hrbrtglm

HTTP/2 is not HTTPS-only, the browsers implementations may be.

https://http2.github.io/faq/#does-http2-require-encryption

You mean like Apple taking the name of a primeur business ?

> They handle taxes in all sorts of countries in different states.

And they handle it so poorly that you have to write them to get a proper invoice in order to recover your VAT.

If your customer buy your application through the app store, they ask "you" an invoice with VAT, and you have to tell them to contact Apple, that's so unprofessional. For a 30% cut, they could clearly put a download link or include a PDF in the sent email.

All right, in fact, I think the law you explained is even fair and needed to prosecute some "Joint Criminal Enterprise". But in this specific case, how could it be "incorrectly" argued, "absolutely wrong" and not dismissed by a judge. I mean, how can you trust the justice if only the poor chap is the one going to jail. Yeah, I'm naive, I know.

So this guy was jailed because he coded an advertising platform and a video hosting service. I know Mega was on a thin shady line, but what has he done wrong to be jailed in USA ?

For me, it's all about the details, and I just can't come back to Firefox for silly reasons, even if I appreciate their stance on privacy.

The tabs shape is repulsing me, I know that's a strong feeling and I can't explain it. The disymetrical back and forward buttons bothers me as well. I can't find how to whitelist domains accepting cookies in Firefox. Switching profiles is much easier with chrome. I'm used to chrome developper tools.

I don't like neither safari neither MS edge.

If it wasn't for the missing onenote extension, maybe I'd be using opera. Again, all about the details.

I'm not sure as there's no description, so I'll ask. That's the desktop version, not the server one ?

Great. You just inspired another european privacy law where website will be forced to ask you to read the terms before processing reading. What it will achieve is users will be annoyed and install a termblock extension to their browser, I mean kind of defensive software.

As the primary goal is to listen to the music, I do really appreciate the fact that the webpage stops its graphics animations when it loses the focus.

It is great to improve my focus as I am not disturbed by my waving cpu meter.

Great work, love it.

In France, it depends where you live, in some area people do it up to 4-5 times. It can be quite disturbing, even for a french :)

> hm, someone should make a simple web app that gathers names and styles of fonts and provides a zip w/ pre-generated CSS

I used http://www.localfont.com to retrieve the Open Sans font I was previously using from google font. Maybe that's the kind of webapp you are looking for.

Flash is essential for harmony of your twosome life if you share your computer with your girlfriend who plays facebook games.

As far as I understand the issue, I think that's only true as domestic sales are concerned. Like you, UK to UK. But if you are from another european country, even under your own country thresholds, you have to apply UK sales tax if the UK customer is not VAT registered.

Thanks for the tip :)

It seems allright if you are doing all the duty procedures as well.

Do you verify the given VAT number to be legit and matching through the VIES system : http://ec.europa.eu/taxation_customs/vies/

Do you keep track of the 2 non contradictory proofs of the receiving country end ? Article 24d : http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELE... Do you keep this localisation proofs for the 10 mandated years ? Can you prove this saved data have not been tampered ? Do you have an audit log on this data ? Do you comply with directive 95/46/CE for the protection and treatment of this data ?

Hopefully for you, you are only dealing with VAT registered corporates, so you are on the easy side. Now imagine the nightmare if you are for example selling e-books or saas or traditional software to VAT / non VAT registered corporates and individuals wolrdwide. It's not so easy anymore.

@Mithaldu

I think, we reached the end of the thread, I can't reply to you. So, sorry for the messed reply.

I'd like to ask more questions. Are your french customers corporates or individuals ? If corporate, do they have a VAT intra-community number, do you have one ? Are you billing VAT in Germany ? As I'm french, could you give me this not stating they are without VAT due to specific french laws.

Beware, I don't know if the situation is the same in germany, but in France you have no recourse if your accountant is wrong, the burden is on you.

I'm afraid many people think "they don't even need to think about it", but are actually wrong. (Not I'm saying it's your case, but here even the tax office is not really sure how to deal with it, the only one who seems to know is the one giving fines, and he's not an adviser, just an inspector ...)

> since on my end nothing has changed at all.

If nothing changed at all, you may be doing it wrong.

Which country are you billing from, which european countries are you selling to ? Are you selling a single product/services, several with each different tax rates ? How do you know which VAT rates you have to apply, are you vatmoss registered ?

