toy - Dave's Blog

Search

Retweet of AnnaNowo

2015 Nov 18, 7:03
Best. URL. Ever. pic.twitter.com/xGc4D9bIpQ
PermalinkComments

Tweet from David_Risney

2015 Mar 2, 1:12
Finished re-watching Galaxy Quest: still awesome. For how long did I mistakenly attribute "Never give up, never surrender" to Toy Story?
PermalinkComments

David_Risney: Egg toy unboxing youtube videos made millions via advertising. My 3yo is already ahead of me on what's hip.

2015 Jan 20, 9:08
David Risney @David_Risney :
Egg toy unboxing youtube videos made millions via advertising. My 3yo is already ahead of me on what's hip. http://finance.yahoo.com/news/youtube-s-highest-paid-star-is-a-woman-who-unboxes-disney-toys-062606350.html …
PermalinkComments

laughingsquid: Two-Year-Old Picks the Lock to His Sister’s Room...

2013 Mar 28, 3:30


laughingsquid:

Two-Year-Old Picks the Lock to His Sister’s Room and Steals Her Toys

PermalinkCommentshumor child video

Stripe CTF - Level 5

2012 Sep 11, 5:00

Level 5 of the Stripe CTF revolved around a design issue in an OpenID like protocol.

Code

    def authenticated?(body)
body =~ /[^\w]AUTHENTICATED[^\w]*$/
end

...

if authenticated?(body)
session[:auth_user] = username
session[:auth_host] = host
return "Remote server responded with: #{body}." \
" Authenticated as #{username}@#{host}!"

Issue

This level is an implementation of a federated identity protocol. You give it an endpoint URI and a username and password, it posts the username and password to the endpoint URI, and if the response is 'AUTHENTICATED' then access is allowed. It is easy to be authenticated on a server you control, but this level requires you to authenticate from the server running the level. This level only talks to stripe CTF servers so the first step is to upload a document to the level 2 server containing the text 'AUTHENTICATED' and we can now authenticate on a level 2 server. Notice that the level 5 server will dump out the content of the endpoint URI and that the regexp it uses to detect the text 'AUTHENTICATED' can match on that dump. Accordingly I uploaded an authenticated file to

https://level02-2.stripe-ctf.com/user-ajvivlehdt/uploads/authenticated
Using that as my endpoint URI means authenticating as level 2. I can then choose the following endpoint URI to authenticate as level 5.
https://level05-1.stripe-ctf.com/user-qtoyekwrod/?pingback=https%3A%2F%2Flevel02-2.stripe-ctf.com%2Fuser-ajvivlehdt%2Fuploads%2Fauthenticated&username=a&password=a
Navigating to that URI results in the level 5 server telling me I'm authenticated as level 2 and lists the text of the level 2 file 'AUTHENTICATED'. Feeding this back into the level 5 server as my endpoint URI means level 5 seeing 'AUTHENTICATED' coming back from a level 5 URI.

Notes

I didn't see any particular code review red flags, really the issue here is that the regular expression testing for 'AUTHENTICATED' is too permisive and the protocol itself doesn't do enough. The protocol requires only a set piece of common literal text to be returned which makes it easy for a server to accidentally fall into authenticating. Having the endpoint URI have to return variable text based on the input would make it much harder for a server to accidentally authenticate.

PermalinkCommentsinternet openid security stripe-ctf technical web

laughingsquid: Back to the Future Time Circuit Replica I would...

2012 Jul 3, 2:38


laughingsquid:

Back to the Future Time Circuit Replica

I would love this as a clock.

PermalinkCommentsback-to-the-future bttf toy diy

Free Universal Construction Kit is a set of 3D models you can...

2012 Mar 19, 4:05


Free Universal Construction Kit is a set of 3D models you can print on a 3D printer that allow you to connect Lego to Duplo to Lincoln Logs, etc.

PermalinkCommentstoy video 3d-printer

Marvel lawyers insist mutants aren't humans

2011 Dec 30, 1:41

‘to avoid getting taxed as “dolls,” rather than lower for “toys”’

PermalinkCommentshumor xmen toys legal

Fred's Home

2010 May 10, 10:32Thanks to Matt -- this looks like another great site full of gifts for folks that I otherwise wouldn't know what to get...
PermalinkCommentsgift wishlist humor toy geek via:swannman

Just Add Johansson

2009 Dec 16, 9:41"This sort of model should remind you of 1-piece click-out toys packaged with action figures such as Teenage Mutant Ninja Turtles. Michael Johansson specializes in parodying this particular moment in toydom by creating life-sized models with that molded-plastic “break-apart and play” action specifically in mind."
PermalinkCommentsart sculpture design product commodity parody

Kid Robot’s QR Code Scavenger Hunt - PSFK

2009 Sep 1, 4:59"...toy and apparel designers Kid Robot (with the help of creative ideas studio We Are Plus) have organized a mobile phone-based scavenger hunt in Manhattan centered around scanning QR codes."PermalinkCommentsqrcode phone scavenger-hunt toy advertising

Solar Wi-Fi Flowers Create Harmony Between Man, Nature And Machine - The Design blog

