4 ms·

While this is a clever hack, and I doubt the author had any malicious intent, this article really rubs me the wrong way. To the author of this post, this was mo

While this is a clever hack, and I doubt the author had any malicious intent, this article really rubs me the wrong way. To the author of this post, this was most likely nothing more than an intellectual challenge, but from Stephen's perspective, I imagine it feels a whole lot like a mean-spirited breach of privacy. Furthermore, by publishing the details of the breach, he's pressured Stephen & his webmaster to immediately fix this hole or risk a much worse attack on his site. (I'm assuming he didn't notify Stephen before publishing this post. Such courtesy would have been greatly appreciated, I bet.) There's a security hole in the postal service, too. You can read anyone's mail by stealing it from their mailbox. Doesn't mean it's a good thing to do.

slavingia 17y ago
The author states that the site he references in the post is not the same site that is live. "Any overlap with existing site is accident."
lemming 17y ago
"he's pressured Stephen & his webmaster to immediately fix this hole or risk a much worse attack on his site." Surely that's a good thing? I agree that Stephen would/will probably be offended (assuming he wasn't notified), but he'll certainly take security more seriously now.
- dandelany 17y ago
  It's a good thing that Stephen was made aware of this security hole, but the author could have informed him a lot more effectively. If someone broke into my house and I found out about it on Hacker News because they set up a webcam in my living room, I suppose it would be a good thing that I found out about a security problem in my home, but I certainly wouldn't be happy about it.
  - lemming 17y ago
    Fair enough, although it's a much more graphic illustration of the problem actually seeing the results (rather than simply "your site isn't very secure", "your front door lock is a bit loose"). I know it made much more impact on me than it would have if I'd read an article about the possibility of it happening. Although I suspect that if he'd just mailed the username/password to Stephen that would have been example enough. Kind of scary how many of these sites are almost certainly out there, though.
nzmsv 17y ago
Xakep is a magazine mostly about the other kind of hacking (the meaning journalists use). Which means there are lots of black hat and script kiddie materials in there, along with the white hat kind of hacks. Btw, 'xakep' is 'hacker' in Russian, but spelled using Latin characters. This material is definitely on the black hat side of things, but it is still important to be aware of these types of attacks. Sadly, PHP include bugs and SQL injections are still very widespread.

slavingia 17y ago

The author states that the site he references in the post is not the same site that is live. "Any overlap with existing site is accident."

lemming 17y ago

"he's pressured Stephen & his webmaster to immediately fix this hole or risk a much worse attack on his site." Surely that's a good thing? I agree that Stephen would/will probably be offended (assuming he wasn't notified), but he'll certainly take security more seriously now.

dandelany 17y ago
It's a good thing that Stephen was made aware of this security hole, but the author could have informed him a lot more effectively. If someone broke into my house and I found out about it on Hacker News because they set up a webcam in my living room, I suppose it would be a good thing that I found out about a security problem in my home, but I certainly wouldn't be happy about it.
- lemming 17y ago
  Fair enough, although it's a much more graphic illustration of the problem actually seeing the results (rather than simply "your site isn't very secure", "your front door lock is a bit loose"). I know it made much more impact on me than it would have if I'd read an article about the possibility of it happening. Although I suspect that if he'd just mailed the username/password to Stephen that would have been example enough. Kind of scary how many of these sites are almost certainly out there, though.

nzmsv 17y ago

Xakep is a magazine mostly about the other kind of hacking (the meaning journalists use). Which means there are lots of black hat and script kiddie materials in there, along with the white hat kind of hacks. Btw, 'xakep' is 'hacker' in Russian, but spelled using Latin characters. This material is definitely on the black hat side of things, but it is still important to be aware of these types of attacks. Sadly, PHP include bugs and SQL injections are still very widespread.