5 ms·
Probably a good idea to edit the title to indicate that this is an example attack site as well, not my favorite thing in general to land on without warning. No
by hobs 11y ago
Probably a good idea to edit the title to indicate that this is an example attack site as well, not my favorite thing in general to land on without warning.
No js seems to mean no worries though.
- bcrypt 11y agocreator here. sorry, i did not expected to be hn'ed. not running js is usually a good idea though!
- kentonv 11y agoThe results never leave your browser, though, so there's not much to worry about.
- desdiv 11y agoThe JS code sent to kentonv's browser might be safe, but you can't really meaningfully comment on hobs' situation, since you don't have a copy of the JS code that was sent to hobs' browser.
- kentonv 11y agoActually I can. The author of this code is a friend of mine who works with the EFF, and the idea that she's secretly sending malicious scripts to some people but not others from her MIT web hosting space under her own name is simply not plausible.
- e12e 11y agoUnless, she's already compromised your browser and the two previous comments are in fact placed by her! In all seriousness, I appreciate the added context your (particularly this last clarifying comment) add to the discussion.
- robzyb 11y ago> The JS code sent to kentonv's browser might be safe, but you can't really meaningfully comment on hobs' situation [...] But if that's the case then you shouldn't click on anything on HN. I would argue that it is A-OK to post this link directly on hackernews. It just says "look at what your browser can do! imagine if blackhats took advantage of this."
- bcrypt 11y agoIn any case, I didn't minify or remove comments, so you can just view-source:http://zyan.scripts.mit.edu/sniffly/index.js http://zyan.scripts.mit.edu/sniffly/index.js
- vonklaus 11y agoThat is what I thought about my browser history.
- heretek 11y agoWhile I probably would have linked HN to the slides instead of the site, I do think calling it an attack site is paranoid and disingenuous.
- hobs 11y agoDoes the term "example attack site" not mollify that a bit? I tried to be clear that its not a real attack site (or my comment we be much more alarming) but something that executed malicious behavior, even if it wasnt from a malicious actor. Wasnt looking to castigate the author, just looking for a title with a warning.
- kzhahou 11y agoHonest question: what is your concern? Any link you click could possibly contain a hidden attack, perhaps a malicious one. If this link had been labeled differently, would you not have clicked?