|Join Nairaland / Login / Trending / Recent / New|
Stats: 1213971 members, 1574632 topics. Date: Friday, 01 August 2014 at 04:58 PM
|Foreign Affairs / Re: Israel’s Mobile Missile Defence System: What Is The Iron Dome? by TheArbiter: 7:39am On Jul 18|
An Explanation of the Evidence of Weaknesses in the Iron Dome Defense System
Editor’s Note: Readerly response to a recent news story, “Israeli Rocket Defense System Failing at a Crucial Task, Expert Analysts Say,” where Ted Postol was quoted to say that Iron Dome was not effectively detonating warheads, was so negative, and angered so many people, particularly Israelis, that we asked Professor Postol to explain how he came to his conclusions and to show his data. He gracefully agreed. The following article represents his opinion, and is not necessarily the opinion of MIT Technology Review—and does not represent any collective assessment by MIT or one of its departments, labs, or centers. (That’s because we are editorially independent of the Institute.)
In the early weeks of July 2014 the conflict between Israel and Palestinians in Gaza has again flared up. This has resulted in a new round of large-scale rocket attacks launched by Hamas, operating from Gaza, against Israeli population centers. The last time such large-scale rocket attacks occurred between Hamas and Israel was in November 2012. During the November 2012 conflict a large number of photographs of Iron Dome interceptor contrails were observed in the sky. These contrails revealed that the Iron Dome interceptor rate was very low—perhaps as low as 5 percent or below.
This paper explains why the geometry of the contrails photographed in the sky indicates whether or not an Iron Dome intercept attempt had any chance of intercepting an artillery rocket target.
I will show sample pieces of data indicating that Iron Dome performance was very low in November 2012, and I will show similar data for July 2014, which indicates that Iron Dome performance almost a year and a half later has probably not improved.
At this time, collection of the data for July 2014 is still in progress. However, all the data I have so far collected indicates that the performance of Iron Dome has not improved.
One of the most demanding problems in intercepting an artillery rocket is that the interceptor must destroy the warhead on the rocket. If the interceptor hits the back end of the rocket, all that will happen is damage to the expended rocket motor tube, which is basically an empty pipe. Damaging the back end of the artillery rocket essentially has no effect on the outcome of the engagement. The pieces of the rocket will essentially fall in the same defendant area, and the warhead will almost certainly go on to the ground and explode. These facts mean that the only meaningful definition of a successful intercept is the destruction of the artillery rocket warhead. As will be shown in the discussion to follow, destroying the artillery rocket warhead is considerably more demanding than doing damage to other parts of the artillery rocket—or successfully damaging an aircraft, causing the failure of its mission.
Protecting a population spread over defended areas from the hazards of such missile attacks must involve protection against falling debris, which can cause serious injuries to individuals who are not in protective shelters.
As I will discuss later in this article, Israel does in fact have an extremely effective missile defense. That defense is the early warning system that tells people on the ground a rocket is traveling in their direction, and the shelters that are arranged so that individuals can easily get to protection within tens of seconds of warning. In an article referenced later in this paper, it is shown that during the bombing of London by V-1 and V-2 rockets, seconds of early warning vastly reduced casualties and deaths from individual attacks.
In the particular case of rocket attacks against Israel, the overwhelming number of artillery rocket warheads are in the 10- to 20-pound range, which makes the effectiveness of shelters even greater.
These two factors, the small size of the warheads, and the warning and sheltering system completely explain why there have been no casualties from the rocket attacks.
Assessing Whether or Not an Iron Dome Intercept Attempt Is Successful from Photographs of Iron Dome Contrails
I will first show why the Iron Dome interceptor must approach the target artillery rocket from a frontal direction. I will then show that the Iron Dome interceptor has, for all practical purposes, no chance of destroying the warhead on incoming artillery rockets if the interceptor engages the rocket from the side or from the back.
I will then present photographic evidence of contrails in the sky, indicating that Iron Dome interceptors were mostly chasing or engaging artillery rockets in side-on geometries.
I do not know why the Iron Domes were not engaging most artillery rockets using the proper front-on geometry. However, it is clear that the Iron Dome radar tracking and guidance system is not working, as it is initially sending Iron Dome interceptors to intercept points that then result in the interceptor not being able to achieve the right geometry for a successful engagement against the artillery rockets.
I will show photographs of contrails from November 2012 and from July 2014 indicating that the Iron Domes are still behaving erratically—resulting in continued very low intercept rates.
Assessing the Meaning of Iron Dome Contrails
To understand why the Iron Dome interceptor must approach the artillery rocket from a frontal direction, it is necessary to have a rudimentary understanding of the Iron Dome interceptor.
Figure 1 below shows a conceptual picture of a front-on engagement by an Iron Dome interceptor against a Grad artillery rocket. The blue dashed line emanating from the forward section of the Iron Dome interceptor depicts the line of sight of what is called a “laser fuse.” The purpose of the laser fuse is to create a beam of light that will reflect off the front end of the artillery rocket so that the interceptor can determine that the target artillery rocket is in the process of passing the interceptor. As can be seen from the diagram, the warhead in the Iron Dome interceptor is placed well behind the fuse assembly, a distance of roughly three feet from the laser-fuse aperture. This gives the fuse enough time to determine where the front of the target rocket is, estimate how long it will take for the front of the artillery rocket to pass parallel to the artillery rocket’s warhead, and detonate the Iron Dome warhead.
