http://www.nytimes.com/2008/03/29/science/29collider.html?pagewanted=1&_r=3&hp

My favorite quote is the very last sentence on page 2.

(Scroll down to see)















































“the Large Hadron Collider might make dragons that might eat us up.”

:) :) :)
-- 
...Ben Chambers
www.pacificwebguy.com

Post a reply to this message

Chambers wrote:
> http://www.nytimes.com/2008/03/29/science/29collider.html?pagewanted=1&_r=3&hp 

Excellent. :)

The trouble is, most people don't realise that when a scientist says 
something is unlikely, they could easily be talking about a 1 in 1e30 
chance or less. Basic honesty and innate pedantry forbids them from 
saying outright that something is impossible because they don't honestly 
know for absolute certainty. Of course, the slightest chance that a 
pico-blackhole with less mass than a proton could appear and start to 
eat the earth, however slowly or briefly, can very easily be used by the 
press to sell at least 1e30 papers...

Post a reply to this message

And lo on Thu, 03 Apr 2008 05:03:10 +0100, Chambers  

<ben### [at] pacificwebguycom> did spake, saying:

> http://www.nytimes.com/2008/03/29/science/29collider.html?pagewanted=
1&_r=3&hp

So let me get this straight *Mr* Wagner, who studied physics, and Mr  

Sancho, an author, are attempting to get an injunction in Hawaii against
 a  

European Science Group, of which they United States is not a part, from 
 

operating in Switzerland because they've failed to carry out an  

environmental impact statement as required under a Act that doesn't appl
y  

to them.

:-)

-- 

Phil Cook

--
I once tried to be apathetic, but I just couldn't be bothered
http://flipc.blogspot.com

Post a reply to this message

On Wed, 02 Apr 2008 21:03:10 -0700, Chambers <ben### [at] pacificwebguycom> wrote:

>http://www.nytimes.com/2008/03/29/science/29collider.html?pagewanted=1&_r=3&hp

Half-Life and its sequels are just training simulators for what's to come.  ;-)

Post a reply to this message

"Phil Cook" <phi### [at] nospamrocainfreeservecouk> wrote in message
news:op.t8083otuc3xi7v@news.povray.org...

> So let me get this straight *Mr* Wagner, who studied physics, and Mr
> Sancho, an author, are attempting to get an injunction in Hawaii against a
> European Science Group, of which they United States is not a part, from
> operating in Switzerland because they've failed to carry out an
> environmental impact statement as required under a Act that doesn't apply
> to them.

But, but, but, isn't Switzerland a small town up near the Canadian border? I
mean, it has skiing, so it must be somewhere up north.
Europe? Is that a state?

<grin>

For some extra fun, find the New Scientist article that reports on this. The
article's sane, the comments get progressively more ridiculous.
Why do these people seem to think they know more about subatomic physics
than the professional scientists do?
Oh wait, I forgot. Science = Evil. Geeks are losers. Geniuses are always
trying to take over or destroy the world. Right. Now I got it.

Down with Progress! Back to the Stone Age!


Hehehehehehe...... <grin>

Post a reply to this message

Gail Shaw wrote:

> But, but, but, isn't Switzerland a small town up near the Canadian border? I
> mean, it has skiing, so it must be somewhere up north.
> Europe? Is that a state?

That would be funny if it wasn't true... :'(

> For some extra fun, find the New Scientist article that reports on this. The
> article's sane, the comments get progressively more ridiculous.
> Why do these people seem to think they know more about subatomic physics
> than the professional scientists do?
> Oh wait, I forgot. Science = Evil. Geeks are losers. Geniuses are always
> trying to take over or destroy the world. Right. Now I got it.
> 
> Down with Progress! Back to the Stone Age!

Indeed. Because, let's face it, if the world gets destroyed by the LHC, 
the scientists won't be upset. It's not like they'll be the first ones 
to die or anyt... oh, wait...

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

On Thu, 3 Apr 2008 15:37:41 +0200, "Gail Shaw" <initialsurname@sentech
sa dot com> wrote:

>Why do these people seem to think they know more about subatomic physics
>than the professional scientists do?

