Google Maps and Blitzortung

    I have developed an addon to the blitzortung maps, which gives you information via Google Maps down to the lowest zoom, and you have the posibility to mark the variance with a circle, which will cover the potential strike area.

    It works with the usage of two modules, - and it does not require any programming.

    I was asked by Egon to make sure that the data could not be spoofed from the server, which means that it demands a Password to enter it.

    You can see it live on my site, which is http://www.tordenvejr.nu/torden.php

    The modules can be in either PHP or ASP, in case you do not have PHP on your server.

    Currently 6 stations in Denmark is using this feature.

    A further description in "poor" Germain can be seen here , and in English here by clicking on the flag in the top bar, whereafter the text chances to English, and when pressing download, it will give you the text in English

    You can see an implementation on another site here , and yet another site here

    As I have free hosting on this, the mentioned yearly fee, is not valid, as long as I do not have to pay for the hosting.

    Kind regards,

    Per

    Tordenvejr.nu

    2 Mal editiert, zuletzt von Esor (20. Mai 2011 um 08:58)

    Hi,

    not bad, but some important notes/questions:

    1. The password doesn't make sense, because everybody can see it in your url (http://oelstykke-vejr.dk/TordenStrikes-…r&Password=jklw...)

    2. The file with the raw lightning () is also available to everyone. Though the filename changes from time to time it is easy to recalculate it and so it is accessible to everyone. It could be easily read by programs. I don't think, that this is allowed.

    3. Your parameters are not filtered: Click here for an example ;)

    I've seen another station with that addon and the same issues.

    I am the developer of MyBlitzortung and I am using tiles for the strike maps (not the raw data) to avoid this problem. Otherwise, it wouldn't be possible to hide the raw data from non-members. In your case, Google makes the tiles for you, but also Google needs access to the raw data on your website. The only way to correct this, is to disallow access to the kmz-file except for the Google servers. Perhaps this might work in your case.

    Greetings
    Tobi

    You are partly right, but the KMZ file changes number every 12 hours, and it is generated randomly, at the same time there is a check that no one collects the data as this is registered in a controlprogram, which will stop sending data if any suspection of spoofing.

    So an automatic program cannot be made, it will have to be changed at least once every 24 hours, and if a station starts to download data every minute,whitch is not allowed it will be blocked. - this is possible, as only the above program is running on the decicaded server, which is the one your your nice example of my lack of filtering is calling.

    Also I can see the calling station, and if the station calling is not authorized, It will be blocked immediately.

    This is handled by the PHP program, and a Statistic program running on the server.

    Also the change of filename can be every minute if necessary, but for practical reason I initially choose to do it every 24 hours.

    Concerning filtering, I will fix that - something I was not aware off.

    How did you manage to get the password info, as this is stored in a PHP file, and thus should not be accessable as far as I know?

    The benefit of letting Google do the KMZ, is that there will be no load problems on the server.

    So all in all, I think that a possible spoofer will be disappointed (I will change the accessmethod in version 2.0)

    Greetings
    Per

    The filtering is implemented, you can no longer access via your sample link.

    The second issue around password, and access via not approved website, will follow soon

    Thanks for the help

    One of the benefits of the solution I have created, is that data is not spread over multiple WEB-sites, as well as no multiple storages will be done. Everything is controlled centrally, and any changes to the program will have immediately effect with the connected WEB-sites, without them having to change anything.

    Only in case of new user controlled features, the add of parameters must be done in the module, which can either be done by the WEB-site manager him self, or can be sent to him ready to use.

    Also it means that the blitzortung.org server will only be called once per minute for all participating website, as the data is stored centrally. This I made in order not to stress the blitzortung.org servers.

    But as I promised Egon, I will keep a strict eye on eventual spoofing, and inmproving the security when ever posible.

    As I still am very curious how you got the password, I would like if you would PM me this, as it will help me in further protection.

    Greetings
    Per