6 ms·

I was just talking about this at lunch, by really weird coincidence. You were leading the funniest GitHub pull request I've ever taken part in. It went somethin

I was just talking about this at lunch, by really weird coincidence. You were leading the funniest GitHub pull request I've ever taken part in. It went something like this: Me: "I've created a PR to allow .cur and .mid files, like the good ol' days." You: "Wtf is a .cur?" Person 2: "It's windows cursor format." You: "(many paragraphs, tl;dr: Sorry, but we're not recreating Geocities.)" ~ one year later ~ You: "I caved. I've merged, sorry for being a dick." After so long, I'd completely forgotten about the PR and found it hilarious that you eventually merged my PR. I'm happy to see things continue forward :D

kyledrake 10y ago
I've been thinking about flipping it around - instead of whitelisting certain files, simply blacklisting the problem formats. Thanks for reminding me.
- ReverseCold 10y ago
  I think a whitelist is better, there can be a ton of file formats that have vulnerabilities in their readers.
  - kyledrake 10y ago
    True. The main issue is that people love to create new web formats. For example, there was some 3D model formats we didn't support initially. It's pretty hard to keep up.
    - erikpukinskis 10y ago
      I don't think you necessarily need to keep up! Just keep moving and you'll get what you need over time.
    - e12e 10y ago
      On the other hand, a whitelist might work as a way to "trick" people into starting to contribute, by way of filing issues and submitting trivial pull requests? Thanks for all your hard work on the site by the way! I've actually taken the opportunity to use it at my new job, as one option for students to publish/show work in our basic web/html course at Voss FHS[1]. Did you manage to keep publishing the transparent financial reports? As I've mentioned before, I personally find the openess of the whole operation to one of the most interesting bits of the site :-) [1] http://voss.fhs.no/english/information-about-voss-folkehogskule http://voss.fhs.no/english/information-about-voss-folkehogsk...
  - bencollier49 10y ago
    Like .cur files! According to a quick google search, there was/is a buffer overflow vulnerability in XP. Makes me wonder how many SP1 XP installs hit Neocities.
  - dkresge 10y ago
    Agreed. Kyle, are you also validating that the content of the uploaded file correlates with the extension? Geocities began having real issues with bot generated accounts, each of which would get one shard of a binary warez uploaded as .jpg, etc. Of course, we didn't have captcha, so your exposure might be limited. Awesome to see this -- wish you worlds of luck.

kyledrake 10y ago

I've been thinking about flipping it around - instead of whitelisting certain files, simply blacklisting the problem formats. Thanks for reminding me.

ReverseCold 10y ago
I think a whitelist is better, there can be a ton of file formats that have vulnerabilities in their readers.
- kyledrake 10y ago
  True. The main issue is that people love to create new web formats. For example, there was some 3D model formats we didn't support initially. It's pretty hard to keep up.
  - erikpukinskis 10y ago
    I don't think you necessarily need to keep up! Just keep moving and you'll get what you need over time.
  - e12e 10y ago
    On the other hand, a whitelist might work as a way to "trick" people into starting to contribute, by way of filing issues and submitting trivial pull requests? Thanks for all your hard work on the site by the way! I've actually taken the opportunity to use it at my new job, as one option for students to publish/show work in our basic web/html course at Voss FHS[1]. Did you manage to keep publishing the transparent financial reports? As I've mentioned before, I personally find the openess of the whole operation to one of the most interesting bits of the site :-) [1] http://voss.fhs.no/english/information-about-voss-folkehogskule http://voss.fhs.no/english/information-about-voss-folkehogsk...
- bencollier49 10y ago
  Like .cur files! According to a quick google search, there was/is a buffer overflow vulnerability in XP. Makes me wonder how many SP1 XP installs hit Neocities.
- dkresge 10y ago
  Agreed. Kyle, are you also validating that the content of the uploaded file correlates with the extension? Geocities began having real issues with bot generated accounts, each of which would get one shard of a binary warez uploaded as .jpg, etc. Of course, we didn't have captcha, so your exposure might be limited. Awesome to see this -- wish you worlds of luck.