2 ms·
I really think we should stop being so mean to the submitter. Sure the code might have problems and the whole approach might not be advisable, but I am sure the
by danieltillett 11y ago
I really think we should stop being so mean to the submitter. Sure the code might have problems and the whole approach might not be advisable, but I am sure they have learned a lot from doing this. Ronsor congratulations for actually shipping.
- speps 11y agoI think the negativity comes from the fact this site now linked on the front page of HN can be hacked to send malicious JavaScript to people... Also, in my opinon, adding "Demo" means that it shows how to do it, but that's not clearly not how to do it properly.
- danieltillett 11y agoYes it should not be getting the attention it is getting right now, but we can approach this in a more generous fashion. Let's help rather than ridicule.
- frgewut 11y agoWell even Google still has tons of bugs (including XSS and XSRF). Nowadays it's not possible to write applications without knowledge of XSS, XSRF, SQLi, redirects etc.etc. The security amount you have to understand is just getting ridiculous. And let's not even mention DOS. No-one is securing against that and most servers can be made inaccessible by a simple script that just opens connections.
- qwontem 11y agoI wouldn't characterize a collegial inspection of key security/durability features a website should employ as mean-spirited. Considering that there's some low-hanging fruit still to be plucked, it's better for someone to point them out, and demonstrate the necessity to close these easily-leveraged gaps quickly, rather than to leave them open for someone much less scrupulous to misuse.