I found another interesting avenue for affecting a web application recently when Heather was trying to renew one of her magazine subscriptions. She mentioned that the site was getting a '500 Server Error' and I recognised the e-mail address it was suggesting, so I banged an e-mail off to advise the problem.

Curiously, they weren't able to duplicate the issue while I was still seeing the problem. I did a little fooling around and discovered that I only saw the error when I was making the request through my proxy server.

A little more digging and I ascertained that if I connected to the proxy normally via IPv6 I got the '500 Server Error', but if I instead connected to the proxy via IPv4 it all worked just fine.

Something that has been annoying me recently with my bank has been that their website tells me that they will never ask for my password over the phone. And then their call centre asks me for my password. Over the phone. Of course the call centre doesn't mean my website password - they mean the special 'ultra-secure 5ekr1t code phrase', but they don't have a good, universally understood word to use for that. Hopefully they'll work one out, but they appear to have got the message anyway.

This got me to thinking about how these phrases are used, and how insecure they are in reality. After all when I store a website password I go to significant lengths to ensure that the same password is not represented by the same string of characters in my database. How vulnerable are our secrets in the databases of organisations we do business with?

It is nice to see someone apologising for their planned failure to consider Linux users. It's ridiculous that they even have to. It seems to me that these people have spent way too much effort on making the logo and menus scroll in from the left and right of the screen, and not enought effort on the actual functionality of their website.

I fail to understand what benefit they have gained from using the Pizza UI for their logo & menus (yes, really) rather than using simple links - or CSS-based menus, if they needed fancy. The page layout doesn't actually need anything more than simple text links. The logo (thankfully) does nothing after it's page-load scroll. For extra 'fail' marks they substitute graphics when I initially arrive with Javascript disabled (and wearing my tinfoil hat) but the graphics give me the appearance of a menu without actually performing a useful function.