The timing delay is quite critical to many variables. It must account not only for the location of the target rocket’s warhead but also for the speed of the fragments from the Iron Dome warhead, the miss distance, the off-parallel orientation of the Iron Dome interceptor relative to the artillery rocket, and the high passing speed of the Iron Dome interceptor and the artillery rocket.
Figure 2 shows how the fragments move, under the assumption that the crossing speed of the Iron Dome interceptor and artillery rocket is about 1,200 meters per second and the fragments from the Iron Dome warhead are projected at about 2,100 meters per second perpendicular to the axis of the Iron Dome interceptor. Because the Iron Dome interceptor is moving at 1,200 meters per second relative to the artillery rocket, the additional crossing speed needs to be added to the 2,100-meter-per-second lateral velocity of the fragments. The net direction of the cloud of fragments, as would be seen if an observer were sitting on the artillery rocket, is shown by the pale blue arrow that passes through both the Iron Dome warhead and the artillery rocket’s warhead.
Figure 3 shows the outcome if everything works as intended. However, there is a range of possible outcomes where success is very likely, and beyond that range, the possibility of success diminishes drastically.
As can be seen from the arrow marked “1,500 meters per second” in figures 2 and 3, the higher crossing speed can result in a significant change in the net direction of the cloud of fragments. Thus, the fuse must determine the best time to detonate the warhead based on the crossing speed, the distance of the artillery rocket target as it passes by the Iron Dome interceptor, and the various fusing delays associated with detonating the Iron Dome interceptor’s warhead.
Because of the uncertainties in the exact crossing speed and crossing geometry, even a perfect fuse may fail to put lethal fragments onto the artillery rocket’s warhead.
In addition, unless the distance between the Iron Dome warhead and the warhead of the artillery rocket is small (roughly a meter or so), there will be a greatly diminished chance that a fragment from the Iron Dome warhead will hit, penetrate, and cause the detonation of the artillery rocket warhead.
Thus, a front-on engagement does not guarantee that the Iron Dome interceptor will destroy the warhead on the artillery rocket.
Figure 4 and figure 4A show the consequences of a failure in the fuse timing in what was almost certainly an engagement between an Iron Dome interceptor and the artillery rocket shown on the ground in the photos. As can be seen by inspecting the photograph in figure 4, there is significant damage in the area where the rocket fell. This damage was almost certainly due to the detonation of the rocket’s small warhead. Figure 4A shows the magnified front end of the rocket, where holes can be seen in the expended and empty rocket motor casing that was immediately behind the warhead. This photograph therefore shows an example of what might have been a successful Iron Dome intercept attempt.
In this case, it is nearly certain that the artillery rocket was engaged by an Iron Dome interceptor that was properly approaching the artillery rocket front-on. Unfortunately, the timing commands from the fuse resulted in fragments from the exploding Iron Dome warhead hitting the artillery rocket after the warhead had passed. The relatively low density of holes in the artillery rocket’s afterbody suggests that the encounter also had a relatively high miss distance—possibly several meters.
This photograph illustrates how even when the Iron Dome interceptor is in a proper front-on trajectory, it can still fail to destroy the warhead of a target artillery rocket.
Figures 5, 6, 7, and 8 show detailed vector diagrams that indicate how the Iron Dome interceptor would perform if it engaged an artillery rocket from a variety of directions. In these diagrams the speeds are shown in feet per second, rather than the meters per second used in figures 1, 2, and 3.
Figure 5 shows a nearly front-on engagement direction (again, note that all the vector speeds are now in feet per second). A careful review of the geometry of the engagement will reveal that even a moderately skewed off-frontal direction of approach will drastically reduce the chances that fragments from the Iron Dome warhead could be sprayed onto the warhead of the artillery rocket. This therefore shows that the front-on geometry is very sensitive to small off-frontal errors that could be the result of faults by the master control system in the guidance and control of the Iron Dome interceptor.
This particular diagram (figure 5) demonstrates how important it is for the the master guidance and control system to place the interceptor in the right location before it begins the actual homing process against a target artillery rocket
Figures 6, 7, and 8 show detailed vector diagrams for interceptor engagements that approach the target artillery rocket from the side or from the back. A careful inspection of the geometry of the fuse-sensing beam and the spray pattern of the fragments from the Iron Dome warhead show that there are two very serious problems with these kinds of engagements.
First of all, if the fuse detects the artillery rocket, it has no way of determining where the warhead is on the artillery rocket. Second, it is nearly certain that even if the fuse detonates by chance at a time when the warhead might be in the spray pattern of the Iron Dome warhead, the distance between the Iron Dome warhead and the artillery rocket warhead will in almost all circumstances be very large, resulting in a very low density of fragments at the location of the artillery rocket warhead. Given the small number of fragments that can be dispersed by the Iron Dome warhead, this translates into a very high chance that no fragment will hit the warhead. Making matters even more difficult, the projected area of the warhead is very small, since it will be encountered from the front or back rather than from the side. Moreover, fragments are very likely to hit metal surfaces that are at very low grazing angles relative to the direction of the fragment motion. This will result in fragments’ tending to bounce off the shell or transmit almost no energy to a target. Hence, figures 6, 7, and 8 show that for all practical purposes, the probability that the Iron Dome interceptor can destroy the warhead of the engaged artillery rocket is essentially zero.
