4 ms·

Yey I'm not getting prosecuted. Good times.

• apgwoz 16y ago
  A couple of years ago, I emailed Garry Tan about this very issue after successfully posting to a friend's Posterous. They were only thankful for the heads up and investigated. A year or two later, I was interviewing at a company whose product has a similar feature (post todos more or less), and decided to see if I could post to my friends todo list. I was thinking that if I could, I'd post to the guy who was interviewing me's list "Hire Andrew--he exposed a hole." It didn't work on my friends account, and I got an email a couple of minutes later. "I see you were doing some fuzzing, were you able to get any messages through?" I wasn't able to (though I didn't try too hard), and I didn't get the job either. (I ended up with a better job, so it all worked out).
  • robinduckett 16y ago
    Well, apparently all you need to break Posterous' security is an SMTP server from 1and1.co.uk
    • rantfoil 16y ago
      Um, not anymore actually. And also it only worked because Dustin had no SPF records -- again vast majority of users were unaffected.