I was listening to Melvyn Bragg rabbit-ing on about Newton's laws of
motion. You can get the podcast here
http://www.bbc.co.uk/radio4/history/inourtime/

He read out the first one and said to the professor "Can you expand on
that?" After a short moment the professor said "No".
The science reporter came to Bragg's rescue :)
-- 

Regards
     Stephen

Post a reply to this message

"Stephen" <mcavoysAT@aolDOTcom> wrote in message
news:kln9v391qi6bp936qjpc250pbo7ue616vh@4ax.com...
>
> He read out the first one and said to the professor "Can you expand on
> that?" After a short moment the professor said "No".
> The science reporter came to Bragg's rescue :)

LoL

Well, in all honesty, the 1st law of motion is fairly self-explanatory.

Post a reply to this message

>> He read out the first one and said to the professor "Can you expand on
>> that?" After a short moment the professor said "No".
>> The science reporter came to Bragg's rescue :)
> 
> LoL
> 
> Well, in all honesty, the 1st law of motion is fairly self-explanatory.

Somebody remind me... which one is law #1?

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

"Invisible" <voi### [at] devnull> wrote in message
news:47f4e25c$1@news.povray.org...
> >> He read out the first one and said to the professor "Can you expand on
> >> that?" After a short moment the professor said "No".
> >> The science reporter came to Bragg's rescue :)
> >
> > LoL
> >
> > Well, in all honesty, the 1st law of motion is fairly self-explanatory.
>
> Somebody remind me... which one is law #1?

An object will remain at rest or will continue moving in a straight line at
constant speed unless an external force is applied.

Post a reply to this message

>> Somebody remind me... which one is law #1?
> 
> An object will remain at rest or will continue moving in a straight line at
> constant speed unless an external force is applied.

OK, that *is* pretty self explanatory...

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

On Thu, 3 Apr 2008 15:53:43 +0200, "Gail Shaw" <initialsurname@sentech
sa dot com> wrote:

>
>Well, in all honesty, the 1st law of motion is fairly self-explanatory.

Not to dear Melvyn. It sounded as if he was struggling. And when they
went on to talk about Descartes third law. He complained that they had
only started on Newton's second <hehe>
-- 

Regards
     Stephen

Post a reply to this message

>> An object will remain at rest or will continue moving in a straight line 
>> at
>> constant speed unless an external force is applied.
>
> OK, that *is* pretty self explanatory...

But if the audience is the general public, you should probably explain how 
air drag, friction, gravity and things can all be external forces.

Post a reply to this message

Bill Pragnell <bil### [at] hotmailcom> wrote:
> The trouble is, most people don't realise that when a scientist says 
> something is unlikely, they could easily be talking about a 1 in 1e30 
> chance or less. Basic honesty and innate pedantry forbids them from 
> saying outright that something is impossible because they don't honestly 
> know for absolute certainty. Of course, the slightest chance that a 
> pico-blackhole with less mass than a proton could appear and start to 
> eat the earth, however slowly or briefly, can very easily be used by the 
> press to sell at least 1e30 papers...

  I think that it's a lot more likely that a black hole travelling at
almost c towards us will collide with the Earth in the next 10 years
than a micro-blackhole created by humans eating the Earth.

-- 
                                                          - Warp

Post a reply to this message

scott <sco### [at] laptopcom> wrote:
> >> An object will remain at rest or will continue moving in a straight line 
> >> at
> >> constant speed unless an external force is applied.

> But if the audience is the general public, you should probably explain how 
> air drag, friction, gravity and things can all be external forces.

  Well, according to GR there's no such a thing as "gravity force", and
the correct form of the law of inertia is "...will continue moving along
its geodesic...". A geodesic is the shortest path between two points for
a given object.

-- 
                                                          - Warp

Post a reply to this message

Chambers escribió:
> http://www.nytimes.com/2008/03/29/science/29collider.html?pagewanted=1&_r=3&hp 
> 

Bleh. Registration required.

Post a reply to this message

Invisible escribió:
> Gail Shaw wrote:
> 
>> But, but, but, isn't Switzerland a small town up near the Canadian 
>> border? I
>> mean, it has skiing, so it must be somewhere up north.
>> Europe? Is that a state?
> 
> That would be funny if it wasn't true... :'(

It's *not* true. Europe is *not* a state.

*ducks*

Post a reply to this message

Invisible wrote:
> Indeed. Because, let's face it, if the world gets destroyed by the LHC, 
> the scientists won't be upset. It's not like they'll be the first ones 
> to die or anyt... oh, wait...