What does the data show about Iron Dome’s performance in November 2012 and July 2014?
Figures 9, 10, and 11 show contrails in the sky that indicate that Iron Dome interceptors were attempting to engage target artillery rockets either by chasing them from behind or by attacking them from the side.
The geometries of the engagement are easily established because the artillery rockets are falling at high elevation angles relative to the ground—perhaps 60 to 70 degrees relative to vertical. This reëntry angle is due to aerodynamic drag, which slows up the artillery rocket and eventually causes it to fall at a relatively steep angle.
Figures 12 and 13 show photographs that are supposed to have been taken in July 2014. I have found photographs from November 2012 that have been mislabeled as being from July 2012, so I am in the process of verifying that photographs collected were actually taken in the stated time frames. These two photographs have checked out as being from July 2014.
Figure 14 shows a very rough estimate based on my observations in November 2012, when I saw perhaps no more than 10 to 20 percent of Iron Dome contrails that indicated an engagement geometry that was front-on.
As shown in the performance “guesstimate,” if we assume that the engagement geometry and 20 percent of the engagements were front-on, then at that time I estimated the probability of destroying a SCUD warhead might be between 0.3 and 0.6. Thus, if all other engagements effectively resulted in a zero probability of intercept, then the intercept rate would be roughly
0.2 × (0.3 or 0.6) = 0.06 to 0.12
That is an intercept rate, defined as destruction of the artillery-rocket warhead, of between 6 and 12 percent.
My best estimate is that fewer than 20 percent of the engagements I was able to get data on were actually front-on, and I have no information about the actual miss distances or whether the engagement-attempt geometries were close to antiparallel. Thus the statement that the intercept performance of Iron Dome appears to be probably 5 percent or less.
A sample of such a calculation is shown in figure 14.
Why Are Israeli Casualties from Rocket Attacks so Low?
An article published in the journal Nature in 1993 addressed the debate over the performance of the Patriot missile defense in the Gulf War of 1991. At that time, the same questions were being raised—why was damage so low, and why were there so few casualties? (All reports now indicate that there was only one casualty from the direct effects of the SCUD attacks. This casualty was caused by a Patriot missile that dove to the ground in an attempt to intercept a SCUD missile.)
In the case of the SCUD attacks, there were many fewer rockets launched at Israel (perhaps around 40), but the warheads on the missiles were much larger—about 500 pounds. Nevertheless, many SCUD warheads fell in open areas, doing relatively little damage. In cases where warheads fell near buildings, the civil-defense measures essentially protected the population from the consequences of the SCUD impact.
Figures 15, 16, and 17 show damage in Israel from artillery rocket attacks during November 2012 and July 2014. As can be seen by inspecting the photographs, even when the rockets happen to hit buildings, the damage tends to be quite localized. This does not mean that individuals in the area of the rocket attack would not be injured or killed if they were close enough to the impact site, but it is very clear that the warheads are not of sufficient size to cause casualties or deaths to those who are properly sheltered.
In contrast, figures 17 and 18 show the results of bomb attacks in Gaza in July 2014. The exact yields of the bombs are uncertain, but it appears they are probably in the 1,000- to 2,000-pound category. In these cases, attempts at sheltering the population might well fail, as few shelters can sustain the level of damage that could be inflicted by such large bombs.
So again, this illustrates that the small size of the artillery rocket warheads and the ability to quickly warn populations of these arriving small warheads is an extremely capable defense that works far more effectively than Iron Dome.
Theodore Postol is Professor of Science, Technology and National Security Policy in the Program in Science, Technology, and Society at MIT.
|Science/Technology / A Scientific Breakthrough Of 2013: The Real Reason Why We Need Sleep by TheArbiter: 2:18pm On Jan 03|
Scientists discover the first real reason we need sleep:
The image above, from Xie et. al in Science, shows how when mice sleep, ﬂuid-filled channels (pale blue) between neurons expand and flush out waste.
We know we need to sleep. We know our brains and bodies work better after sleep. But what we didn’t know, until now, was why.
Scientists have just reported the first major mechanical reason our brains need to sleep — certain cleaning mechanisms in the brain work better when we shut the brain down.
Just like how dump trucks take to the city streets during the pre-dawn hours because there’s less traffic, our brain’s cleaners also work best when there’s less going on.
“This study shows that the brain has different functional states when asleep and when awake,” study researcher Maiken Nedergaard, of the University of Rochester said.
“In fact, the restorative nature of sleep appears to be the result of the active clearance of the by-products of neural activity that accumulate during wakefulness.”
We’ve known that our brains consolidate memories during sleep and perform other important functions.
There are also benefits to the body during sleep — resting allows our muscles, bones, and organs to repair themselves.
It also keeps our immune system healthy.
We know that sleep has all of these benefits, but until now we didn’t know any of the specific changes that bring about these sleep benefits.
Charles Czeisler, a sleep researcher at Harvard Medical School in Boston, told Science Magazine’s Emily Underwood that this is the “ﬁrst direct experimental evidence at the molecular level” for why we need to sleep.
