4 ms·
This is not new[1], but interesting that github didn't think about this when they set-up gh-pages. It's hard to blame them though. Security is easy to miss. My
by gingerlime 14y ago
This is not new[1], but interesting that github didn't think about this when they set-up gh-pages.
It's hard to blame them though. Security is easy to miss. Myself and many other people who use github, and who understand those issues, don't really think about it until someone points this out...
[1] http://security.stackexchange.com/q/12412/7306 http://security.stackexchange.com/q/12412/7306 - just an example of a discussion about this very same issue from about a year ago (and it wasn't new even then)
EDIT: layout
- homakov 14y agodid I say cookie tossing is something new? If I would consider it as a new attack I would call it Homakov Cookie Tossing Attack. Now it's just cookie tossing.
- gingerlime 14y agoSaying that it's not new wasn't meant as a criticism for your discovery of this happening on github. Quite the opposite. It's more of an observation on how even well-known security vulnerabilities can go overlooked. Even by companies with as big exposure and as many resources as github.