Wikipedia:Reference desk/Computing

Welcome to the computing section
of the Wikipedia reference desk.

skip to bottom

Select a section:

• Computing
• Entertainment
• Humanities
• Language
• Mathematics
• Science
• Miscellaneous
• Archives

Want a faster answer?

Main page: Help searching Wikipedia

   

How can I get my question answered?

• Select the section of the desk that best fits the general topic of your question (see the navigation column to the right).
• Post your question to only one section, providing a short header that gives the topic of your question.
• Type '~~~~' (that is, four tilde characters) at the end – this signs and dates your contribution so we know who wrote what and when.
• Don't post personal contact information – it will be removed. Any answers will be provided here.
• Please be as specific as possible, and include all relevant context – the usefulness of answers may depend on the context.
• Note:
  • We don't answer (and may remove) questions that require medical diagnosis or legal advice.
  • We don't answer requests for opinions, predictions or debate.
  • We don't do your homework for you, though we'll help you past the stuck point.
  • We don't conduct original research or provide a free source of ideas, but we'll help you find information you need.

Ready? Ask a new question!

How do I answer a question?

Main page: Wikipedia:Reference desk/Guidelines

• The best answers address the question directly, and back up facts with wikilinks and links to sources. Do not edit others' comments and do not give any medical or legal advice.

See also:

• Teahouse
• Help desk
• Village pump
• Help manual

October 24

Should picture URLs include file extensions?

I've written a web application using HTML, CSS, JavaScript, Node.js and Express. I'm looking for advice on URL design for pictures in my application.

Currently, the implementation works as follows:

• backend generates SVG avatars for given IDs and converts uploaded images to WebP
• backend generates picture URLs: /avatar/{id}.svg for automatically generated avatars and /media/{id}.webp for user-uploaded images
• server.js defines the corresponding routes: /avatar/:id.svg and /media/:id.webp
• the file format is already unambiguous from the endpoint and its implementation, even without an extension: /avatar/{id} would still refer to an SVG generated by the avatar handler, while /media/{id} would refer to a WebP image served by the media handler, and the server can communicate the actual format through the HTTP Content-Type header

Would you recommend keeping file extensions in these URLs or switching to extensionless, format-independent URLs? ~2026-56849-00 (talk) 22:24, 24 October 2026 (UTC)

I'd keep the file extensions. The format may be unambiguous given the URL, but when downloaded, the disambiguating path segment is stripped off of the file name.  ​‑‑Lambiam 08:00, 27 October 2026 (UTC)

October 29

https

How to http: and https: relate these days?

If a server prefers https, and I follow a link that has http:, the server will (always?) substitute https:. But what about the reverse? Not all websites have made the change. Will a http site do the right thing with a https: address? —Antonissimo (talk) 03:37, 29 October 2026 (UTC)

See Transport Layer Security (TLS). This is the underlying tech that maintains privacy for the communication between a user's computer and the server. While some servers are configured to allow unencrypted (plain http) mode as fallback, doing so has security implications: this would make a man-in-the-middle attack feasible. For example, attacker eavesdropping on a user's connection half-way, taking the HTTPS request packet, and do something to it to make it fail to force a fallback to plain HTTP. 海盐沙冰 _{/ aka irisChronomia / Talk / Uploads} 05:29, 29 October 2026 (UTC)

The automated upgrade from http: to https: may be due to your browser, rather than the server.  ​‑‑Lambiam 08:21, 29 October 2026 (UTC)

It can also be in a router and corporate packet inspection. From the browser to the web server, there is long-standing history of automatically converting http traffic to https without asking the user.

But, I wanted to answer the question about how they relate. If you use http, your web request is unencrypted in transit. If you use https, your web request (the same request you made in http) is encrypted in transit. The standard format of encryption is TLS. What is important here is not that it is encrypted from your computer to the server. It is encrypted from your web browser to the web service running on the web server.

I also wanted to respond to the statement that not all website have made the change. That is true. It is expensive to implement https because you need a secure certificate on the server. You either pay in money or time. For around $1000, you can easily purchase a certificate that lasts years. For $0, you can spend hours fiddling with cryptic broken websites to try and get a certificate that lasts a few months and then you have to start over again, trying to run through the maze of more broken links, broken forms, and broken instructions... and tons of advertising that covers up that one button you were supposed to click five screens ago. Therefore, if you don't feel you need encryption on your website, why deal with it? ~2026-46630-01 (talk) 11:50, 29 October 2026 (UTC)

October 31

Diagram explaining PHP2Shell

Would https://www.akamai.com/blog/security-research/understanding-php2shell-everything-you-need-to-know and https://outcomeschool.com/blog/php2shell be considered reputable sources if I wish to draw a diagram explaining how PHP2Shell works, in a similar style to this explanation for Heartbleed? cmɢʟee τaʟκ (please add {{ping|cmglee}} to your reply) 00:13, 31 October 2026 (UTC)

Akamai Technologies is a reputable company with long-standing expertise in the area of cybersecurity, so I think it can be considered a reliable source. I have no reason to doubt the accuracy of the explanation on the website of Outcome School by its founder, Amit Shekhar, a graduate of IIT (BHU) Varanasi. This school is a prestigious engineering institution, but I do not have evidence that Amit Shekhar has specific cybersecurity expertise, so it is less clear that this page can be considered a "reliable source" in the specific Wikipedia sense. As it aims at a more general public, it may still be a valuable resource in understanding the more detailed technical explanation on Akamai's security blog and condensing it to a simple diagram. CVE-2026-109619 is essentially a dangling pointer issue, so the (static) diagram in the article Dangling pointer may, perhaps, also be a source of inspiration.  ​‑‑Lambiam 11:53, 31 October 2026 (UTC)

I have thought about this because I've had to explain the PHP2Shell bug. The issue is that most people don't have a good feel for how the server handles multiple requests. So, the explanation is a lot of handwaving. What you really need is a non-computer scenario where an order is placed in a slot of some kind and that order is marked active/inactive. Under normal conditions, the order comes in. It gets marked active. The order is completed. It gets marked inactive. The slot is cleared. The PHP2Shell scenario is an order comes in. The slot is marked active. The order fails and the slot is cleared (this is the bug: the slot should be marked inactive as well). Then, an order for something you shouldn't be allowed to order is put into that slot. It is active, so the order is completed, the slot is marked inactive, and the slot is cleared. What is expected is that the illegal order comes in, the slot is checked, it is illegal, blocked. But, because the previous failed order left the slot active, the illegal order is assumed to have been checked. In my mind, I think it can relate to a diner run by simplistic robots following command loops. A customer orders 999 hamburgers. It fails. The customer orders $200 and the order is fulfilled. ~2026-46630-01 (talk) 14:05, 2 November 2026 (UTC)