jenoer

> The results from our mouse study certainly cannot be transferred one-to-one to humans, but studying the effects of maternal overnutrition is almost impossible to do in people..

I don't want to be that guy, but shouldn't this article be named "For Mice, High Fat Diet May Affect* Offspring"?

I think most visitors, like myself, visit a lot of these posted links to read up on the project/end-result, out of curiosity and for expanding my knowledge on various subjects.

This article has been posted 4 hours too early.

You are correct, it's called "fractional reserve banking". It's not a standard 'x10' though, since it's based on rules from federal banks etc.

Rapid succession button clicking usually combines many different tests:

- Performance

- Usability

- Brute-force capabilities

- Error handling

- And in this case, Security, a bug where trying to log in a couple of times on the Login screen with an empty, or set, password.

A test scenario closer to this would be:

---

When I am on the login screen

And I enter 'root' in the 'Username' field

And I enter 'thispasswordisfalse' in the 'Password' field

And I press the 'Login' button '10' times

Then I should see the text 'Your password is invalid'

---

Please note that this issue is not just in the Settings page, it takes place on the login screen as well, that's why I'm shocked, it's such a core functionality, touching so many system components.

As a Tester myself, I cannot understand why this is not covered by either unit tests or behavioral tests. Clicking dialog buttons in rapid succession is what we (should) do once in a while. Especially in core functionalities such as the login screen. It's one of the first screens you see as a tester. And you have default usernames, be it enabled or not.

For example, I do not own an iPhone, but at work, I made a bet with my colleague (jokingly) that I could break _something_ on his phone in a few minutes.

I did not have his finger print or pin-code, so I was very limited, I even joked "I don't need that, give it here!"

Finding out I only had a hand full of options, I focused on the emergency dialer. As any good tester would be curious about, I wanted to check the max field length, so I entered digits, copy/paste it a few times, copy/paste that string, ("wait, no limit? Not even at 1000? why?") and so on, until I noticed the interface became laggy, so of course, I kept going.

Boom, suddenly back at the login screen, tried to open the emergency dialer, but got a full blank white screen, in the meantime the phone started heating up substantially. Since it was a new Phone (iPhone 7 with iOS 10.x I believe) and the dev getting nervous, we decided to reboot it. That fixed the issue. (Curious if this is still an issue in iOS 11.x)

TL;DR: As a tester this simple curiosity should be in your blood, and especially covered in behavioral tests when your software has been around for 5+ years.

Various articles, blog posts etc. about this have already been posted to HN.

One of these inspired me to make a Firefox add-on that solves this issue: https://addons.mozilla.org/en-US/firefox/addon/dont-touch-my... [/plug]

Agreed. In a hostage situation you'd expect someone to gather intelligence of the situation before entering the building the hostages are claimed to be in.

For example, heat cameras could be used to make a map of the room and the situation in it.

When I polished the extension with a custom Icon, I went to the Chrome Store with a big smile on my face, it asked me to set up settings, let me set up a custom icon, forced me to think of a good informational text, and at the "moment supreme" of hitting the Publish button it asked me for a credit card. Luckily Mozilla returned that smile and had a suprisingly fast review-proces, it only took around 12 hours I think.

Anyway, now I can first see how popular it will be on Firefox before I decide to try find a 'throw away' credit card.

That's a very good point, thanks for sharing!

I will take a look into this because this sounds very interesting. I am new to "this" though, so it will take me some time to figure out how to implement this into, perhaps, a v2.0, but I'm surely taking up the challenge to learn more about this, so thank you for the tip!

Unfortunately not. Once you set everything up to Publish the extension and hit the Publish button, Google informs you need to pay a 5 USD developer registration fee (using Google Payments) which allows you to publish up to 20 items.

Edit: They claim this is "to check the legitimacy of the accounts of the developer to ensure users are protected against fraud." (paraphrasing slighty)

It's not perfect yet since it uses jQuery instead of pure JavaScript, but: This is my first (tiny) project in over a year. I was inspired by a HN post I saw some weeks ago and thought I'd share this with others since I'm quite proud of how well it's working.

This also gave me the inspiration of focussing on learning how to code. This will be a very useful skill since I'm a software tester for a PHP (and JavaScript) based web application.

(I am yet to add it to the Chrome Extensions, but Google asks 5$ which isn't a lot, but they only allow Credit Card, so this will be on hold until I aquire one.)

Perhaps a silly question as I do not have a lot of experience with software like this, but:

What prevents Lastpass, bitwarden or any other third-party to update their software (and/or compromise the download server) to synchronize all information un-encrypted in a new version which is auto-updated by the user?

I currently use KeePassX, and synchronize this file with a secure server myself since I feel uncomfortable with having software that handles the encryption also controlling the synchronizing service.

My fiancé is from Taiwan and recently moved in with me in Europe. I've been there a couple of times and can not agree more with what you say! We want to live a couple of years together in my country and eventually switch to Taiwan once I feel comfortable with leaving my family and current life behind (and when she has (western) working experience & study that will grant her instant "You worked/studied in the west? Take our money!" privileges) We will live like king and queen together!

In the Netherlands road flares are not allowed. Only police or rescue-workers are allowed to use these in only certain situations.

Here, when accidents like these occur, our automated road information system directly displays how fast you may drive there (it has sensors to monitor traffic speed). And, within minutes, a traffic monitoring group will close down the affected roads fully and signal to which lanes people have to switch to by using arrows pointing towards the lane next to it.

The system looks like the following, and is placed on almost every highway here: https://upload.wikimedia.org/wikipedia/commons/8/88/Amsterda...

I also managed to execute JavaScript by adding <img src=x onerror=alert(1337)> to my blade description, it seems to run on the home-page or here: https://ftp.googleblade.com/jenoer

Edit: Unfortunately I have to go to bed, if I find anything else tomorrow I'll drop you an e-mail.

I suggest you blacklist a few more subdomain requests, for example, I took ftp.googleblade.com, api., smtp. and could take a few others which could disrupt future expansions on this project.