3 ms·

Well I already posted it, nobody is interested. Okay :( I guess you should change the title - this on is too shouting. Sorry all that I took your time for cons

by homakov 15y ago

Well I already posted it, nobody is interested. Okay :( I guess you should change the title - this on is too shouting. Sorry all that I took your time for considering the problem. I see you are not interested to do/solve anything and my arguments worth nothing.

jaredsohn 15y ago
This is currently the #2 post on Hacker News; I think people are interested.
deleted 15y ago
[deleted]
- homakov 15y ago
  penetration testers consistently find holes, websites consistently leave holes - isn't it crazy? I just want you to think in "a new way" and find new solutions! Well, mass assignment problem was fixed directly and easily with 1 commit. This one requires Your ideas. Warning top bar is only my proposal. You can dislike it - but you cannot dislike the fact that CSRF is dangerous. And, Please, note. The real problem with CSRF - while we (developers, browsers) are fighting - USERS SUFFER. E.g. they lose money from skrill account. They follow spam subscriptions. ETC. Isn't it awful?
  - tptacek 15y ago
    That's the real problem with all security bugs. CSRF is among the least of them. CSRF can mostly be fixed mechanically, form by form. XSS can't. You should read Michel Zalewsky's post "Postcards from a post-XSS world". I think you're wrong about it being a browser bug, or even that it's amenable to browser fixes. Maybe I'm wrong. But I'm only interested in the engineering discussion, not the morality play.
    - homakov 15y ago
      >But I'm only interested in the engineering discussion, not the morality play. I'm either. Yes, those all are just security bugs. Known, sometimes fixed, sometimes reported. But I wont even try to check Alexa Top for XSS - I m pretty sure I won't find anyting. Bugs are different, that's why CSRF seems the most dangerous to me.
      - tptacek 15y ago
        You will absolutely find XSS all over the Alexa top domains.

by homakov 15y ago

jaredsohn 15y ago

This is currently the #2 post on Hacker News; I think people are interested.

deleted 15y ago

[deleted]

homakov 15y ago
penetration testers consistently find holes, websites consistently leave holes - isn't it crazy? I just want you to think in "a new way" and find new solutions! Well, mass assignment problem was fixed directly and easily with 1 commit. This one requires Your ideas. Warning top bar is only my proposal. You can dislike it - but you cannot dislike the fact that CSRF is dangerous. And, Please, note. The real problem with CSRF - while we (developers, browsers) are fighting - USERS SUFFER. E.g. they lose money from skrill account. They follow spam subscriptions. ETC. Isn't it awful?
- tptacek 15y ago
  That's the real problem with all security bugs. CSRF is among the least of them. CSRF can mostly be fixed mechanically, form by form. XSS can't. You should read Michel Zalewsky's post "Postcards from a post-XSS world". I think you're wrong about it being a browser bug, or even that it's amenable to browser fixes. Maybe I'm wrong. But I'm only interested in the engineering discussion, not the morality play.
  - homakov 15y ago
    >But I'm only interested in the engineering discussion, not the morality play. I'm either. Yes, those all are just security bugs. Known, sometimes fixed, sometimes reported. But I wont even try to check Alexa Top for XSS - I m pretty sure I won't find anyting. Bugs are different, that's why CSRF seems the most dangerous to me.
    - tptacek 15y ago
      You will absolutely find XSS all over the Alexa top domains.