Oh, those Anomylous Materials people are at it again!

-- 
   Darren New / San Diego, CA, USA (PST)
     "That's pretty. Where's that?"
          "It's the Age of Channelwood."
     "We should go there on vacation some time."

Post a reply to this message

Nicolas Alvarez wrote:
> Chambers escribió:
>> http://www.nytimes.com/2008/03/29/science/29collider.html?pagewanted=1&_r=3&hp 
>>
> 
> Bleh. Registration required.

That's weird, I'm not registered, and it never bothered me.

-- 
...Ben Chambers
www.pacificwebguy.com

Post a reply to this message

Chambers escribió:
> That's weird, I'm not registered, and it never bothered me.

I just read carefully the URL that it redirected me to.

Now I want to kill a webdev.

"&REFUSE_COOKIE_ERROR=SHOW_ERROR"

And indeed, below the "Log In Now" heading, it says "In order to access 
our Web site, your Web browser must accept cookies from NYTimes.com. 
More information." But isn't it totally retarded that it takes you to a 
login page if you don't have cookies enabled, even if you don't need to 
log in? In fact, isn't it totally retarded that it requires cookies in 
the first place?

Post a reply to this message

Nicolas Alvarez escribió:
> Chambers escribió:
>> That's weird, I'm not registered, and it never bothered me.
> 
> I just read carefully the URL that it redirected me to.
> 
> Now I want to kill a webdev.
> 
> "&REFUSE_COOKIE_ERROR=SHOW_ERROR"

So yeah, enabled cookies and read the thing.

Quite a good article. Maybe Wagner should be put inside the collider :)

Post a reply to this message

Nicolas Alvarez wrote:
> In fact, isn't it totally retarded that it requires cookies in 
> the first place?

No. What's totally retarded is building statefull apps on top of HTTP. 
Right up there with custom login forms when HTTP has a perfectly good 
login mechanism.

-- 
   Darren New / San Diego, CA, USA (PST)
     "That's pretty. Where's that?"
          "It's the Age of Channelwood."
     "We should go there on vacation some time."

Post a reply to this message

Darren New escribió:
> Nicolas Alvarez wrote:
>> In fact, isn't it totally retarded that it requires cookies in the 
>> first place?
> 
> No. What's totally retarded is building statefull apps on top of HTTP. 
> Right up there with custom login forms when HTTP has a perfectly good 
> login mechanism.

HTTP auth is not "perfectly good"; but I agree with the general sentiment.

Post a reply to this message

"Nicolas Alvarez" <nic### [at] gmailisthebestcom> wrote in message
news:47f52c1c$1@news.povray.org...
> Chambers escribió:
> >
http://www.nytimes.com/2008/03/29/science/29collider.html?pagewanted=1&_r=3&
hp
> >
>
> Bleh. Registration required.

As an alternative

http://www.newscientist.com/channel/opinion/dn13555-particle-smasher-not-a-t
hreat-to-the-earth.html?feedId=online-news_rss20

Post a reply to this message

Warp wrote:
> Bill Pragnell <bil### [at] hotmailcom> wrote:
>> The trouble is, most people don't realise that when a scientist says 
>> something is unlikely, they could easily be talking about a 1 in 1e30 
>> chance or less. Basic honesty and innate pedantry forbids them from 
>> saying outright that something is impossible because they don't honestly 
>> know for absolute certainty. Of course, the slightest chance that a 
>> pico-blackhole with less mass than a proton could appear and start to 
>> eat the earth, however slowly or briefly, can very easily be used by the 
>> press to sell at least 1e30 papers...
> 
>   I think that it's a lot more likely that a black hole travelling at
> almost c towards us will collide with the Earth in the next 10 years
> than a micro-blackhole created by humans eating the Earth.

Agreed. If it's very small we probably wouldn't even notice.

Post a reply to this message

Bill Pragnell escribió:
> Agreed. If it's very small we probably wouldn't even notice.

If it's big, you think we would notice either? :)

Post a reply to this message

Nicolas Alvarez wrote:
> HTTP auth is not "perfectly good"; but I agree with the general sentiment.

What's wrong with it, other than being limited to name/password as input?

-- 
   Darren New / San Diego, CA, USA (PST)
     "That's pretty. Where's that?"
          "It's the Age of Channelwood."
     "We should go there on vacation some time."