The paper was published in the journal Science on Oct. 17.
All of our cells accumulate waste while they are working, and these waste products can be toxic. If they aren’t removed they can build up and kill our cells. Throughout the rest of the body the lymphatic system washes these waste products away, but the brain is cut off from these actions because of the blood-brain barrier.
When the brain is sleeping, channels between cells grow. This allows cerebrospinal fluid into the depths of the brain tissues to flush out toxic proteins that build up during the day, including the kind that are responsible for neurodegenerative diseases like Alzheimer's.
The image above, from Xie et. al in Science, shows how when mice sleep, ﬂuid-filled channels (pale blue) between neurons expand and flush out waste.
|Celebrities / Miley Cyrus Twerking Has Its Origins In Africa by TheArbiter: 12:37pm On Jan 03|
These images of Miley Cyrus above do not depict the act of twerking.
Unfortunately, though, she is up for TIME's "Person of the Year" award, supposedly for her "twerk-filled performance at the 2013 MTV Video Music Awards," which "set off a chain of memorable entertainment moments."
But here's the thing: She's never actually twerked at all. And even if she had, there is a slim chance she understands the African roots of the dance that she's come to so shamelessly own.
Twerking is a complex and challenging dance move that originated in West Africa in the 1990s. It does not involve simply bending over and shifting your booty from left to right. As Christiana Mbakwe wrote, "It takes tremendous skill and attention." Shannon Givens, 25, said that it's extremely difficult to master. "Cold fact. Miley Cyrus is not twerking. She is moving side to side."
Real twerking looks something like this:
It seems like a new trend, but it's been around for awhile. In the book Playing with Identities in Contemporary Music In Africa, author Simon Akindes writes that twerking has its roots in West Africa. In the Ivory Coast, it's known as mapouka, and and they've been dancing it since 1997 (at the latest), when it hit the dance and music scene. The government temporarily baned the dance from all media, deeming it too provactive. The ban was lifted in 1999 when a new government took power.
The New York Times wrote back in 2000, "Banned from Ivoirian television — chased away by officials in neighboring countries like Togo, Niger, Burkina Faso and Benin — mapouka spread nevertheless along the West African coast, from Dakar to Kinshasa, in the last couple of years. The dance — which focuses on, though is not limited to, the surprisingly difficult act of wiggling one's buttocks without moving one's hips — also became an endless source of discussions and newspaper ruminations on culture, sex, women and men, especially here in the Ivory Coast."
Givens, who lives in Harlem and is studying at Long Island University's school of public health, was born and raised in the Sumner, Mississippi. She said that twerking migrated from West Africa into Caribbean culture before making its way to the American South, where it mainly picked up in Atlanta and among the Louisiana Bounce music scene.
Mbakwe wrote, "I’ve seen variants of twerking my entire life. I remember watching the elderly women dance at the predominantly West African church I attended growing up. If the right 'praise' song was sung, they’d grab a white handkerchief and dance their way to the front of the church. They’d rotate their hips and bounce their bums until they were barely above the ground."
The dance is inextricably intertwined with music. In the book The Modernity Bluff: Crime, Consumption, and Citizenship in Cote D'Ivoire, author Sasha Newell claims that mapouka has its own musical genre.
In modern day American music, praisings of booty shaking are endless.
The band Queen declared that "fat-bottomed girls make the world go 'round." Rapper Mos Def dedicated his song "Ms. Fat Booty" to a woman whose posterior he praised for being "so fat that you could see it from the front." Eminem, in "Bottom Like That," described — quite viscerally — his physical reaction to a seeing nice round behind. And who could forget, "Girl, shake that laffy taffy?" Sir Mix-a-Lot does not even need to be quoted; we know what he likes, (and he cannot lie.)
Women, too, are proud of their voluptuous behinds and understand their power. Beyonce coined the term "bootylicious," warning men that they weren’t ready for all her "jelly," and Fergie claimed that her "hump, [her] lovely lady lump" could get a man "love drunk."
The cultural ties to music and dance are undeniable, but a deeper look at the move reveals that its popularity has scientific roots as well.
Biologist Alfred Kinsey argued that a man’s passion for a woman’s rear end comes from the fact that the female buttocks is the primary visual feature during sex for primates, our close ancestors, who do the deed "CanineApproach." Dr. Lionel Tiger, anthropology professor at Rutgers University, said, "The posterior view implies a level of intimacy." On the the pelvic rotation of the twerk, he said, "Primates like to see objects move." He believes that twerking is a way for the woman to signal to a man that she is primed for sex. "It’s very literal. We’re animals."
Another explanation is that voluptuous rear ends are a female-specific trait. They result from estrogen, which encourages the girl’s body, after puberty, to store fat in the hips and the butt, giving us girls all that "junk in the trunk" and "all that Bottom inside them jeans," to use Fergie’s poeticism. It’s a certain type of fat, though, containing adipose tissue, which stores energy for reproduction. Devendra Singh, a professor of psychology largely known for his work regarding the science of human attraction, wrote that — whereas a woman assesses a male’s desirability as a mate based on his control over resources — "physical attractiveness [for males] is largely a reflection of reliable cues to a woman’s reproductive success."
