The Internet & the Web
IGCSE Computer Science Topic 5 9:50 English narration · English + 中文 subtitles burned in
Chapters
Transcript
You type a web address and press enter.
你输入一个网址，按下回车。
Less than a second later, a page appears — a page that lives on a computer maybe ten thousand kilometres away.
不到一秒钟，页面就出现了——而这个页面， 也许存放在一万公里之外的一台计算机上。
In that fraction of a second your browser found out where that computer is, asked it for the page, and drew the answer on your screen.
就在这几分之一秒里， 你的浏览器查出了那台计算机在哪儿、向它要来了页面，还把结果画在了你的屏幕上。
And it did all of that across a network where other people are trying to steal data, delete or change files, stop a service from working — that is the impact of the threats — and trick you into typing your password.
而这一切，都是在一张同时还有人试图窃取数据、淹没服务器、 骗你输入密码的网络上完成的。
This lesson is both halves: how the web works, and how it is attacked and defended.
这节课讲的是两半：网络是怎么运作的， 以及它是怎么被攻击、又该怎么防守的。
The internet, the web, and staying safe on it.
互联网、万维网，以及如何在上面保持安全。
Today: the internet versus the world wide web, URLs, how a page reaches you, cookies, digital currency and blockchain, the cyber threats, the malware types, and how to defend against them.
今天我们讲：互联网与万维网的区别、URL、 一个页面是怎么送到你面前的、Cookie、数字货币与区块链、各种网络威胁、恶意软件的类型， 以及该怎么防御。
Let's begin.
让我们开始吧。
First, two words people mix up constantly.
首先是两个经常被搞混的词。
The internet is the infrastructure — the huge worldwide network of computers, and the cables, routers and connections that join them all together.
互联网是基础设施——由计算机组成的巨大的全球网络， 以及把它们连在一起的线缆、路由器和各种连接。
The world wide web is a collection of websites and web pages that you view using the internet.
万维网则是一批网站和网页的集合， 你通过互联网来浏览它们。
So the internet is the network; the web is one of the things you use on that network.
所以互联网是那张网；万维网只是你在那张网上使用的东西之一。
Email is another one.
电子邮件是另一个。
If you can say that sentence in the exam, you have the mark.
如果你能在考场上写出这句话，这一分就到手了。
At home, a router joins your network to the internet and sends data to the right place.
在家里，路由器把你的网络接到互联网，并把数据送到正确的地方。
The pages you request live on powerful computers in a data centre.
你请求的页面， 存在数据中心里的强大计算机上。
Those servers store websites and send them to you.
那些服务器存放网站，再把页面发给你。
The internet is those machines and the links between them, not the pages on your screen.
互联网就是那些机器和它们之间的连接，不是你屏幕上的页面。
The web is one service that rides on that network.
万维网只是骑在那张网上的一种服务。
Email is another.
电子邮件是另一种。
Next, the address itself.
接下来是网址本身。
A uniform resource locator, or URL, is a text address for a web page.
统一资源定位符，也就是 URL，是网页的一个文本地址。
Take this one.
就看这一个。
The first part, h-t-t-p-s, is the protocol — the set of rules used to transfer the page, and the s means the transfer is encrypted.
第一部分，h-t-t-p-s，是协议——传输这个页面所用的一套规则，而那个 s 表示传输是加密的。
The middle part is the domain name, which identifies the web server, and which a DNS turns into an IP address.
中间那部分是域名，它标识出是哪一台网页服务器，并且会被 DNS 转换成一个 IP 地址。
And the last part is the file path and file name of the resource stored on that server.
最后那部分，是这个资源存放在那台服务器上的文件路径和文件名。
Name each part together with its job.
要把每一部分和它的作用一起说出来。
An answer that says "the first bit" and "the last bit" describes a URL without ever explaining it.
只说"第一段""最后一段"， 那是在描述这个 URL，却始终没有解释它。
So what happens when you press enter?
那么，你按下回车之后发生了什么？
Your browser needs the website's IP address — but a URL is a name, not a number.
你的浏览器需要这个网站的 IP 地址—— 但 URL 是一个名字，不是一串数字。
So the browser asks a domain name service, a DNS, which stores the IP address for each web address.
于是浏览器去问域名服务，也就是 DNS， 它保存着每一个网址对应的 IP 地址。
The DNS finds the matching IP address and sends it back.
DNS 找到匹配的 IP 地址，把它送回来。
If that DNS does not have it, it asks another DNS server, until the address is found.
如果这台 DNS 没有，它就去问另一台 DNS 服务器，直到找到为止。
Now the browser uses that IP address to contact the web server that stores the page.
现在浏览器用这个 IP 地址去联系存放该页面的网页服务器。
The web server sends the page's hypertext markup language — HTML — back.
网页服务器把页面的 HTML 发回来。
And the browser does three jobs with it: rendering the HTML, displaying web pages on the screen, and managing how a web page is presented — its layout, text and images.
