14 ms·
Probably should rename this to "billion reposts." Can we move beyond this simple issue and discuss more complicated aspects of security on HN?
by dguido 14y ago
Probably should rename this to "billion reposts."
Can we move beyond this simple issue and discuss more complicated aspects of security on HN?
- dguido 14y agoFine, you guys asked for it. https://news.ycombinator.com/item?id=259458 https://news.ycombinator.com/item?id=259458 https://news.ycombinator.com/item?id=3859853 https://news.ycombinator.com/item?id=3859853 https://news.ycombinator.com/item?id=1674911 https://news.ycombinator.com/item?id=1674911 https://news.ycombinator.com/item?id=301296 https://news.ycombinator.com/item?id=301296 https://news.ycombinator.com/item?id=4619344 https://news.ycombinator.com/item?id=4619344 People that exploit these kinds of things continue to innovate, but HN seems to be stuck with XSS, SQLi, and malformed XML.
- daeken 14y agoWhile I'm all with you on talking about advanced security, the reality is that most people here don't understand basic security. I think talking about the low-hanging fruit is important -- everyone has to start somewhere. And as always, if you want to see more advanced security stuff, post it! I'll upvote it for sure. Edit: This does make me think that I've been meaning to write a blog post about a security issue I discovered for about 6 months now. Time to do that.
- wglb 14y agoWhich he did: http://news.ycombinator.com/item?id=4678309 http://news.ycombinator.com/item?id=4678309. This is a tale in which cody pretty much ends up owning ccbill.
- ezequiel-garzon 14y agoPlease consider that none of those posts with any comments in them took place within the last two years. And "sadly" gets created just to tell people to read more books. Sad indeed... EDIT: HN seems to be stuck with XSS, SQLi, and malformed XML HN is not a person: half of today's HN didn't exist two years ago [1]. [1] http://blog.rjmetrics.com/surprising-hacker-news-data-analysis/ http://blog.rjmetrics.com/surprising-hacker-news-data-analys...
- VMG 14y agoDisagree. I didn't know about that attack and found it very interesting.
- sadly 14y agoSadly, it's because you aren't reading enough books. Read more books.
- enraged_camel 14y agoSadly, I downvoted you. I wouldn't have if you had actually given some book suggestions, but instead your post amounts to "read more lol" which is not only unhelpful but also condescending.
- ftwinnovations 14y agoDown voting is good, but feeding the trolls is not!
- tisme 14y agoThe problem here is that a lot of newly minted IT professionals will write stuff that will allow a re-use of all those old exploits all over again. Occasionally warning people about known dangers doesn't harm. Sure that's not exactly moving the needle but it may help to mitigate a few lurking problems that people were not yet aware of. Think of it as a 'wear your seatbelt' advertisement. If you're already wearing your seatbelt then it wasn't meant for you.
- ghshephard 14y agoEntirely appropriate. We've probably had a minimum of 20-30 reposts over the problems with saving passwords as simple salts+hashes, which is a useful introduction to bcrypt/scrypt/pbkdf2.
- angrycoder 14y agoAchievement Unlocked: You've read all of the Internet.
- stcredzero 14y agoWhat about one for reading all of HN?
- marmot1101 14y ago10 year deep IT professional, recent HN member. This is the first I've seen of this attack. Reposts can be a good thing.
- ftwinnovations 14y agoI'm so tired of these "seen it before, I'm smarter and more senior than you" responses. Look, if people vote it up it means they like it. Just because its been talked about before doesn't make it less valuable.
- ctdonath 14y agoThe Internet is a much bigger place than some people realize. If you would like a part of it improved & expanded, please proceed to do so.