5 ms·
isn't this technically illegal to demonstrate haha?
by r0m4n0 12y ago
isn't this technically illegal to demonstrate haha?
- __david__ 12y agoWhy on earth would it be illegal?
- DonHopkins 12y agoWhat SHOULD be illegal is not sanitizing all inputs.
- r0m4n0 12y agodam, that got downvoted into oblivion haha. honest question... although i dont believe it should be, a third party injecting javascript to demonstrate an exploit might be...
- tedunangst 12y agoAnybody saying "this is illegal" should be required to cite the law they think is broken and explain why the act in question violates that law.
- maaaats 12y agoHe hasn't injected anything. It's just his public DNS record that this page has chosen to display without sanitizing.
- pbhjpbhj 12y agoI imagine the UK Computer Misuse Act (eg at Section 3, http://www.legislation.gov.uk/ukpga/1990/18 http://www.legislation.gov.uk/ukpga/1990/18) probably covers it if the person who altered the TXT field does so to cause websites to load code on purpose, that purpose being for example to impair (Section 3(2)(a)) the running of the computer [causing Rick Astley to play, defo counts!] - but it can be read to cover pretty much anything. Similarly I imagine something like the CFAA (18 USC 1030) probably has broad enough clauses to make this sort of action technically illegal, at least in some cases? But I'm out of my depth on that one.
- r0m4n0 12y agoat least the UK has something somewhat specific (and actually fits XSS quite well). CA 502c just says: "(3) Knowingly and without permission uses or causes to be used computer services" amongst other very broad subsections http://support.piercecollege.edu/1521a/References/California%20Penal%20Code%20Computer%20Crimes%20Section%20502.aspx http://support.piercecollege.edu/1521a/References/California...
- tokenizerrr 12y agoSo do you want to make it illegal to set the contents of your own domain's TXT record to: "<script src='//peniscorp.com/topkek.js'></script>" Because that is all this is.
- boie0025 12y agoWhat a bunch of nonsense. TXT records were intended for arbitrary use. Why in the world are these companies pulling data from unknown sources and dumping it RAW into their output? Wow. Good find, IMO. [1] http://tools.ietf.org/html/rfc1464 http://tools.ietf.org/html/rfc1464
- pshinghal 12y agoI don't think it makes any sense for this to be illegal, but I can point to at least one example where sense didn't necessarily dictate "justice": http://www.ehackingnews.com/2013/12/anonymous-hacker-charged-for-hacking.html http://www.ehackingnews.com/2013/12/anonymous-hacker-charged...
- peterkelly 12y agoIn which country's jurisdiction?
- jcromartie 12y agoThose DNS lookup sites are pulling his information and putting it on their sites. He didn't ask for those records to be published!
- 0x0 12y agoAh, so his TXT records actually serve a genuine purpose? ;)