9 ms·
WordPress is the mainstream of web development. It's not a non-sequitur because you brought up "the mainstream". If you're saying that you meant the mainstream
by ebbv 10y ago
WordPress is the mainstream of web development. It's not a non-sequitur because you brought up "the mainstream".
If you're saying that you meant the mainstream of security professionals specifically, I'd be interested in what a survey of security professionals had to say about open redirect. For me it's clearly a potential attack vector, and Google's specific implementation is obviously sloppy and lazy. I can't see any security professional worth their salt giving it a pass.
As far as Google not being a running joke, that's true and it's all the more reason it's surprising they are so dismissive of concerns about their way too broad whitelist.
- tptacek 10y agoI feel like at this point we both understand the point I was making and don't need to litigate it further. You can and should feel free to disagree with it, but there's a reason pentesters file open redirects sev:lo. (XSS is the canonical sev:medium, for what it's worth).
- throwaway5752 10y agox
- ebbv 10y agoMan if you are afraid to disagree with someone just because of who they are I feel bad for you. I've let pg have it on here when I disagreed with him. It doesn't matter. Everybody's wrong sometimes.
- tptacek 10y agoI'm one of your downvoters. :)
- deleted 10y ago[deleted]
- deleted 10y ago[deleted]