Post a reply to this message

Darren New escribió:
> Nicolas Alvarez wrote:
>> HTTP auth is not "perfectly good"; but I agree with the general 
>> sentiment.
> 
> What's wrong with it, other than being limited to name/password as input?

A good start is: how do you logout?

Post a reply to this message

Nicolas Alvarez wrote:
> A good start is: how do you logout?

You shouldn't need to. You're not connected to the site between page 
fetches. In terms of "how do I remove the password from my machine", 
that would be a local matter.

-- 
   Darren New / San Diego, CA, USA (PST)
     "That's pretty. Where's that?"
          "It's the Age of Channelwood."
     "We should go there on vacation some time."

Post a reply to this message

Darren New escribió:
> Nicolas Alvarez wrote:
>> A good start is: how do you logout?
> 
> You shouldn't need to. You're not connected to the site between page 
> fetches. In terms of "how do I remove the password from my machine", 
> that would be a local matter.

Exactly. Browsers give no UI to stop sending the login information to 
the server.

Post a reply to this message

Nicolas Alvarez wrote:
> Exactly. Browsers give no UI to stop sending the login information to 
> the server.

Firefox certainly does. It's in the exact same panel you go to to clear 
out the "don't save passwords" for the more common "fill in this form to 
get a cookie" kind of tracking.

-- 
   Darren New / San Diego, CA, USA (PST)
     "That's pretty. Where's that?"
          "It's the Age of Channelwood."
     "We should go there on vacation some time."

Post a reply to this message

Darren New escribió:
> Nicolas Alvarez wrote:
>> Exactly. Browsers give no UI to stop sending the login information to 
>> the server.
> 
> Firefox certainly does. It's in the exact same panel you go to to clear 
> out the "don't save passwords" for the more common "fill in this form to 
> get a cookie" kind of tracking.

You mean Remove private data, Authenticated sessions? That's like 
telling people to manually delete cookies from all websites when they 
want to log out from a single place, instead of a "logout" button.

How do I log out of *one* website?

How can a website automatically log you out after inactivity? (cookies 
have expiration date)

Isn't it safer to send a cookie with a session ID back and forth than 
sending your actual username and password on every page request?

Post a reply to this message

Nicolas Alvarez wrote:
> You mean Remove private data, Authenticated sessions?

No. Tools->Options->Privacy->Passwords.  Exactly where you'd expect it.

Authenticated sessions are SSL cookies, nothing to do with passwords.

> How do I log out of *one* website?

Tools->Options->Privacy->Passwords - remove the password for that site.

> How can a website automatically log you out after inactivity? (cookies 
> have expiration date)

With the normal HTTP login mechanism, you're logging in every time you 
fetch a page, so the question is meaningless.

If you're inactive, why does the web site need to "log you out"?  Why 
can't it just discard your session, empty your shopping cart, or 
whatever else it does when you normally "log out"?

How does the web site keep you from saving the password in Firefox for 
more than 30 minutes, forcing you to retype your user name and password 
if you're idle too long?  How does the web site keep you from leaving 
the password-protected page on your screen after too much inactivity?

BTW, cookie expiration is enforced by the browser, not the server. Try 
expiring a cookie on most cell phones. Hint: It doesn't work.

> Isn't it safer to send a cookie with a session ID back and forth than 
> sending your actual username and password on every page request?

No.  Cookies can be hijacked. MD5 message digests can't.

-- 
   Darren New / San Diego, CA, USA (PST)
     "That's pretty. Where's that?"
          "It's the Age of Channelwood."
     "We should go there on vacation some time."

Post a reply to this message

"Nicolas Alvarez" <nic### [at] gmailisthebestcom> wrote in message
news:47f6484e@news.povray.org...
> Bill Pragnell escribió:
> > Agreed. If it's very small we probably wouldn't even notice.
>
> If it's big, you think we would notice either? :)

Probably. The gravitational effects would be pretty noticable, especially
when it gets close. Depends how massive the thing is how bad it would be.

Anywhere close to even  stellar mass and it wouldn't have to come within the
oort clous to have some very nasty effects

Post a reply to this message

Darren New escribió:
> Nicolas Alvarez wrote:
>> You mean Remove private data, Authenticated sessions?
> 
> No. Tools->Options->Privacy->Passwords.  Exactly where you'd expect it.