So a curvy behind signals to a male that the female is able to get pregnant, carry to term, and successfully lactate in order to feed the baby, hence, helping the male’s offspring survive. (What would Darwin say about twerking?)
This might explain why the New York Times wrote that in the Ivory Coast, "As young women sought to outperform one another, a large posterior became de rigueur." The dance "made plumpness fashionable even among Westernized young women who had toyed with slimness."
Twerking incorporates global cultures and histories, the freedom of intimate expression, and the evolutionary science of attraction. It transcends cultural boundaries and time periods.
It's too bad that it's been reduced to a Miley Cyrus joke. Especially when she wasn't even twerking to begin with.
|Computers / Re: How Do I Recover My Lost Folder On External Hard Drive: Help by TheArbiter: 8:06pm On Dec 29, 2013|
Try GetDataBack. It has both FAT and NTFS (file system) versions. It can recover files even from formatted drives with its 4 step process. Its disadvantage: it requires time to scan the drive on first use.The bigger the drive the longer it takes.
PM me if you cant get it and i'll see what i can do.
|Webmasters / Re: When And How To Deploy HTTPS For Web Pages by TheArbiter: 12:14pm On Dec 27, 2013|
@ Love Decay
Did you you really read it through. In summary its a when and how scenario for DEPLOYING https and not detailed a explanation on installation.
Pertaining to SSL certificates, i posted a detailed step-by-step guide on how to obtain STARSSL certificates some weeks ago but an overzealous mod/bot, for an unknown reason, decided to deny potential webmasters access to the info by censoring it completely. A webmaster confidentially insinuated it may have been censored because most are unaware such a free service exist and a few are making pecuniary benefits from the ignorant.
So due to the current climate of mods censoring info at will, even if it does not violate posting guidelines, i dont think i will go to the trouble of posting detailed guides for some time.
|Webmasters / When And How To Deploy HTTPS For Web Pages by TheArbiter: 6:54am On Dec 22, 2013|
Guide Credit to EriK: http://erik.io/blog/2013/06/08/a-basic-guide-to-when-and-how-to-deploy-https/
Many web developers know about SSL, but it is very common to see it only partially deployed, or not deployed where it should be. This basic guide on when and how to deploy SSL will help you avoid the most common mistakes.
If you have any kind of confidential information, or if you have logins, even if they are just for admins, you should deploy HTTPS. The risks are not theoretical.
Never deploy HTTPS partially: use it for all content, or many risks are left open, like the interception of session IDs, which is almost as good as passwords.
When you deploy HTTPS, enforce all requests to be served over HTTPS, by redirecting any plain HTTP requests to HTTPS URLs.
Enable strict transport security (HSTS) to further reduce the opportunity for attacks.
Set the secure flag on your cookies, like the session cookie, to make sure they don’t leak out through plain HTTP requests.
What is HTTPS?
HTTPS refers to the layering HTTP on top of SSL/TLS. The end result is that the HTTP traffic, including requested URLs, result pages, cookies, media and anything else sent over HTTP, is encrypted. Someone interfering with the connection can neither listen in on traffic, nor change it. In addition to simply encrypting, the identity of the remote server is verified: after all, having an encrypted connection is a lot less useful if you don’t know who’s at the other end. The end result is that it becomes incredibly difficult to intercept the traffic. It might still be possible to know which websites a user is visiting, but no more than that.
When and why should I deploy HTTPS?
You should deploy HTTPS whenever your website has any kind of non-public information. That includes any website that has logins – after all, if it were public information, it would not need a login. It also includes logins only used by administrators, like in your typical Wordpress website.
You should deploy HTTPS because without it, even someone doing passive eavesdropping, i.e. just listening to the network traffic and not manipulating it, can read along with all HTTP traffic, including any passwords or authentication tokens.
This is not a theoretical attack. I have done this myself (with permission) several times – this is particularly easy on public hotspots. Public hotspots typically apply no wifi encryption, which makes it trivial to eavesdrop on all traffic. This is a very common setup in bars, hotels, trains, and other public places. In other words, if your users sometimes use your website from a public hotspot, and you do not use HTTPS, anyone in the vicinity can listen in on all their traffic. This isn’t the only case where eavesdropping might happen, but it is a very easy one.
What if I just use HTTPS for my login page?
No. Using HTTPS just for the login page will prevent your user’s passwords from being eavesdropped, but this is only part of the problem.
First of all, the less HTTPS on your website, the easier it becomes to do active interception: your login link might point to an HTTPS URL, but if I change that link before the user clicks on it, it will not help you. But, using HTTPS partially also leaves risks open for passive interception.
Verifying a username and password is only one part of authenticating users on the web: we also need to remember that a particular user was authenticated, and which account they authenticated with. The most common method is session cookies. Typically, this means the browser stores a long random string, the session ID, in a cookie. PHP for example, uses the PHPSESSID cookie for this. A database on the server side then knows that that random string belongs to a particular session, in which a particular user authenticated himself. If I somehow acquire the session ID of your session, after you login, I acquire all permissions you have: almost as good as having your password.
Knowing this risk, the session ID is very long and random, and has a limited lifetime, meaning I can’t just guess it: this is what makes it safe enough. But, due to the way cookies work, the browser includes the cookie in every request it makes to your website. So even long after login, every page I request, even if it is usually public, will result in my session cookie being sent by the browser. And if someone is eavesdropping at that point, they can still compromise my account.
