6 ms·
penetration testers consistently find holes, websites consistently leave holes - isn't it crazy? I just want you to think in "a new way" and find new solutions
by homakov 15y ago
penetration testers consistently find holes, websites consistently leave holes - isn't it crazy? I just want you to think in "a new way" and find new solutions! Well, mass assignment problem was fixed directly and easily with 1 commit. This one requires Your ideas.
Warning top bar is only my proposal. You can dislike it - but you cannot dislike the fact that CSRF is dangerous.
And, Please, note. The real problem with CSRF - while we (developers, browsers) are fighting - USERS SUFFER. E.g. they lose money from skrill account. They follow spam subscriptions. ETC. Isn't it awful?
- tptacek 15y agoThat's the real problem with all security bugs. CSRF is among the least of them. CSRF can mostly be fixed mechanically, form by form. XSS can't. You should read Michel Zalewsky's post "Postcards from a post-XSS world". I think you're wrong about it being a browser bug, or even that it's amenable to browser fixes. Maybe I'm wrong. But I'm only interested in the engineering discussion, not the morality play.
- homakov 15y ago>But I'm only interested in the engineering discussion, not the morality play. I'm either. Yes, those all are just security bugs. Known, sometimes fixed, sometimes reported. But I wont even try to check Alexa Top for XSS - I m pretty sure I won't find anyting. Bugs are different, that's why CSRF seems the most dangerous to me.
- tptacek 15y agoYou will absolutely find XSS all over the Alexa top domains.