3 ms·

The fly bouncing around on the page is incredibly annoying.

by dsl 14y ago

ewoutkleinsmann 14y ago
$('#home #fly').click()
- civilian 14y ago
  $('#up_5210503').click()
  - mauvehaus 14y ago
    And now you have me wondering if your comment gets a new id when you update it. If so, convincing people to execute random javascript code could be a good way to build karma. Let's find out :-) $('#up_5210561').click() EDIT: Comment id's remain the same when you update them. Now for the social engineering aspect...
    - nwh 14y ago
      Ideally one would embed a webpage with a hidden image that loaded the upvote URL for a particular post of yours. Every logged in user would unknowingly upvote that post ID. Thankfully HN is built with form keys, so that particular CSRF attack won't work. Social engineering would be more difficult, I seem to remember that Chrome prevents javascript strings from being pasted into it's URL (you can still type them), in order to prevent attacks just like this. There was a number of attacks on Facebook that involved asking users to copy and paste a dodgy looking javascript string into a Facebook tab in order to "win" something. Of course it just spammed posts and stole session information, but it was still an interesting attack.
      - pooriaazimi 14y ago
        This method was abused last year (a submission with 3800+ upvotes): http://news.ycombinator.com/item?id=3742902 http://news.ycombinator.com/item?id=3742902
mauvehaus 14y ago
If you're using firefox and can install extensions, I recommend noscript [1]. Admittedly, it'll take some time to whitelist all the stuff you actually want to work, but it does cut down on silly stuff like the fly (which for me remains parked in the upper left-hand corner). There's apparently a Chrome extension called ScriptSafe if that's your browser of choice. [1] http://noscript.net/ http://noscript.net/ [2] https://chrome.google.com/webstore/detail/scriptsafe/oiigbmnaadbkfbmpbfijlflahbdbdgdf https://chrome.google.com/webstore/detail/scriptsafe/oiigbmn...

The fly bouncing around on the page is incredibly annoying.

by dsl 14y ago

The fly bouncing around on the page is incredibly annoying.

ewoutkleinsmann 14y ago

$('#home #fly').click()

civilian 14y ago
$('#up_5210503').click()
- mauvehaus 14y ago
  And now you have me wondering if your comment gets a new id when you update it. If so, convincing people to execute random javascript code could be a good way to build karma. Let's find out :-) $('#up_5210561').click() EDIT: Comment id's remain the same when you update them. Now for the social engineering aspect...
  - nwh 14y ago
    Ideally one would embed a webpage with a hidden image that loaded the upvote URL for a particular post of yours. Every logged in user would unknowingly upvote that post ID. Thankfully HN is built with form keys, so that particular CSRF attack won't work. Social engineering would be more difficult, I seem to remember that Chrome prevents javascript strings from being pasted into it's URL (you can still type them), in order to prevent attacks just like this. There was a number of attacks on Facebook that involved asking users to copy and paste a dodgy looking javascript string into a Facebook tab in order to "win" something. Of course it just spammed posts and stole session information, but it was still an interesting attack.
    - pooriaazimi 14y ago
      This method was abused last year (a submission with 3800+ upvotes): http://news.ycombinator.com/item?id=3742902 http://news.ycombinator.com/item?id=3742902

mauvehaus 14y ago

If you're using firefox and can install extensions, I recommend noscript [1]. Admittedly, it'll take some time to whitelist all the stuff you actually want to work, but it does cut down on silly stuff like the fly (which for me remains parked in the upper left-hand corner). There's apparently a Chrome extension called ScriptSafe if that's your browser of choice. [1] http://noscript.net/ http://noscript.net/ [2] https://chrome.google.com/webstore/detail/scriptsafe/oiigbmnaadbkfbmpbfijlflahbdbdgdf https://chrome.google.com/webstore/detail/scriptsafe/oiigbmn...