The same can happen when you only place the administrator part of your website behind SSL: when you log in and later visit the non-SSL public part, the browser will still be sending the session cookie.
In short: as session cookies, which allow access to the user’s account, are sent in every request, simply securing the login page is absolutely insufficient.
How do I enable HTTPS properly?
Enforce HTTPS usage
Some websites buy an SSL certificate, configure it on their web server, and assume they’re done. But that just means you enabled the option of HTTPS – which users are unlikely to notice. To make sure everyone benefits from your HTTPS support, you should redirect all requests that come in on HTTP, to HTTPS. That means any user visiting your site will automatically be switched over to HTTPS, and from that point on their traffic is secure.
This still leaves a small gap: the first time the user makes a request to your website, they will use plain HTTP, and they may already transmit confidential information at that time. It also leaves a small man-in-the-middle hole open.
Strict transport security
For further tightening, enable HTTP strict transport security (HSTS). This is a special header that can be sent by the server, which indicates: for a defined time period, you must not access this website over plain HTTP, or access it over HTTPS when it has a dodgy certificate. Optionally, subdomains can be included as well.
It’s a simple server header, and trivial to configure. Note though that there is no way to revert the setting before the max-age has expired, so don’t make it too long. You use HSTS next to an HTTPS redirect, not in place of it.
Cookies, including the session cookie, have an optional flag called secure. This basically means: “never send this cookie over a plain HTTP connection”. Enable this flag on your cookies, and they will not be sent with the HTTP request the browser does initially – but only once the connection switched to HTTPS, and can no longer be eavesdropped.
Can I just deploy SSL for authenticated users?
No. Once you’ve followed the guidelines above, at the moment a user makes a plain HTTP connection, you do not know whether they are authenticated. That’s the whole point: they should not transmit any secret information, like their session cookie, until they are on SSL.
Although I can imagine some ways to work around this, they might break at some point. As the cost of SSL is really quite low nowadays, it’s not worth it.
|Politics / Re: Jonathan Launches First Nigerian-Built Drone by TheArbiter: 10:28am On Dec 18, 2013|
Talking about drones. If this is a real drone
What do we call this?
My opinion: The officer who orchestrated this charade needs to be court martialed. Why ridicule your Commander-in-Chief with the commissioning of a mere prototype toy that can purchased in average toy stores abroad for a few dollars. A responsible serious weapons development section of the Air force, everywhere in the world, tasks a President to commission a fully operational vehicle and not a toy prototype.
Honestly, why did Prez Jonathan agree to this charade in the first place.
|Education / Re: FG Pays N200b To CBN For ASUU by TheArbiter: 3:36pm On Dec 04, 2013|
ASUU Strike: Presidency lied against ASUU, By Nasir Fagge
The letter from the Government, signed by Dr. Mac John Nwaobiala, was delivered at ASUU National Secretariat on 6th November, 2013. ASUU had made it clear to Government through the Minister of Education, and at the meetings held with Government’s representative, that our Union does not have an EXECUTIVE PRESIDENT who has the power to decide for the Union on crucial matters, including and especially on trade disputes and strikes. Similarly, the internal democracy of our Union does not permit the Principal Officers to make decisions on Union matters of trade disputes without advice from the National Executive Council. Allowing branches to meet, advise and take positions is the only way we know how to run a democratic organisation.
2. The content of ASUU’s reply
Here is the relevant portion of ASUU’s reply to government’s letter, as contained in Union’s letter of 22nd November, 2013 signed by Nasir F. Isa, President of ASUU:
“On behalf of NEC I hereby convey the Union’s appreciation of the expressed concern of Your Excellency to bring an end to the crisis occasioned by the poor implementation of the 2009 Agreement and the 2012 Memorandum of Understanding (MoU) arising therefrom through your personal intervention.
NEC would have taken a definitive decision on ending the strike, especially in view of Your Excellency’s intervention but for certain uncertainties, the clearance of which would have been decisive in making the relevant decision. These uncertainties involve issues on which ASUU members nationwide have strong feelings. They are about certain gaps evident in Government’s report as presented to our Union.
Specifically, our members are requesting that Your Excellency facilitates the resolution of the issues as a way of concretising their understanding of the agreed positions. This will involve the following:
(a) That the N200 billion agreed upon as 2013 Revitalisation Fund for public universities shall be deposited with the CBN and disbursed to the benefitting universities within two weeks.
(b) That the renegotiation of the 2009 Agreement in 2014 be included in the final document as agreed at the discussion with Your Excellency.
(c) That a Non-victimisation clause which is normally captured in all interactions of this nature be included in the final document and
(d) That a new Memorandum of Understanding shall be validly endorsed, signed by a representative of government, preferably the Attorney General of the Federation and a representative of ASUU, with the President of the Nigeria Labour Congress (NLC) as a witness.
Your Excellency please be assured that the Union is willing to do all that is needful to resolve the lingering crisis as soon as the expressed observations of our members are addressed.