2009 Jul 23, 10:32Toyota's 3rd gen Prius ad. campaign features giant solar powered flowers that seat ten, provide free wi-fi and power, and will be placed outdoors in major cities across the US.
PermalinkCommentswifi power prius solar advertising toyota

Bloody Xmas: Macabre Plush Toys Are Perfect Xmas Gift for Future Psychokillers

2008 Dec 29, 12:06Too bad I missed these before Christmas: "Why buy a stupid Elmo when you can permanently disturb that young mind with a cute knitted plush rabbit killed with a giant carrot? Or a beautiful tiger eating some human remains? I love these."PermalinkCommentshumor death macabre stuffed-animals toy gizmodo via:jen-johnston gift

Marienplatz and the Deutsches Museum

2008 Dec 19, 12:18

Church Tower in MarienplatzOn Monday in Germany we went to Marienplatz and wandered around the Christmas Market, some of the stores, had drinks in a little pub, visited the Toy Museum, and checked out an impressive looking church. We accidentally drew in some other tourists as we stood gaping at the Glockenspiel tower waiting for the little show to begin at the wrong hour. That night Megan and Oliver came by our hotel and took us out to a traditional Bavarian restaurant and brewery that had been brewing beer there for hundreds of years. It was fun although we may have kept Megan and Oliver out too late on a weeknight.

Deutsches MuseumThe next day we went to the Deutsches Museum the largest science and technology museum in the world. And indeed it is very large, six floors on a large grounds. I needed to better pace myself: I spent too much energy being interested in the engineering sections with steam engines, mining, aerospace etc. I was completely worn out by the time we got to physics, chemistry, etc. etc. and we didn't even look in the natural sciences section. Anyway, its very large. That night we ate with Jon at an Italian restaurant. During the meal two period dressed children came in and began singing then tried to shake down their captive audience in the restaurant asking for money. The man at the table next to us asked one of the children what charity the money was going towards, the child said they kept the money, and the man said never mind then and sent the child away.

PermalinkCommentsgermany personal vacation nontechnical

A Young Mad Scientist's First Alphabet Blocks | Xylocopa

2008 Dec 17, 2:27"Specifically, we have noticed that there is absolutely no training in the K-6 grades that prepares students to become mad scientists. In this competitive 21st-century world, the need for mad scientists will only increase... We are pleased to announce the release of our Young Mad Scientist's First Alphabet Blocks."PermalinkCommentshumor science geek gift via:swannman shopping wishlist toy alphabet-blocks

Teddy Bears in School from Toy Museum

2008 Dec 14, 10:32

sequelguy posted a photo:

Teddy Bears in School from Toy Museum

PermalinkCommentsgermany munich marienplatz

Marienplatz Square seen from Toy Museum

2008 Dec 14, 10:32

sequelguy posted a photo:

Marienplatz Square seen from Toy Museum

PermalinkCommentsgermany munich marienplatz

Party Movies Recommended by Netflix

2008 Sep 18, 10:31
Poster for 24 Hour Party PeoplePoster for Human TrafficPoster for The Boys and Girls Guide to Getting Down

Netflix has recommended three party movies over my time with Netflix and if you're OK with movies featuring sex, drugs, rock&roll (or techno) as almost the main character then I can recommend at least The Boys and Girls Guide to Getting Down.

24 Hour Party People is based on the true story of Tony Wilson, journalist, band manager, and club owner (not all at once) around the rise of punk and new wave in England. Like many true-story based movies it starts off strong and very interesting but gets very slow at the end like the writers got bored and just started copying the actual events. Unless you have some interest in the history of music in the 80s in Manchester I don't recommend this movie.

Human Traffic is fun and funny following a group of friends going out for a night of clubbing and partying. I had to get over seeing John Simm as not The Master from Doctor Who but rather as a partying youth. It felt like it was geared towards viewers who were on something like the totally odd techno musical interludes with the characters dancing for no apparent reason. Otherwise the movie was good.

The Boys and Girls Guide to Getting Down is done in the style of an old educational movie on the topic of clubbing and partying. It sounds like a premise that would get old but they do a good job. While demonstrating drinking and driving they have scientists push a mouse around in a toy convertible. Enough said. It was funny and I recommend it.

PermalinkCommentsparty movie netflix

Neil Fraser: News: Wooden Brain

2008 Sep 8, 6:51Neil prints out brain cross sections from an MRI and pastes them onto a set of wooden cubes forming a model of his brain. "Last month I took a left-right MRI scan, reconstructed it, and rerendered top-bottom and front-back scans... Another method to visualize a complex 3D object is to build a model. The dimensions of the MRI data cuboid are almost exactly 3x4x5. Accordingly, I obtained 60 one-inch cubes ... arranged them appropriately, varnished the 94 outside faces, printed nine carefully selected cross-sections and their mirror images, sliced the prints into 266 squares and glued them to the correct internal faces."PermalinkCommentsart design brain toy model wood

Cadbury Hits Fireplace Shovel

2008 Sep 1, 4:45
Cadbury jumps out of her toy box hitting the fireplace shovel, and does a few other cute things.
From: David Risney
Views: 76
1 ratings
Time: 00:44 More in Pets & Animals
PermalinkCommentsvideo
Older Entries Creative Commons License Some rights reserved.