4 ms·

Such blatant incompetence astounds me. They can't even validate a field when they know the exact format of the content it should contain?

by tdavis 17y ago

axod 17y ago
The sad thing is people seem to have got used to such incompetence. They expect websites to be broken, insecure, incomplete etc. The programmer responsible should be made to write out lines or something - "I must always validate every single user input".
ashishk 17y ago
What's nuts is how easy this is to exploit. I could explain this to a friend over the phone-- no previous XSS experience necessary. Compared to the whole mikey fiasco, where he found a hole in the on display script for tweets.
blasdel 17y ago
The thing to recognize about Twitter is that they are blatantly incompetent at everything related to their core business. It's actually 140 bytes, not characters, except when it isn't: http://groups.google.com/group/twitter-development-talk/browse_thread/thread/9d9d16d55e2e1e67 http://groups.google.com/group/twitter-development-talk/brow... Even after fixing their db/cache/queue infrastructure to not fall over in normal use, they still can't handle a DoS attack at all! They peer exclusively with the highest-latency and least-connected Tier1: NTT/Verio (incidentally, so do fellow idiots OpenDNS). The business side is in fantasyland, as shown in the documents leaked to TechCrunch. Evan Williams has no idea what he's doing -- Blogger was pure dumb luck, it had already effectively died when it was bought and resurrected by Google. I don't know how Alex Payne keeps himself sane in that kindergarten.
- al3x 17y ago
  We're a small company trying to solve a lot of difficult problems all at once. We make mistakes, but it's always interesting.
  - blasdel 17y ago
    You also happen to be an miracle worker without parallel :)
al3x 17y ago
See my other comment. The engineer who wrote this code did take the time to validate, but his validation was incorrect. Call it "blatant incompetence" if you like, but I'm guessing you've written a buggy validation or regex once or twice in your life.
- idlewords 17y ago
  So you let the same engineer who writes code green-light it for deployment?
  - al3x 17y ago
    No. We have a code review process. It wasn't caught in review, and was okayed for deployment by another engineer.
- blasdel 17y ago
  Except that using validation at all in this case is a mistake, especially writing it yourself for a narrow case, much less using regexes to do it. Escaping, damnit.
  - al3x 17y ago
    Yes, I agree. That's why we've tried to assist Rails Core in reviewing a more comprehensive string tainting model. I've said for some time now that security needs to be institutionalized in frameworks in order for developers to be unable to make stupid mistakes like this one.
- lallysingh 17y ago
  If that's bad, remember the old iTunes installer bug? http://apple.slashdot.org/article.pl?sid=01/11/04/0412209&mode=nested&threshold=3 http://apple.slashdot.org/article.pl?sid=01/11/04/0412209&#3... They had a shell script which didn't "quote" their $variables. It rm -rf'd entire drives by mistake. It's why I use "$@" now.
int2e 17y ago
Every non-trivial app has vulnerabilities. One indication of a vuln is not "blatant incompetence" I've responsibly reported my fair share of Twitter vulns over the years. In general Twitter fixed them quickly. (Except some CSRF/XSRF issue which was non-trivial and was when they had fewer resources.) Dave Naylor was just irresponsibly publicizing something, which makes him somewhat of a jerk. Being a jerk is not necessarily a Bad Thing and of course we/I don't know the entire story here, but that's what it sounds like.

Such blatant incompetence astounds me. They can't even validate a field when they know the exact format of the content it should contain?

by tdavis 17y ago

Such blatant incompetence astounds me. They can't even validate a field when they know the exact format of the content it should contain?

axod 17y ago

The sad thing is people seem to have got used to such incompetence. They expect websites to be broken, insecure, incomplete etc. The programmer responsible should be made to write out lines or something - "I must always validate every single user input".

ashishk 17y ago

What's nuts is how easy this is to exploit. I could explain this to a friend over the phone-- no previous XSS experience necessary. Compared to the whole mikey fiasco, where he found a hole in the on display script for tweets.

blasdel 17y ago

The thing to recognize about Twitter is that they are blatantly incompetent at everything related to their core business. It's actually 140 bytes, not characters, except when it isn't: http://groups.google.com/group/twitter-development-talk/browse_thread/thread/9d9d16d55e2e1e67 http://groups.google.com/group/twitter-development-talk/brow... Even after fixing their db/cache/queue infrastructure to not fall over in normal use, they still can't handle a DoS attack at all! They peer exclusively with the highest-latency and least-connected Tier1: NTT/Verio (incidentally, so do fellow idiots OpenDNS). The business side is in fantasyland, as shown in the documents leaked to TechCrunch. Evan Williams has no idea what he's doing -- Blogger was pure dumb luck, it had already effectively died when it was bought and resurrected by Google. I don't know how Alex Payne keeps himself sane in that kindergarten.

al3x 17y ago
We're a small company trying to solve a lot of difficult problems all at once. We make mistakes, but it's always interesting.
- blasdel 17y ago
  You also happen to be an miracle worker without parallel :)

al3x 17y ago

See my other comment. The engineer who wrote this code did take the time to validate, but his validation was incorrect. Call it "blatant incompetence" if you like, but I'm guessing you've written a buggy validation or regex once or twice in your life.

idlewords 17y ago
So you let the same engineer who writes code green-light it for deployment?
- al3x 17y ago
  No. We have a code review process. It wasn't caught in review, and was okayed for deployment by another engineer.
blasdel 17y ago
Except that using validation at all in this case is a mistake, especially writing it yourself for a narrow case, much less using regexes to do it. Escaping, damnit.
- al3x 17y ago
  Yes, I agree. That's why we've tried to assist Rails Core in reviewing a more comprehensive string tainting model. I've said for some time now that security needs to be institutionalized in frameworks in order for developers to be unable to make stupid mistakes like this one.
lallysingh 17y ago
If that's bad, remember the old iTunes installer bug? http://apple.slashdot.org/article.pl?sid=01/11/04/0412209&mode=nested&threshold=3 http://apple.slashdot.org/article.pl?sid=01/11/04/0412209&#3... They had a shell script which didn't "quote" their $variables. It rm -rf'd entire drives by mistake. It's why I use "$@" now.

int2e 17y ago

Every non-trivial app has vulnerabilities. One indication of a vuln is not "blatant incompetence" I've responsibly reported my fair share of Twitter vulns over the years. In general Twitter fixed them quickly. (Except some CSRF/XSRF issue which was non-trivial and was when they had fewer resources.) Dave Naylor was just irresponsibly publicizing something, which makes him somewhat of a jerk. Being a jerk is not necessarily a Bad Thing and of course we/I don't know the entire story here, but that's what it sounds like.