![]() |
2010-07-07
, 20:01
|
|
Posts: 210 |
Thanked: 178 times |
Joined on Jan 2010
|
#891
|
![]() |
2010-07-09
, 02:40
|
Posts: 107 |
Thanked: 4 times |
Joined on Jun 2010
|
#892
|
![]() |
2010-07-09
, 03:05
|
Posts: 466 |
Thanked: 418 times |
Joined on Jan 2010
|
#893
|
The Following User Says Thank You to slaapliedje For This Useful Post: | ||
![]() |
2010-07-09
, 04:41
|
Posts: 136 |
Thanked: 47 times |
Joined on Apr 2010
@ SF East Bay, Cali
|
#894
|
![]() |
2010-07-09
, 05:40
|
|
Posts: 306 |
Thanked: 350 times |
Joined on Oct 2009
@ Sydney
|
#895
|
Someone correct me if I'm wrong, but it depends on the developer of the site. A site developer can include code their site so that it checks for the version of the flash player the user is using and decide whether to allow them to view the Flash content or not.
The Following User Says Thank You to H3llb0und For This Useful Post: | ||
|
2010-07-09
, 05:50
|
Guest |
Posts: n/a |
Thanked: 0 times |
Joined on
|
#896
|
Someone correct me if I'm wrong, but it depends on the developer of the site. A site developer can include code their site so that it checks for the version of the flash player the user is using and decide whether to allow them to view the Flash content or not.
![]() |
2010-07-09
, 17:55
|
Posts: 670 |
Thanked: 367 times |
Joined on Mar 2009
|
#898
|
![]() |
2010-07-10
, 01:34
|
|
Posts: 4,930 |
Thanked: 2,272 times |
Joined on Oct 2007
|
#900
|
Due to a state requirement of N hours instruction for a "certified driver education program", each lesson page had a JS countdown timer before it would make the link for the next page visible. As I read faster than average, I had time to look over the source while I was waiting, and about two pages in got curious enough to try the link before time-out... and it worked, whereas I'd expected it to (leniently) redirect me to the original page, or possibly restart the whole chapter as a disincentive to tampering.There's a saying "never trust the client", which that on-line testing company utterly disregarded -- they just assumed nobody could/would tamper with the execution of javascript in their browser. And that makes me wonder how much the appeal of Flash is that it saves the developer from having to dodge all those pitfalls, since nobody could/would tamper with the execution of actionscript in their flash plugin.
So, I merrily skipped through with no more timeouts. When it came to the quizzes, I had to wonder -- they couldn't be doing that client-side, too, could they? Turns out, they actually didn't, not quite. The quizzes were fairly straightforward forms, which the server checked and generated a score page.
But the test page itself was dynamically generated with randomized questions from a pool; obviously, they couldn't apply a simple "ADBBC..." answer key, but needed some way to keep track of which answer was correct for each question in that test. They cleverly solved this challenge by dropping a "question list" hidden field in the generated test page, and the server would verify that the radio-button selected for each question matched the answer-key for the corresponding question, according to the list submitted by the client.
A likely vulnerability, of course, but not real bad, yet -- surely it'd throw out obviously-faked question-lists, so until you'd been through it once and sold an answer-key, not much use... then I saw a quiz where it randomly selected the same question twice.
Having a hard time believing it, and a decent web browser, I edited the page to fill the question list with the first entry, and checked the same answer (the correct one for the first question, obviously) to every question -- and got a perfect score! Basically, it'll let you gamble as many questions as you like on one you know the answer for. I played the rest of the questions by the book (trust me, I didn't need to cheat -- my problem was with not caring how fast I drove on open roads, not on driving drunk, road rage, not knowing the rules of the road, or the dozen other things they tried to teach me -- and it was faster and easier to play it straight), but was left, frankly, flabbergasted by how sloppy they were.
The Following 2 Users Say Thank You to Benson For This Useful Post: | ||
![]() |
Tags |
adobe, adobe flash, blahblah, flash, flash 10, flash 10.1, fremantle, future, idiotic thread, maemo, maemo 5, nokia, nokia fails, update |
|