4 ms·
:(
by andrewpk 8y ago
:(
- quickthrower2 8y agoYou can do that on any blog! E.g. blogger.com
- SyneRyder 8y agoI was about to say the same thing. Think of the username.micro.blog pages as your personal home page, like a Wordpress or Squarespace blog site. They're a hosting option for people who aren't tech-savvy enough to setup an RSS feed / 280-char micro-post RSS feed on their own site, or just don't want the hassle of maintaining that setup. I believe others have tried posting similar XSS into a Micro.Blog post, and it gets filtered out in the timeline feed that followers read, whether on the site or via 3rd party clients. (Now if someone proves that wrong, that would be a big deal.)
- Aissen 8y agoI think it's only true as long as every *.micro.blog subdomain is properly isolated, and you can't access cookies/sessions from micro.blog (e.g post/comment as someone else, if there's no CSRF token). I haven't checked, but hopefully it's the case here. See: https://security.stackexchange.com/questions/95369/persistent-xss-in-blogger-domain https://security.stackexchange.com/questions/95369/persisten...
- quickthrower2 8y agoDifferent subdomains are different origins. So it's safe.
- albinowax_ 8y agoIt's not quite that simple once cookies (and Internet Explorer/Edge) get involved. But it definitely could be secure.
- teleclimber 8y agoNot quite. There are gotchas: https://blog.github.com/2013-04-09-yummy-cookies-across-domains/ https://blog.github.com/2013-04-09-yummy-cookies-across-doma...