People don’t understand. Even IF (big if) software could be written, developed and implemented to allow FReepers only to view...
I’ll go even further.... Even IF (big if) software could be written, developed and implemented to allow ONE THIRD OF ALL FReepers only to view...
This place will be a parking lot tomorrow night.
(IMHO)
It doesn’t require new software to be written. I write .net software applications and .aspx and the implentation of what this post was asking is does NOT require a major undertaking; in fact, it’s very easy to do.
The authentication layer is already written. It's the login and cookie structure JohnRob already has in play. What we would do is the AUTHORIZATION layer, which is a lot easier if all you are doing is granting access to pages. I've never 'had it that easy', I've always had to have RBAC (Rules-Based Access Control) down to the control- and menu-item level.
I won't claim it to be a five-minute fix, but it is a lot easier than it first struck me.
By the way, during my thinkwalk, I actually thought of a series of security holes that I bet JohnRob didn't think to plug, based on his authentication method. If he's not using SessionID on every page, he's vulnerable to a variety of spoofs and CSRF 'confused teller' attacks. Not a big deal, because the attacker would need to know A) which internet user was logged into FR to begin with, and B) the payoff is small, unless they happen to luck upon the session with Admin Mod, JimRob or JohnRob. So what if they hijack Laz's screen name, for example. All that would happen is Laz might not hit it for one day.
The authentication layer is already written. It's the login and cookie structure JohnRob already has in play. What we would do is the AUTHORIZATION layer, which is a lot easier if all you are doing is granting access to pages. I've never 'had it that easy', I've always had to have RBAC (Rules-Based Access Control) down to the control- and menu-item level.
I won't claim it to be a five-minute fix, but it is a lot easier than it first struck me.
By the way, during my thinkwalk, I actually thought of a series of security holes that I bet JohnRob didn't think to plug, based on his authentication method. If he's not using SessionID on every page, he's vulnerable to a variety of spoofs and CSRF 'confused teller' attacks. Not a big deal, because the attacker would need to know A) which internet user was logged into FR to begin with, and B) the payoff is small, unless they happen to luck upon the session with Admin Mod, JimRob or JohnRob. So what if they hijack Laz's screen name, for example. All that would happen is Laz might not hit it for one day.