3 ms·
I saw this but don't really consider it much of a problem. It's the kind of thing that you can't really exploit. It'd be obvious if you really tried to use it f
by staunch 15y ago
I saw this but don't really consider it much of a problem. It's the kind of thing that you can't really exploit. It'd be obvious if you really tried to use it for evil and then PG would kill your account.
- TomGullen 15y agoIf HN has some sort of redirect to any URL page (eg, redirect.ashx?url=http://www.google.com http://www.google.com I don't know if HN does but a lot of sites do in some form) then it could be exploited possibly
- kwamenum86 15y agoNot necessarily. You could make the CSRF request on, for example, 80 percent of the views to make it look legit. You could even take a more sophisticated approach and start by automatically upvoting for 100 percent of logged in users just to get on the front page and dampening once your story rises in the rankings.
- staunch 15y agoAnd if any users notice your account and domain are banned. Not saying it shouldn't be fixed but I doubt you would have much luck exploiting this at any scale.