

Kickstarted a Python course (now 2, soon to be 3 courses) - RealPython.com

Nicholas_C 13y ago

My work VPN blocks this as porn. Ha!

deleted 13y ago
[deleted]
fheisler 13y ago
Oof, good to know... Any other false positives you've had so I can maybe figure out why? Edit: Never mind, I think your censorware might just have a more inventive sexual imagination than I do when it comes to domain names...
- veidr 13y ago
  Not sure it would be related, but python.com used to be a startling high-res extremely NSFW spread that you really didn't want to accidentally visit in a public setting when you really wanted python.org... (They are now 'no longer accepting new affiliates' though, and the pictures are gone.)
- Nicholas_C 13y ago
  None that I'm aware of.
- Nicholas_C 13y ago
  This was also blocked at work: >http://blogs.sfweekly.com/foodie/2013/12/amazonfresh_has_launched_in_ba.php http://blogs.sfweekly.com/foodie/2013/12/amazonfresh_has_lau... But the main site (http://www.sfweekly.com/ http://www.sfweekly.com/) and the blog site (http://blogs.sfweekly.com/ http://blogs.sfweekly.com/) aren't blocked. I'm going to guess my work filter is just screwy.
mh- 13y ago
do you work at a ruby shop?
- Nicholas_C 13y ago
  Har har. I work in finance.

jsnk 13y ago

Isn't the website payment system vulnerable to MITM without without using https?

sync 13y ago
Technically, no. The payment happens within an iframe secured with https: https://www.simplegoods.co/embed/PKGTEISN https://www.simplegoods.co/embed/PKGTEISN
- DaCapoo 13y ago
  The issue with it however is that the initial page is delivered over an insecure connection, which allows any part of it to be modified in the usual MITM style. Nothing prevents an attacker from changing the link that is served to the client with something else that looks like that payment system and functions the same, but logs the payment information. There's a reason Firefox now disallows mixed HTTP/HTTPS content by default[0] [0] - https://blog.mozilla.org/tanvi/2013/04/10/mixed-content-blocking-enabled-in-firefox-23/ https://blog.mozilla.org/tanvi/2013/04/10/mixed-content-bloc...
- throwaway125 13y ago
  In other words: yes, it's vulnerable to SSL stripping.
- jafaku 13y ago
  If the main page is insecure, then everything is insecure.
deleted 13y ago
[deleted]
fheisler 13y ago
Simple Goods (our provider) does use https via an iframe, so it's secure although not best practice - that said, we'll be moving to Stripe soon!

cstrat 13y ago

Oh awesome, I backed both of your courses. Wish I could say that I have had enough time to go through them both...