Is anyone else getting a javascript error on Firefox? It is causing the whole site to not work for me.

"Uncaught SyntaxError: missing ) after argument list"

so... there would only be 4 possible choices for a bot to make to guess correctly?

left, right, up, and down?

Having special characters is a good idea but having a comma just to break a CSV is dumb. This would only happen if the hacker used a bad exporter or created their own (very poorly).

Yeah, this is silly. Pretty much every serializer in existence is going to handle this case. If the attacker wrote their own, then you might get lucky

AFAIU CSV is fundamentally ambiguous and can't actually be parsed in a fully deterministic way.

Edge cases get hard when dealing with nested commas, and there's no standard escape sequence.

Probably matters less with a two column arrangement, but things get really hairy really fast when you start adding types or BLOBs in the CSV.

AFAIK it's only "ambiguous" in the sense that if you get a csv file you can't determine the exact parsing behavior to use, but if you know what program created the csv (or what encoder options were used), it's not ambiguous to parse.

>but things get really hairy really fast when you start adding types or BLOBs in the CSV.

AFAIK BLOBs are hex encoded, which make them a non issue.

Hah! Half the time people will even do silly things like cat together multiple CSVs from different sources.

If blobs got consistently hex encoded, that would also be nice. Base64 is common, and there are multiple types of base64 encoding people use too.

Personally, I tend to think of CSV imports as something you can expect to have a ‘yield’ - and it’s never 100%.

yea so just do BSV or bell separated file. We already have "\n" newline separated files. We just need a cel seperator, '\b'. Problem solved.

On the plus side, accidentally cat’ng it to your terminal will be pleasantly musical.

No. Driving requires a fast reaction time and with remote having an inherent lag in the feed -- count me out.

+lack of sensors or sensory overload.

One behaves differently when driving, and be mindful of 360 degrees, checking the mirrors every 5-10 seconds, etc. But if one has a wall of screens, perhaps in the long run they may be able to convert the 2d (wall of monitors) to the 3d (360/surroundings) and sense it accordingly.

Lag/downtime/tunnels/etc. would kill, and should be flawless.

If ISP's could do it, couldn't some bad actor?

There are only 2 ways for some "bad actor" to do this sort of MITM (man in the middle).

1) Illegally tap into a node on the internet backbone. The only cases I've heard of where this has actually occurred involved either corrupt ISPs or governments in dictatorial or 3rd world countries. If government is involved, all bets are off.

2) Inject software inside your local computer or network. In which case, all bets are off once again. Once inside your network, these "bad actors" would presumably have full access to the SSL/TLS handshake process as well and thus be able to decrypt traffic as they see fit.

Bottom line: The case for HTTPS everywhere is weak and is mostly about perception created by 3rd parties (like Google) with a vested interest.

- use CSRF tokens

- route throttling to something high since if they are new users they shouldn't need to hit that form more than once

- don't let the end user know that you were able to send an email. Keep it vague like "if your email exists, you should receive an email soon."

- don't use a personal email server; something like sendgrid can give you a server that is in good/neutral standing

- if you have to handle your own emails, keep up with any bounce backs and always keep an eye your server being on any blacklists to get it cleared out as soon as possible

- honeypots can be useful if the spammer(s) isn't keeping a close eye on their scripts

- put your site behind a DDoS service

> don't let the end user know that you were able to send an email.

I need to stress this is a very important point. If you happen to state the email they entered already exists in the system, the attacker now knows that is a valid account then use a known password linked to that email to gain access.

I've used Swagger before.

Have you looked into hardware keys? like Yubikeys or the Google Titan?

Thank you, good idea. I'll look into these next.

If you don't want someone/something from seeing your content, don't put it on the internet but if that isn't enough:

- add a disallow in your robots.txt (many people say the bots ignore this anyways)

- somehow have your pages so far down in SEO rankings that bots would deem it incorrect/irreverent

- put your content behind a login; this too has it's issues since the bot handler can just get some login credentials to crawl anyways or a user can copy the content elsewhere

- you could also try gaming the system by making your content so offensive that the current AI censorship fad blocks it

- you could try not linking a domain name to the IP, making it harder to find

- sue any AI developer that you think crawled your content

>you could also try gaming the system by making your content so offensive that the current AI censorship fad blocks it

-

recall the /. comment bombs against eschelon in the day whereby they had a signature statement that said all the key-words the pre-snowden-leak folks (myself included) wiould trigger eschelon...

There are a vast number of new keywords, in the AI time-loop, which are really bad to include - but maybe a logic bomb of sorts on AI based on woke triggering is in order...

a signatory paragraph of such words as the F, the N, C, the other F, any pronoun BS, etc... and get AI to be offended based on their requirements to be WOKE in their results...