3 ms·
Regarding this and the other response to me. I would never do what I described. I was just trying to demonstrate to those that don't understand XSS properly, th
by mike-cardwell 16y ago
Regarding this and the other response to me. I would never do what I described. I was just trying to demonstrate to those that don't understand XSS properly, that these issues are serious. I don't think a Rick Rolling really gets that issue across.
If I do an XSS attack against you on github whilst you are logged in, I can compromise all of your source repositories, your code, and in turn, potentially compromise the systems of your users.
- durin42 16y agoEnd-users aren't who you need to tell. Just site owners. Posting this to HN before it was fixed constitutes (IMO) completely irresponsible disclosure.
- mike-cardwell 16y agoI agree. I would not have disclosed this particular XSS flaw until after it was fixed.