3 ms·

You can see in the commit log from on https://github.com/younesbram/younesbram/commit/4282312e4ec38ab20bb5469cc298b24e142d99d5 https://github.com/younesbram/you

You can see in the commit log from on https://github.com/younesbram/younesbram/commit/4282312e4ec38ab20bb5469cc298b24e142d99d5 https://github.com/younesbram/younesbram/commit/4282312e4ec3... where the first PoC commit is pushed up. The thing I find interesting is that this wasn't a random discovered; like, you look at the first commit in the sequence and you'll see. > \ce{$\unicode[goombafont; color:red; pointer-events: none; ... ie. This isn't some random chance discovery. This is someone looking to use a specific exploit with the ```math tag, already certain that there's some way of doing it. How strange.

rawling 2y ago
This isn't the source of it. I came across this on Twitter last night and traced it back a bit to try to share "the original" with my colleagues. The earliest I found was https://x.com/cloud11665/status/1799136093071163396 https://x.com/cloud11665/status/1799136093071163396 which I think is slightly earlier than the second commit on this repo.
mesmertech 2y ago
that was the first iteration of CSS injection that was working, that github then patched. The new one is the new iteration that still works it was found by a bunch of anime-pfps on twitter and went "viral"
- DaiPlusPlus 2y ago
  > it was found by a bunch of anime-pfps on twitter I think you mean “infosec professional”
- pindab0ter 2y ago
  What does one's pfp matter, if what they found holds water?
  - sshine 2y ago
    What’s a pfp?
    - codetrotter 2y ago
      Profile picture
  - dag11 2y ago
    In this case it adds to their credentials
jraph 2y ago
I don't think you can really trust commit history to deduce this: - the history can be rewritten, with push --force. The author might have iterated by force pushing one commit - The author could have discovered it by change in a private repository, or another repository that they deleted
- wokwokwok 2y ago
  Honestly, I doubt the author is playing the “deep game” of looking like they’re just messing around while secretly being a secret agent and (for some fathomless reason) making it look like it with an artificial git history. So in general, yes, but in this case, I doubt it. I’m pretty sure this git history is a real and true log of them dicking about trying to get the exploit they saw on twitter working. …but, I guess, you could be right. /shrug
  - jraph 2y ago
    I do occasionally force push myself, mostly for making my history look clean, not really secretly hiding stuff. And if I had to tweak / study a GitHub exploit, I would definitely force push to try stuff without leaving a trail for meaningless commits. It actually didn't occur to me that the author would do this for messing around, but it could be indeed. :-)

rawling 2y ago

This isn't the source of it. I came across this on Twitter last night and traced it back a bit to try to share "the original" with my colleagues. The earliest I found was https://x.com/cloud11665/status/1799136093071163396 https://x.com/cloud11665/status/1799136093071163396 which I think is slightly earlier than the second commit on this repo.

mesmertech 2y ago

that was the first iteration of CSS injection that was working, that github then patched. The new one is the new iteration that still works it was found by a bunch of anime-pfps on twitter and went "viral"

DaiPlusPlus 2y ago
> it was found by a bunch of anime-pfps on twitter I think you mean “infosec professional”
pindab0ter 2y ago
What does one's pfp matter, if what they found holds water?
- sshine 2y ago
  What’s a pfp?
  - codetrotter 2y ago
    Profile picture
- dag11 2y ago
  In this case it adds to their credentials

jraph 2y ago

I don't think you can really trust commit history to deduce this: - the history can be rewritten, with push --force. The author might have iterated by force pushing one commit - The author could have discovered it by change in a private repository, or another repository that they deleted

wokwokwok 2y ago
Honestly, I doubt the author is playing the “deep game” of looking like they’re just messing around while secretly being a secret agent and (for some fathomless reason) making it look like it with an artificial git history. So in general, yes, but in this case, I doubt it. I’m pretty sure this git history is a real and true log of them dicking about trying to get the exploit they saw on twitter working. …but, I guess, you could be right. /shrug
- jraph 2y ago
  I do occasionally force push myself, mostly for making my history look clean, not really secretly hiding stuff. And if I had to tweak / study a GitHub exploit, I would definitely force push to try stuff without leaving a trail for meaningless commits. It actually didn't occur to me that the author would do this for messing around, but it could be indeed. :-)