It's a difficult subject, I'm really surprised it seems so easy for you (or anybody else)

> I did not mean to imply that it was 5 days

My comment was supposed to be an addendum but I failed by nitpicking and questioning your interpretation. I'm sorry.

As a security researcher, may I ask you these questions:

Which channel are you using as a first contact ? Would it be enough for me as a saas supplier to monitor security@myservice.com ? I must admit I'm bit afraid by a cleartext channel for this kind of disclosure. Would you have some recommandations for the receiving part of the vulnerability ?

Thank you for the link of the policy, it seems to be a fair one.

I just read it and it looks like you are misinterpreting it.

> then give them 5 days to respond > they may want to "negotiate" more than 5 days to fix the issue

"5 working days" is not the same at all than "5 days", think of public holidays and week ends ...

I don't think that's a relevant comparison. You can be sure that when cars, airplanes and industrial plant have available access through internet, they will be powned as well and there will be accidents.

Thank you.

So I imagine, given their specifications, they had to give each tenant its own full PG database. I understand they have strong business logics but it does not seem very efficient. Salesforce is known to use a single oracle instance for all its tenants and I don't think their business logics is less demanding.

Giving an administrator or elevated role to the tenant connection looks like a really bad idea from the start, especially if the tenant instance is not sandboxed in a container or virtual server.

But this things are hard and a small mistake can have big consequences.

Well, that's really interesting for all of us who work with multi-tenant webapp.

Maybe you took some notes.

Could you share some more info if you are free to disclose how you poked with the connection pool. I haven't look at OpenERP sources, but I think the database in use is PostgreSQL.

> "for a user of one database to access other database"

Were OpenERP using a database for each tenant or 1 database with multiple schemas ? In case it was the former case, were all databases accessed with the same credentials ? Which connection pool was it ? Pgpool / Pgbouncer ? Where was the vulnerability, code, db, pool, config setup ?

Sorry for all this questions, I'm indeed very interested and involved in this topic.

Not allowing to run servers from home is especially vague. So it's not like if only port 25 is blocked

Are you allowed to run a game server, ftp server, web server, ssh server ?

Words first mean what is written in a dictionary or encyclopedia.

Internet : https://en.wikipedia.org/wiki/Internet

If you are not allowed to run server, they are WSP (Web Service Provider) not ISP.

But if you are OK with ISP not providing internet, I'm sure you are fine with unlimited limited or throttled after x, 24/24 access between 9-5 and secured http page as long as there is a padlock favicon ...

I'm fine with that, but then it is not an ISP.

So your ISP is not providing you an internet access ? That's lame.

The courier service vector is an effective way to trick people.

You can ring an intercom in any big apartments block and ask to be opened the door to deliver whatever, most of the time you'll find a resident to open. No reason for it to not work in emails :)

Not related to mail fishing as javascript is filtered (disabled) for emails, but more with browsers ...

I'm a nitpicker but that's one of the reason why i dislike safari browser. You need the status bar enabled in order to see the links destination url and I don't like the 7 pixels height taken by this bar.

But as I am browsing with javascript enabled, I can't be sure that the url showed by the link is the destination I'll be sent to. That's something quite hard to explain to non technical people (like my parents). I'm not even trying to be honest. I'm not sure what to think about this behavior and generally with link shortener, it's an easy way to phish people in forum, comments, ...

And the shortened link still works for emails.

How do you send your emails ?

If your customer is using google domains, microsoft 365 or what else, and the employees do not fall in your phishing attempt and report your mail as spam, you may be heading for some trouble with delivery afterward.

I find it amusing that you are opposing on one side a population and on another a country.

So let me rephrase it for you : France will pretend to be upset ... It's part of the game.

As a french, I just don't give a s US spying our officials, I'm much more worried any foreign secret service achieving it. It just shows how much our defense and digital security is weak. If I'm angry, it's towards our own services which can't prevent this kind of stuff.

Thanks a lot,

I did not know chrome had this setting option, or I view it but did not really realize what it was for. I'm glad you took some time to list the needed steps.

Minor correction, depends on the eu countries, but in France, the authors tax charged on copy mediums is in addition to the product price without VAT, and then VAT is applied to the whole. So you pay VAT on the authors tax. To be clear you pay tax on tax, a french speciality.