Yours in the struggle
Naisr F. Isa, Ph.D
|Software/Programmer Market / Gamemaker Studio Standard Edition Is Free For A Limited Time by TheArbiter: 7:45am On Nov 27, 2013|
By Russ Boswell
Source Link here
Have you ever wanted to design a game? It's a difficult process, just ask anyone who has ever stepped foot into the business, but that doesn't mean you should give up on your dreams of porting something to the masses. There are a lot of useful tools out there that can help you breath life into your gaming ideas, but some of them will set you back quite a bit, and some are complex and difficult to maneuver.
GameMaker Studio from YoYo Games is not a traditional tool, but is instead an easy-to-use program that can help you quickly create two-dimensional Indie-style games. The best part? You can get it for free.
You're not going to crank out a AAA-title with this creator, but you'll "get a feel" for game design, and you can have a fully-functioning game within weeks according to the company's website. This is a great place to learn the process, and there are hundreds of tutorials online that can help you use GameMaker like a pro.
GameMaker Studio: Standard Edition would normally set you back around $50, but YoYo Games is giving would-be developers a free copy of their popular tool for a "limited time." To get yours, you'll need to go to the following page and download the free edition of the software. Once downloaded and installed, a box will pop up asking you which "update stream" you want to use. Choose the beta stream, and let the program update itself. Once it's all finished you'll be able to upgrade to the Standard Edition, and will be sent an activation code.
We don't know exactly how long this offer will be around, so be sure to secure your copy ASAP.
|Politics / Re: Whats Your Motivation And Inspiration For Voting President Jonathan? by TheArbiter: 4:20pm On Oct 04, 2013|
This is definitely not a campaign thread. If i were a moderator, i would have censored your statements and that of @Dike Chimezie. Isn't there a motivation or inspiration that made millions of youths to vote for the current President in office?
Thats what i'm interested in learning.
|Politics / Re: Whats Your Motivation And Inspiration For Voting President Jonathan? by TheArbiter: 3:58pm On Oct 04, 2013|
And what if i may ask would be the motivation or inspiration for the enmasse voting; governance deliverables or raw emotions like @donphilopus.
Did any youth in this country really vote based on subjective governance deliverables or just sentiments?
|Politics / Re: Whats Your Motivation And Inspiration For Voting President Jonathan? by TheArbiter: 3:49pm On Oct 04, 2013|
Don't be hasty in jumping to conclusions. I'm being objective here and not taking sides. Speak reason and many will be willing to listen. Why not convince me to see things your way with arguments devoid of abuse. The contents of the thread speaks for itself.
donphilopus: i bet you that most of the people that voted him in then regretted voting for him.
|Politics / Re: On the Dangerous Gulf Emerging Amongst Nigerians by TheArbiter: 3:10pm On Oct 04, 2013|
Government of the people, for the people, by the people.
|Politics / Re: Whats Your Motivation And Inspiration For Voting President Jonathan? by TheArbiter: 2:55pm On Oct 04, 2013|
An interesting perspective. While not all leaders are politicians, most politicians are leaders in their own right. But what about gonvernance deliverables. Any expectations? It seems all the views so far with the exception of @abuayman have any focus on deliverables as a yard stick of governance.
Dike Chimezie: Interesting question indeed.
|Politics / Re: Whats Your Motivation And Inspiration For Voting President Jonathan? by TheArbiter: 2:50pm On Oct 04, 2013|
You are the first dissenting voice. Hmmm, your reasons seem far-fetched. If he were prone to wrong decisions won't it have been obvious to the electorate. Anyways, its just one (your) opinion. Lets see what others have to say.
donphilopus: The reason why i didn't vote him and will not vote for him is because he takes the wrong decision, he can't differentiate between good and bad.
|Politics / Re: Whats Your Motivation And Inspiration For Voting President Jonathan? by TheArbiter: 1:23pm On Oct 04, 2013|
Good looks are assets to politicians all over the world. As a matter of fact most politicians are good looking. So you were enamored by his looks and not governance deliverables. Interesting.
egift: Because he have an innocent look face and a smile of deception to go with it. Is that good enough?
|Politics / Re: Whats Your Motivation And Inspiration For Voting President Jonathan? by TheArbiter: 12:03pm On Oct 04, 2013|
A reasonable motivation. But Rome was not built in day (4give the adage). Surely projects of such magnitude require time to implement. With the university as u say, you are one satisfied voter.
abuayman: All state will have a federal university and domestic airport but up till now, my state Kogi is still there without airport, at least the University is there sha
Was that statement made before the elections? Its a reasonable motivation for voting if i may say.
kokoA: "Terrorist attacks happen everywhere in the world, Nigeria is not an exception..." And "we are on top of the situation"
|Politics / Re: Whats Your Motivation And Inspiration For Voting President Jonathan? by TheArbiter: 11:47am On Oct 04, 2013|
Do you imply ur motivation is none other than to have a non-northerner as president. So if things go good or bad you are indifferent? A very interesting perspective.
demmie1: anti-northern sentiments.
