Message Of DAy to users (fwd)

MegaZone (megazone@livingston.com)
Mon, 3 Jun 1996 18:49:07 -0700 (PDT)

Once upon a time Paul Castro. shaped the electrons to say...
>How can we force a page on our own users, overriding wherever they are
>browsing at the time?

You can't - a browser will not accept a page it did not request. HTTP is
a TCP based protocol, so the browser *must* initiate the request. You can
try to force feed HTTPD responses all day and the browser will never accept
them.

>It sounds like a job for Server Push, but what if it was not requested?

Won't work.

>Any ideas out there..?

This has been asked many, many times in the W3C and HWG mailing lists,
as well as the various newsgroups.

They only possibility is to intercept a valid HTTP request from the user,
*spoof* the servers IP, and send a reply.

Which would mean:
1. Sniffing your network for the appropriate packet.
2. Somehow intercepting the request so the *real* server doesn't respond.
3. Causing one of your own servers to spoof the IP and name of the real
server and feed a page with the requested name but your own content.

This is:
A: Sleezy - if my provider did this I'd be gone so fast their lines would
burn.
B: A lot more trouble than it is worth.

And, of course, HTML soon will have the ability to do MD5 signatures on
URLs - try spoofing that.

-MZ

--
Although I work for Livingston Enterprises Technical Support, I alone am
responsible for everything contained herein.  So don't waste my managers'
time bitching to them if you don't like something I've said.  Flame me.
Phone: 800-458-9966  support@livingston.com  <http://www.livingston.com/> 
FAX: 510-426-8951    6920 Koll Center Parkway #220, Pleasanton, CA 94566