4 ms·
And while happily displaying the sender email publicly, it gives no indication that someone has embedded (potentially malicious) javascript in a post (why that
by pmachinery 6y ago
And while happily displaying the sender email publicly, it gives no indication that someone has embedded (potentially malicious) javascript in a post (why that is even allowed is another question), or that some expected 'blog posts' are actually unexpected redirects to external sites that can contain even more malicious/illegal content.
Leaving aside that a site like this is so wide open for abuse of all kinds it won't last five minutes, I don't even see the advantage of submitting a form at an email provider over simply submitting a form directly on the site.
- hacker256 6y agoThis is silly. Does google tell you if a site is using JS? Does HN? What "abuse" is available? Also, it's been more than 5 minutes. Looks like you are wrong.
- gitgud 6y agoWell cross site forgery and cross site scripting are a few things that people might do, but I don't think it's a big deal
- hacker256 6y agoAgreed. We offer a public API with no access, so there is limited risk and, in addition, we do not use cookies. There are some dangers, but it's really limited in this context! An attacker can just as easily perform the same attacks with free webhosting on any of the thousands of free webhosts!