然后浏览器渲染这段 HTML——把代码变成你真正看到的排版、文字和图片。
While you browse, sites store cookies.
在你浏览的时候，网站会存下 Cookie。
A cookie is a small text file that a website stores on your device, so it can remember things about you.
Cookie 是网站存在你设备上的一个小文本文件， 好让它能记住关于你的一些事。
There are two types, and the difference is simple.
它有两种，区别很简单。
A session cookie is deleted the moment you close the browser — it is for short-term things, like the items in a shopping basket.
会话 Cookie 在你关闭浏览器的那一刻就被删掉—— 它用来存短期的东西，比如购物车里的商品。
A persistent cookie is saved on the device, so the site remembers you between visits.
持久 Cookie 会保存在设备上， 所以网站在你下次来的时候还认得你。
Cookies are used to save personal details, so you do not type your login or your address again, and to track your preferences — your language, or the things you like — so the site can suggest content.
Cookie 的用途包括保存个人信息， 免得你又要输一遍登录名或地址；以及记录你的偏好——你的语言，或者你喜欢的东西—— 好让网站给你推荐内容。
Now something the internet made possible: digital currency.
再来看一样互联网让它成为可能的东西：数字货币。
That is money which exists only in electronic form — no coins, no notes.
这是一种只以电子形式存在的钱—— 没有硬币，也没有纸币。
It is stored and moved between people using computers, and you can pay for things online with it.
它靠计算机来保存、在人与人之间转移，你可以用它在网上付款。
But it has a problem, and the problem is trust.
但它有一个问题，而这个问题就是信任。
How do you stop somebody spending the same money twice?
你要怎么阻止有人把同一笔钱花两次？
How do you stop somebody changing the records?
又怎么阻止有人去篡改记录？
Without an answer to that, digital money is worthless.
如果这个问题没有答案，数字货币就一文不值。
The answer is blockchain.
而这个答案，就是区块链。
A blockchain is a digital ledger — a shared record of every transaction.
区块链是一本数字账本——一份记录了每一笔交易的共享记录。
The record is copied across many computers, so no single person controls it, and it is very hard to change.
这份记录被复制到很多台计算机上， 所以没有任何一个人能单独控制它，而且它极难被篡改。
The transactions are kept in blocks, joined in a chain.
这些交易被装在一个个区块里，串成一条链。
Each block holds three things: the data of the transaction, who paid whom and how much; a timestamp, the date and the time; and a hash value, a special code worked out from the block's contents.
每个区块装着三样东西：交易的数据，也就是谁付给了谁、付了多少；一个时间戳，也就是日期和时间； 还有一个哈希值，一段由这个区块的内容算出来的特殊代码。
And here is the clever part.
而精妙之处在这里。
Each block also stores the hash of the block before it.
每个区块还会存下它前一个区块的哈希值。
So if somebody changes an old block, that block's hash changes, and it no longer matches the copy stored in the next block.
所以一旦有人改动了某个旧区块，那个区块的哈希就变了， 于是它和下一个区块里存着的那份副本就对不上了。
The chain breaks, and the change is spotted at once.
链断了，改动当场就被发现。
Now the dangers.
现在来看危险。
Cyber security means keeping computers, networks and data safe from attack, and there are eight threats you must know.
网络安全的意思，是保护计算机、网络和数据不受攻击， 而你必须掌握八种威胁。
A brute force attack tries many passwords very quickly until one of them works.
暴力破解会飞快地一个接一个试密码，直到试中为止。
Data interception listens in to steal data while it travels across a network.
数据拦截是在数据穿越网络的途中"偷听"，把它窃走。
A distributed denial of service attack floods a server with so many requests that it cannot respond, so the website goes down.
分布式拒绝服务攻击会用海量请求淹没服务器， 让它根本没法响应，于是网站就瘫痪了。
Hacking is getting into a system without permission.
黑客攻击是未经许可闯进一个系统。
Malware is harmful software.
恶意软件是有害的程序。
Pharming uses secret code to send you to a fake website, even when you type the correct address.
域名欺骗用暗中植入的代码，把你送到一个假网站上去， 哪怕你输入的地址是对的。
Phishing uses fake messages to trick you into giving away private details.
网络钓鱼用伪造的消息，骗你交出私人信息。
And social engineering tricks the person, not the computer — somebody pretending to be your boss.
而社会工程骗的是人，不是计算机——比如有人假冒你的上司。
Malware deserves its own list, because the exam asks you to match the type to what it does.
恶意软件值得单独列一张表，因为考试会让你把类型和它做的事对上号。
A virus attaches itself to a file, and copies itself when that file is opened.
病毒把自己附在一个文件上，当那个文件被打开时就复制自己。
A worm copies itself across a network on its own — it does not need anybody to open a file.
蠕虫则自己在网络上不断复制—— 它不需要任何人去打开文件。
A Trojan horse pretends to be useful software, then harms the computer once it is installed.
