3 ms·
Ah, CSRF, the irritatingly low-hanging fruit that every would-be security researcher pre-emptively attacks for attention.
by _asdf_asdf 11y ago
Ah, CSRF, the irritatingly low-hanging fruit that every would-be security researcher pre-emptively attacks for attention.
- ronnier 11y agoI don't understand the negative response towards CSRF exploits. They are real and they are dangerous.
- krapp 11y agoIf this had been reported in any other web application, everyone here would be calling the developers morons.
- ChristianBundy 11y agoIf it's such a low-hanging fruit why don't you prove it?
- ubernostrum 11y agoIt's more that if literally any other site on the internet were found to have any type of CSRF vulnerability, people here would be going on and on and on about how this is web dev 101, only a complete idiot wouldn't know about/secure against CSRF attacks, etc. Whereas here, when it's HN with a CSRF issue, "eh, it would break some third-party clients if we patched this".
- dang 11y agoTell me more about this world in which HN's users shield its developers from criticism. We fixed the reported vulnerability and have a fix for the remaining issue ready if it's needed. There's no "eh" here; it's a question of what the right tradeoff is.
- ubernostrum 11y agoWell, I don't see people insulting you the way they would if it were another site... And I don't see people calling out the "breaks third-party clients" justification for not rolling out the full fix.
- dang 11y agoSince you're a "people here", your comments disprove themselves. A phrase like "calling out" assumes that it's obvious what we should do. It's not obvious; the parts that were obvious are done. Our goal is to do what's best for the community, not to avoid getting criticized on the internet.
- ubernostrum 11y agoSince you're a "people here", your comments disprove themselves. If I were going to respond to you the way I feel HN would generally respond to a CSRF hole in a major non-HN site/service, I'd say something like "Well, that line shows you're as good at formal logic as you are at preventing/patching CSRF holes". You know the same as I do that HN's getting light treatment from its users in this thread, compared to how security issues in other things typically get received. It's OK to admit that.
- totony 11y agoHow would you go about proving that?
- ryanlol 11y agoThe negative response tends to be against the super low impact ones, such as this. I have to agree with the GP, blogging about an issue like this just seems tacky. The reactions would undoubtedly be different if it was a practically exploitable CSRF, like something that allows you to change users email addresses.