There is no "passwords" under "privacy". Passwords on the "security" tab 
are the saved passwords. When you login via HTTP auth, and tell Firefox 
*not* to save the password, it still keeps it for the current browser 
session (otherwise it would keep asking you for the password on every 
page request).

How do I delete that password within the session, without restarting the 
browser? I doubt it's in the saved passwords list; that's for 
auto-filling forms (or http auth dialogs), not for things within the 
session.

And anyway, users would want something as simple as the "logout" button 
on HTML forms, not getting into the browser options.

> BTW, cookie expiration is enforced by the browser, not the server.

Session usually expires server-side at the same time as the client-side 
cookie. There are no sessions with HTTP auth, nothing you can expire.

One method I have seen for "expiring session on inactivity" (or on user 
request, via a link) with HTTP auth is returning a 401 as if the 
password was wrong, which forces most browsers to ask you the login info 
again.

Post a reply to this message

Nicolas Alvarez escribió:
> How do I delete that password within the session, without restarting the 
> browser?

"According to RFC 2616, existing browsers retain authentication 
information indefinitely. HTTP does not provide a method for a server to 
direct clients to discard these cached credentials. This is a 
significant defect that requires further extensions to HTTP." --Wikipedia

"The authentication is kept in the browser (client side), so there's 
really no way to log out the user on the server side AFAIK. The user 
will have to close the browser to end the session. I think there are 
hacks around this issue, but I haven't looked into them." --a Ruby on 
Rails blog post

"Both Netscape Navigator and Internet Explorer will clear the local 
browser window's authentication cache for the realm upon receiving a 
server response of 401. This can effectively 'log out' a user, forcing 
them to re-enter their username and password. Some people use this to 
'time out' logins, or provide a 'log-out' button." --PHP manual

BTW: I think most people use forms for login just because everybody else 
is doing it, not because they gave it any thought :)

Post a reply to this message

Gail Shaw escribió:
> "Nicolas Alvarez" <nic### [at] gmailisthebestcom> wrote in message
> news:47f6484e@news.povray.org...
>> Bill Pragnell escribi�:
>>> Agreed. If it's very small we probably wouldn't even notice.
>> If it's big, you think we would notice either? :)
> 
> Probably. The gravitational effects would be pretty noticable, especially
> when it gets close. Depends how massive the thing is how bad it would be.
> 
> Anywhere close to even  stellar mass and it wouldn't have to come within the
> oort clous to have some very nasty effects

I meant, if it eats the Earth within a second and everyone gets killed 
instantly, who would "notice"?

Post a reply to this message

Gail Shaw <initialsurname@sentech sa dot com> wrote:

> "Nicolas Alvarez" <nic### [at] gmailisthebestcom> wrote in message
> news:47f6484e@news.povray.org...
> > Bill Pragnell escribi?:
> > > Agreed. If it's very small we probably wouldn't even notice.
> >
> > If it's big, you think we would notice either? :)

> Probably. The gravitational effects would be pretty noticable, especially
> when it gets close. Depends how massive the thing is how bad it would be.

> Anywhere close to even  stellar mass and it wouldn't have to come within the
> oort clous to have some very nasty effects

  I said in my original post "travelling at almost c towards us".
Pretty hard to notice.

-- 
                                                          - Warp

Post a reply to this message

Nicolas Alvarez wrote:
> There is no "passwords" under "privacy". 

You should learn to qualify your statements, like
   There is no "passwords" under "privacy" on my version of this program.

Certainly on Firefox 1.5.0.12 there is, and it holds the "auth" 
passwords right next to the "<input type=password" passwords.

> When you login via HTTP auth, and tell Firefox 
> *not* to save the password, it still keeps it for the current browser 
> session (otherwise it would keep asking you for the password on every 
> page request).

Right. Same with cookies, see.

> How do I delete that password within the session, without restarting the 
> browser?

Uh, why would you? Don't go back to that site. :-)

Granted, if you want to log in as someone else, that could be mildly 
problematic.  I don't see this as a normal use case for 99% of the sites 
I see using the kludged cookie-based logins, tho.

> And anyway, users would want something as simple as the "logout" button 
> on HTML forms, not getting into the browser options.

There's no reason it couldn't be easier to do from the browser, yes.

