10 ms·
I just fixed it. It was a change I did last night to fix a save bug. My apologies about that, it wasn't a good bug, but hopefully it's the last security-related
by kyledrake 13y ago
I just fixed it. It was a change I did last night to fix a save bug. My apologies about that, it wasn't a good bug, but hopefully it's the last security-related one. Probably goes without saying, but this is definitely a beta project. I'm doing a lot of other things to protect this kind of attack (filename scrubbing, bcrypt passwords), so I'm pretty red in the face about how dumb this one was.
If you find any other bad bugs, please let me know (@kyledrake on Twitter) instead of, you know, trashing other people's work. I'm finding the duplicate sites right now and taking care of it. Thanks, and again my apologies.
This is not an email phishing expedition. I don't even require you to enter your email address to make a site.
- clauretano 13y agoNot only does this trigger GeoCities nostalgia, it calls back to the days when betas were really betas.
- bound008 13y agoslg: just make sure you back up your site to multiple floppies and you'll be fine.
- slg 13y agoYou are right, I should have reached out to you directly with this issue. I took the easy route and didn't put in any effort to track you down, for that I am sorry. However, I take exception to you categorizing my post as "trashing other people's work." I feel that I also have a responsibility to publicize such a glaring security hole in your site. This is the number 1 link on HN at the moment. Thousands of people are going to be signing up. I think they have the right to know that a bug like this exists. Like I said in my initial post, a bug this big seemed to be a sign of a bigger problems. I had suspicions the site was malicious and at that point my priority was to point out those suspicions to the HN community.
- kyledrake 13y agoThat wasn't directed at you, it was a general comment. I was referring to the person(s) that defaced other people's sites. Sorry if it came off any other way. :)
- kyledrake 13y agoHere, I'll do one better: If anyone is concerned about the nature/security of the site, here is the source code to NeoCities, ready for anyone to do a full security audit: https://github.com/kyledrake/neocities-web https://github.com/kyledrake/neocities-web Pull requests welcome!
- mattl 13y agoCan you put up a license for it?
- slg 13y agoGood to see. This is the way to respond to these type of mistakes, be completely transparent. Now if only the NSA subscribed to the same plan... And since it wasn't directed toward me, I guess we all can forget my little rant regarding the "trashing" comment.
- egeozcan 13y agoHey, I'll try to hunt this down for you but just to give you a heads up, the server gives me a 500 internal server error when I use characters like "ğ" or "ü".
- gohrt 13y ago> hopefully it's the last security-related one Guaranteed not. I don't mean for you in particular, security requires constant vigilance.
- kyledrake 13y agoCorrection: the last one that's that bad. That was pretty bad.
- belorn 13y agoOn the issue of security, any possibility for HTTPS in the future?
- mullingitover 13y agoI assume you have this posted on your wall nearby? http://i.imgur.com/y7Hm9.jpg http://i.imgur.com/y7Hm9.jpg
- Zimahl 13y agohopefully it's the last security-related one Not to nit-pick, but it's never the last security-related bug :)
- _pmf_ 13y ago> Probably goes without saying, but this is definitely a beta project. It indeed goes without saying, since you don't mention this on the site.
- sneak 13y agoWhat are you doing to make sure your site (and your users' URLs) will be around in five years? How about fifteen? (I'm not just being snarky, I have run a freenet out of pocket for sixteen years because people's urls and email addresses are important to not lose.)
- reidrac 13y agoOpen source your code and you may get some extra eyeballs to avoid this kind of issues.