Good governance in what aspect? Kindly explain what your expectations were?
slimming: For good governance
|Webmasters / Re: 53rd Independence Day Ebook Request Galore by TheArbiter: 10:47am On Oct 04, 2013|
@ Ayam Kay
Your download links have been up for 15hrs (since 8pm yesterday). They will expire after the next 9hrs.
|Politics / Re: Federal Government Is Broke-adams Oshiomhole by TheArbiter: 10:37am On Oct 04, 2013|
Fractious politics aside. Its becoming highly probable that Nigeria could be broke. Billions in bugdet arrears to states, Oil theft, strikes over money/unpaid salaries (ASUU, ASUP,etc), expensive bokoharam war, etc. It takes no brainer to realize money could be short. The sooner it sinks into the thick skulls of Nigerians the better.
|Politics / Whats Your Motivation And Inspiration For Voting President Jonathan? by TheArbiter: 10:19am On Oct 04, 2013|
Watching the verbal tussles on Nairaland for and against President Jonathan is sometimes apalling. But governments the world over have never been (generally) much loved even after they were overwhelmingly elected by voters.
But one aspect is undeniable, election campaigns grants access and insights into the aspiring candidates unlike everyday experiences. You listen to speeeches and debates which motivates and inspires you to vote for the candidates.
It would be nice to hear from Nairalanders which, of President Jonathan's speeches, debates and policies inspired and motivated them to vote him during the last election.
It will offer an insight into whether the verbal dissafection is from failed promises by the President or just impatience for the changes promised.
Please lets be civil; no vulgar language or abuse.
|Programming / Re: Help On Database Management System For A Hospital : Urgent by TheArbiter: 1:55pm On Oct 03, 2013|
For Open Source software check out this page:
Take a look at this one on Sourceforge:
Check this link for a review of some open source alternatives:
Download and test the softwares. You might just find one that fully or partially meets your needs.
|Webmasters / 53rd Independence Day Ebook Request Galore by TheArbiter: 1:38pm On Oct 03, 2013|
To mark the 53rd independence day celebrations, i have promised to provide access to ebooks as much as i can.
Post any title (It can be different from the sample titles below) you need and i shall provide the ebook, if available, as an encrypted download within 36 hours of request from my locker. The download link will be valid for 24hrs only.
Beginning JSP, JSF and Tomcat: Java Web Development
Botnets: The Killer Web App
The C++ Standard Library: A Tutorial and Reference
Cost Estimation Techniques for Web Projects
Even Faster Web Sites: Performance Best Practices for Web Developers
GIS for Web Developers: Adding Where to Your Web Applications
HTML5 for Dummies Quick Reference
Sams Teach Yourself HTML5 Mobile Application Development in 24 Hours
C++ Primer Plus
C++ Programming: From Problem Analysis to Program Design: From Problem Analysis to Program Design
C++ Timesaving Techniques for Dummies
Flash CS6: The Missing Manual
Ivor Horton's Beginning Visual C++ 2012
LabVIEW: Advanced Programming Techniques
Visual Basic 2012 Programmer's Reference
The ebook size must not exceed 100MB for the request to be honored.
Book Title (it could be different from the above list).
Subject Area (if i dont get the exact title i may get a substitute in the subject same area).
Email: For the download link and password.
|Webmasters / Moderator, Why Was This Post Censored? by TheArbiter: 1:14pm On Oct 03, 2013|
Excuse my asking; is this forum not meant to be a medium for sharing knowledge and information?
If yes, then what justifies the censorship of this post?
It says a spambot banned and censored when the contents are a far cry from the infractions stated in the posting rules.
|Webmasters / Salted Password Hashing - Doing It Right by TheArbiter: 12:32am On Sep 30, 2013|
Found this interesting read. Decided its a better read on the original website. Enjoy.
If you're a web developer, you've probably had to make a user account system. The most important aspect of a user account system is how user passwords are protected. User account databases are hacked frequently, so you absolutely must do something to protect your users' passwords if your website is ever breached. The best way to protect passwords is to employ salted password hashing. This page will explain how to do it properly.................................
Page link here: https://crackstation.net/hashing-security.htm
|Science/Technology / Re: Where Can I Purchase Liquid Nitrogen? by TheArbiter: 5:37am On Sep 15, 2013|
Nope. I meant it will be available but expensive. You can get it around the Lagos and Portharcourt areas if you do a little asking around. The Nigerian navy and some oil/gas companies require regular supplies for their activities. I just dont have exact info on any supplier.
The last straw is for you to import it from abroad if all else fails.
|Science/Technology / Re: Blog closed by Author. by TheArbiter: 9:40am On Sep 14, 2013|
The notion is absurd.
Firstly, you will never find any recipe for it on the internet. The 9/11 attack prompted an aggressive take down by NSA/FBI of all web content that even attempts to transfer such knowledge to terrorists.
Secondly, i would advise against any attempt to experiment. It is fraught with danger and the possibility of loss of life.
Thirdly, The ingredients required for such a misadventure are not easy to come by. You can make a rocket banger but solid rocket fuel is something else. There about 3 Nigerian scientists in 3 universities in Nigeria currently working to develop such capability but funding is lacking from the government.
Lastly, the best you can do is to order solid fuel rocket hobby kits from abroad (which might not pass Nigerian customs) if you need to impress anyone. Trying to reverse engineer the fuel formula is not possible after it has been mixed and cured.
|Sections: politics (1) business autos (1) jobs (1) career education (1) romance computers phones travel sports fashion health |
religion celebs tv-movies music-radio literature webmasters programming techmarket
Nairaland - Copyright © 2005 - 2014 Oluwaseun Osewa. All rights reserved. See Nairalist and How To Advertise. 263