> Session usually expires server-side at the same time as the client-side 
> cookie. There are no sessions with HTTP auth, nothing you can expire.

Of course there is. You're just not thinking.  The server knows how long 
it has been since last you came back.  After that time elapses, clean up 
whatever you'd clean up if the user hit the "logout" button.

In other words, no, cookies do not "expire" on the server side, since 
the server doesn't have a cookie. A cookie is a way for the server to 
store something at the browser. The "something" is what expires. Hence, 
go ahead, expire that "something".

> One method I have seen for "expiring session on inactivity" (or on user 
> request, via a link) with HTTP auth is returning a 401 as if the 
> password was wrong, which forces most browsers to ask you the login info 
> again.

Or just return a 403 *once* even for the *right* password.  Or change 
the realm to be session-specific.

-- 
   Darren New / San Diego, CA, USA (PST)
     "That's pretty. Where's that?"
          "It's the Age of Channelwood."
     "We should go there on vacation some time."

Post a reply to this message

Darren New wrote:
> Or just return a 403 *once* even for the *right* password. 

Sorry. Obviously I meant 401 there.


-- 
   Darren New / San Diego, CA, USA (PST)
     "That's pretty. Where's that?"
          "It's the Age of Channelwood."
     "We should go there on vacation some time."

Post a reply to this message

Nicolas Alvarez wrote:
> Nicolas Alvarez escribió:
>> How do I delete that password within the session, without restarting 
>> the browser?
> 
> "According to RFC 2616, existing browsers retain authentication 
> information indefinitely.

Note that "indefinitely" does not mean "forever". It means you can't 
control how long they save it.

Just like you can't control how long the browser caches user name / 
password information for a forms-based login.

> This is a 
> significant defect that requires further extensions to HTTP." --Wikipedia

Without someone explaining why it's a defect, I'm not sure this is so clear.

> "Both Netscape Navigator and Internet Explorer will clear the local 
> browser window's authentication cache for the realm upon receiving a 
> server response of 401.

Right. That's basically exactly how you're *supposed* to do it. "The 
password you provided to get to this page is invalid. Please reenter it.

> BTW: I think most people use forms for login just because everybody else 
> is doing it, not because they gave it any thought :)

Exactly my point, yes.

Plus, it adds the overhead of requiring SSL (which sucks up both compute 
cycles and IP addresses) just so you can accept the password without 
sending it in the clear, unlike HTTP AUTH.

But of course, again the whole argument that cookies are better than 
AUTH is based on the flawed premise that you should be having "logins" 
in protocols running over a stateless protocol like HTTP in the first place.

-- 
   Darren New / San Diego, CA, USA (PST)
     "That's pretty. Where's that?"
          "It's the Age of Channelwood."
     "We should go there on vacation some time."

Post a reply to this message

Darren New escribió:
> Nicolas Alvarez wrote:
>> Session usually expires server-side at the same time as the 
>> client-side cookie. There are no sessions with HTTP auth, nothing you 
>> can expire.
> 
> Of course there is. You're just not thinking.  The server knows how long 
> it has been since last you came back.  After that time elapses, clean up 
> whatever you'd clean up if the user hit the "logout" button.
> 
> In other words, no, cookies do not "expire" on the server side, since 
> the server doesn't have a cookie. A cookie is a way for the server to 
> store something at the browser. The "something" is what expires. Hence, 
> go ahead, expire that "something".

With cookie-based login, the "something" to expire is the session ID 
kept in the cookie. Even if the client doesn't expire the cookie, the 
server wouldn't accept the session ID anymore once it expires.

With HTTP auth, the "something" that the client sends is the user 
credentials. Should I expire the user's password?

Anyway, just Google "http auth logout" [1] and see how many people 
complain about it. *Sometimes* even people who know what they're talking 
about :)

[1] or "http (auth|authentication) (logout|log out)" so that you don't 
miss anything.

Post a reply to this message

Nicolas Alvarez wrote:
> With cookie-based login, the "something" to expire is the session ID 
> kept in the cookie. Even if the client doesn't expire the cookie, the 
> server wouldn't accept the session ID anymore once it expires.

No. If the only thing you're expiring is the cookie, then there's no 
point in having the cookie. The cookie is there to track some state on 
the server and associate it with the user's session. The cookie by 
itself isn't useful. It's the cookie's association with the row in the 
database representing the shopping cart or whatever that's useful.

