4 ms·

The conditional in the code _is_ a protection. It is not fair of you to consider it non-existent just because _you_ can easily bypass it. Using your argument,

The conditional in the code _is_ a protection. It is not fair of you to consider it non-existent just because _you_ can easily bypass it. Using your argument, it would be fair to circumvent any protection as long as a specialist can trivially bypass it? Remember that 99% of internet users have no idea what "Show page source" actually does, much less what "javascript" is. You are the top 1 percentile power user here. Arguably a lot of things are not strongly protected per se but rely on specialists not trying to actively trick the system, much less posting their techniques on public forums.

d-z-m 4y ago
> Arguably a lot of things are not strongly protected per se but rely on specialists not trying to actively trick the system If a system has a vulnerability, it is the system's fault, not the specialist's. I'm a bit sensitive to this line of argument because it and arguments like it have been used in the past to try and demonize the efforts of security researchers. However, I also believe we should have good norms around responsible disclosure. > much less posting their techniques on public forums. Perhaps it could've been more responsibly disclosed to the OP, agreed. However, the public internet is a public forum. OP posted his code there, and it was found. Any number of web crawlers have probably already found it. Not the least painful way to learn this lesson, but hopefully it was learned.