特洛伊木马假装成有用的软件，一旦装上就开始危害计算机。
Spyware secretly records what you do, such as the keys you press.
间谍软件偷偷记录你做的事，比如你按了哪些键。
Adware floods you with unwanted adverts.
广告软件用一堆没人想要的广告淹没你。
And ransomware locks your files and demands payment to unlock them.
而勒索软件把你的文件锁起来，逼你付钱才解锁。
The virus-versus-worm distinction is the one they ask most: a virus needs a file to be opened, and a worm spreads by itself.
病毒和蠕虫的区别是他们问得最多的： 病毒需要有人打开文件，而蠕虫自己就能传播。
These attacks do not stay on the screen.
这些攻击不会停在屏幕上。
They can steal personal data, delete or change files, and stop a service from working.
它们可以窃取个人数据、删除或改动文件，也可以让一项服务停止工作。
They also cost money, and they make users lose trust in a company.
它们还会让公司花钱，并让用户对公司失去信任。
A distributed denial of service attack can make an online shop unusable, so it loses sales.
一次分布式拒绝服务攻击可以让网店无法使用， 于是它就丢了销售额。
Write the impact, not just the name of the threat.
要写影响，不要只写威胁的名字。
So how do you defend?
那么该怎么防守呢？
Access levels, so each user can only see or change the data they actually need.
访问权限，让每个用户只能看到或修改他真正需要的那部分数据。
Anti-malware software, which scans for and removes harmful programs.
反恶意软件，负责扫描并清除有害程序。
Authentication — proving who you are — using biometrics like a fingerprint or a face, a password, or two-step verification, where a code is sent to your phone as well.
身份验证——也就是证明你是你—— 可以用生物识别，比如指纹或人脸，也可以用密码，或者两步验证， 也就是除了密码之外还往你手机发一个验证码。
Automating software updates, which fix weak points as soon as they are found.
自动软件更新，一发现薄弱点就立刻修补。
A firewall, which checks the data going in and out of a network and blocks anything that is not allowed.
防火墙，检查进出网络的数据，拦下所有不被允许的东西。
Privacy settings, controlling who can see your information.
隐私设置，控制谁能看到你的信息。
And a proxy server, which sits between you and the internet, hiding your IP address and filtering out unsafe content.
还有代理服务器，它坐在你和互联网之间，隐藏你的 IP 地址，并过滤掉不安全的内容。
Plus two free ones: check the spelling and tone of a message, and checking the URL attached to a link — a strange address warns you it is unsafe.
另外还有两个不花钱的：检查消息的拼写和语气，以及检查链接背后的那个网址。
Anti-malware is a family of tools.
反恶意软件是一整类工具。
Anti-virus software looks for programs that attach to files.
杀毒软件寻找会附着在文件上的程序。
Anti-spyware looks for programs that secretly record what you do.
反间谍软件寻找会偷偷记录你做什么的程序。
Automatic updates are part of the same idea: they close weak points as soon as the makers find them.
自动更新属于同一思路：制作者一发现薄弱点，就立刻把它们补上。
Name the kind, not just the family.
要说出具体种类，不要只说这个家族。
And here is the question they really ask: match each threat to its defence.
而下面这个，才是他们真正会问的问题：把每一种威胁和它的防御手段对上号。
Phishing and pharming — check the URL before you click.
网络钓鱼和域名欺骗——点之前先检查网址。
Brute force attacks — strong passwords, plus two-step verification.
暴力破解——强密码，再加上两步验证。
Data interception — encryption, so that what is stolen cannot be read.
数据拦截——加密，这样就算被偷走也读不懂。
Hacking and denial of service attacks — a firewall.
黑客攻击和拒绝服务攻击——防火墙。
Learn the pairs, not just the two lists.
要记的是这些配对，而不只是两张清单。
A question that names a threat is asking you for the matching defence, and the reason it works.
一道题只要点出某种威胁， 问的就是与之匹配的防御手段，以及它为什么管用。
Four marks to lock in.
四个要拿稳的分。
First, the internet is the network, while the world wide web is the pages you view on it.
第一，互联网是那张网，而万维网是你在上面浏览的那些页面。
Second, a page loads like this: the browser asks a DNS for the IP address, then asks the web server for the page, which returns the HTML.
第二，页面是这样加载的：浏览器先向 DNS 要 IP 地址，再向网页服务器要页面， 服务器把 HTML 返回来。
Third, a virus needs a file to be opened, while a worm spreads across a network by itself.
第三，病毒需要有人打开文件，而蠕虫自己就能在网络上传播。
Fourth, a session cookie dies when you close the browser, and a persistent cookie is saved.
第四，会话 Cookie 在你关闭浏览器时就消失，而持久 Cookie 会被保存下来。
Nail these, and this topic is yours.
掌握这些，这个专题就是你的了。