> With HTTP auth, the "something" that the client sends is the user 
> credentials. Should I expire the user's password?

The cookie is there to identify the user. The auth is there to identify 
the user. What exactly is it you do at the server when the "cookie 
expires". You don't "log out" the user, because the user isn't "logged 
in" at that level of abstraction. You're changing some system state, 
which you have to do when "the cookie expires" regardless of what the 
browser does.

Put it this way: You give me a cookie that's set to expire in an hour. 
If I come back in 3 hours with the same cookie (because my browser 
didn't expire it), are you going to let me in with exactly the same 
state? If so, why are you expiring my cookie?  If not, why is the cookie 
better than auth?  If it's really important my cookie expires, you need 
to enforce that at your end.

So what action do you take when someone says "log out" other than 
deleting the cookie, and why do you care? Why not just have a "log out" 
button that cleans up the server side, and from then on return a 403 if 
they go anywhere other than the "log in" link from the home page? :-)

It's really not that hard if you think about it a while. It's just 
easier to pretend HTTP is stateful. And of course the marketing people 
don't like it, because it doesn't work like everyone else's web site, 
all of which work differently.

(Of course, you don't get to do CAPTHCAH either.)

> Anyway, just Google "http auth logout" [1] and see how many people 
> complain about it. *Sometimes* even people who know what they're talking 
> about :)

Oh, I'm not saying it's never appropriate. It's just used almost never, 
and it has definite advantages.

Just looking at the first link, 
http://www.artima.com/weblogs/viewpost.jsp?thread=155252

He lists "username prompt can't be customized". Sure, but that can also 
be a good thing. It's a UI standard. :-)

Numbers 2, 3, 4 are all bogus. "No way to do optional authentication", 
for example, is baloney. Don't return a 401, you don't need to 
authenticate.  5, "difficult single sign-on", is true, but just as bad 
for forms-based sign-ons, because you have to use SSL for that, and 
hence you need to either spend big bucks on a wildcard cert or suck up a 
whole bunch of public IP addresses because you don't like built-in 
authentication. :-)

Basically, the problem is "http auth is lame, because browsers implement 
it in a lame way, so we're not going to use it, so browser authors won't 
bother to de-lame it."  Which makes sense, given HTTP isn't really 
designed to be used for stateful applications anyway. :-)

-- 
   Darren New / San Diego, CA, USA (PST)
     "That's pretty. Where's that?"
          "It's the Age of Channelwood."
     "We should go there on vacation some time."

Post a reply to this message

Darren New escribió:
> Nicolas Alvarez wrote:
>> With cookie-based login, the "something" to expire is the session ID 
>> kept in the cookie. Even if the client doesn't expire the cookie, the 
>> server wouldn't accept the session ID anymore once it expires.
> 
> No. If the only thing you're expiring is the cookie, then there's no 
> point in having the cookie. The cookie is there to track some state on 
> the server and associate it with the user's session. The cookie by 
> itself isn't useful. It's the cookie's association with the row in the 
> database representing the shopping cart or whatever that's useful.

With cookie-based login, the "something" to expire is the session data 
stored in the server and identified by the session ID stored in the 
cookie. Even if the client doesn't expire the cookie, the server 
wouldn't accept the session ID anymore once the session expires.

Better like that?

> Basically, the problem is "http auth is lame, because browsers implement 
> it in a lame way, so we're not going to use it, so browser authors won't 
> bother to de-lame it."  Which makes sense, given HTTP isn't really 
> designed to be used for stateful applications anyway. :-)

I would use it. I'm just arguing it's not "perfectly good", like you 
said in your first post.

Post a reply to this message

Nicolas Alvarez wrote:
> With cookie-based login, the "something" to expire is the session data 
> stored in the server and identified by the session ID stored in the 
> cookie. Even if the client doesn't expire the cookie, the server 
> wouldn't accept the session ID anymore once the session expires.

Exactly. Hence, there's no real need for the cookie to do anything in 
order to "log out" or "expire the session" of the user, am I right? If 
the user comes back to a deep page with a valid login, bounce them to 
the top-level page that says "Your session has expired, please start over."

Then there's sites like (say) Facebook, where you're contractually 
obligated to have only one login, so having a "logout" button makes no 
sense to start with. :-)

> I would use it. I'm just arguing it's not "perfectly good", like you 
> said in your first post.

That's fair enough, yes. In part because the browsers don't support it. 
It's perfectly good for the process of logging someone in. What's not 
perfectly good is lame browser support. :-)

-- 
   Darren New / San Diego, CA, USA (PST)
     "That's pretty. Where's that?"
          "It's the Age of Channelwood."
     "We should go there on vacation some time."

Post a reply to this message

Darren New wrote:
> Then there's sites like (say) Facebook, where you're contractually 
> obligated to have only one login, so having a "logout" button makes no 
> sense to start with. :-)

What about multiple persons using the same computer?

-- 
...Ben Chambers
www.pacificwebguy.com

Post a reply to this message

Chambers wrote:
> Darren New wrote:
>> Then there's sites like (say) Facebook, where you're contractually 
>> obligated to have only one login, so having a "logout" button makes no 
>> sense to start with. :-)
> 
> What about multiple persons using the same computer?

Then you should be closing the browser and logging into the other 
person's account, yes? :-)

(Yeah, OK, this has gotten a bit silly even for me. It's just a pet 
peeve of mine that people use HTTP for all kinds of wrong stuff where 
they'd be far, far better off with an actual statefull 
connection-oriented protocol without quite so much hackery in it. The 
fact that I'm now expected to do all the hackery myself is rather what 
ticks me off, methinks.)

-- 
   Darren New / San Diego, CA, USA (PST)
     "That's pretty. Where's that?"
          "It's the Age of Channelwood."
     "We should go there on vacation some time."

Post a reply to this message

"Warp" <war### [at] tagpovrayorg> wrote in message
news:47f6c63b@news.povray.org...
>
>   I said in my original post "travelling at almost c towards us".
> Pretty hard to notice.
>

Depends how close to c, and how long it's been travelling towards us. Long
enough and the red-shifted light and gravitational lensing (maybe) might
show its presence

Post a reply to this message

And lo on Thu, 03 Apr 2008 14:37:41 +0100, Gail Shaw sa dot com>  

<"<initialsurname"@sentech> did spake, saying:

>
> "Phil Cook" <phi### [at] nospamrocainfreeservecouk> wrote in message
> news:op.t8083otuc3xi7v@news.povray.org...
>
>> So let me get this straight *Mr* Wagner, who studied physics, and Mr
>> Sancho, an author, are attempting to get an injunction in Hawaii  

>> against a
>> European Science Group, of which they United States is not a part, fr
om
>> operating in Switzerland because they've failed to carry out an
>> environmental impact statement as required under a Act that doesn't  

>> apply to them.

> For some extra fun, find the New Scientist article that reports on thi
s.  

> The
> article's sane, the comments get progressively more ridiculous.

Perusing it now; heh.

> Why do these people seem to think they know more about subatomic physi
cs
> than the professional scientists do?

Because for some reason 'people' are being taught that their unqualifed 
 

reasoning is equal to that of qualified reasoning; that their opinion  

matters on every subject regardless of their knowledge (or lack thereof)
  

of it.

> Oh wait, I forgot. Science = Evil. Geeks are losers. Geniuses are al
ways
> trying to take over or destroy the world. Right. Now I got it.

Hell yeah, I'm betting all the negative comments are from Jocks (not you
  

Stephen) who used to shut up Geeks in their lockers and are now petrifie
d  

that they're going to be zapped with Ray-Guns.

> Down with Progress! Back to the Stone Age!

Oh I don't know have you conducted a full H&S assessment on the results 
of  

banging two stones together? It could create a spark that sets the entir
e  

atmosphere aflame; think we'd better return to the Mud Age instead.

-- 

Phil Cook

--
I once tried to be apathetic, but I just couldn't be bothered
http://flipc.blogspot.com

Post a reply to this message

Gail Shaw wrote:
> "Warp" <war### [at] tagpovrayorg> wrote in message
> news:47f6c63b@news.povray.org...
>>   I said in my original post "travelling at almost c towards us".
>> Pretty hard to notice.
>>
> Depends how close to c, and how long it's been travelling towards us. Long
> enough and the red-shifted light and gravitational lensing (maybe) might
> show its presence

And if it were stellar-massed it'd move stars close to its trajectory, 
whose light would reach us slightly beforehand. Although there's not a 
lot we could do about it in either case...

Post a reply to this message