4 ms·

<>: it's fake <>: the SSL seal is missing <>: it's a javascript edit <>: open a https site in firefox and look at the addressbar <>: sec <>: ye

by homm88 12y ago

<__>: it's fake <__>: the SSL seal is missing <__>: it's a javascript edit <__>: open a https site in firefox and look at the addressbar <__>: sec <__>: yeah <__>: it DOESN'T appear if you used a javascript hack to make it go away <__>: and changed the page

quink 12y ago
I guess it's possible that the URL behind the black bar doesn't match the actual URL used for the exploit - further obscuring. It might be too easily guessable if it's short, no matter the censorship. And editing the URL would make the seal look like the above. Sure, it's fake, but there's a not too unreasonable explanation as to why it might not be fake fake and why he'd have made that mistake and thought it not to be relevant enough (or just didn't notice) for the central authenticity of the claim to be challenged. It's absolutely possible it's fake. But it's also yet possible that it's not.
cdcarter 12y ago
Doesn't even need to be a javascript replace. $ uptime > blah $ open blah Change the address bar. Screenshot.
geofft 12y ago
It also doesn't look like the standard Linux uptime command, which uses "load average", singular. The BSDs, including OS X, say "load averages"... does Twitter run FreeBSD, or is this copied-and-pasted from an OS X client machine?
- mmmooo 12y ago
  nice catch, I definitely think that would be the nail in this coffin.
- krschultz 12y ago
  I thought Netflix used FreeBSD? https://www.freebsdfoundation.org/testimonials https://www.freebsdfoundation.org/testimonials
  - geofft 12y ago
    Yeah, there are certainly a bunch of people running FreeBSD in production. I just didn't think Twitter was one of them.
dperfect 12y ago
The address bar also has focus (blue outline), further suggesting the URL has been edited after a page load. Normally it loses focus as soon as you hit [enter].
buro9 12y ago
Faking it would be much easier and not betray such evidence: Hit F12, edit out the HTML to be whatever you want. Everyone is freaking about the "URL edit", but it's probably that it's actually a long string exploit and he's just edited the URL to fit into the screen to take the screenshot. It's too amateur a fake, so I'm actually leaning on the side of it being real.
deleted 12y ago
[deleted]

<__>: it's fake <__>: the SSL seal is missing <__>: it's a javascript edit <__>: open a https site in firefox and look at the addressbar <__>: sec <__>: ye

by homm88 12y ago

quink 12y ago

I guess it's possible that the URL behind the black bar doesn't match the actual URL used for the exploit - further obscuring. It might be too easily guessable if it's short, no matter the censorship. And editing the URL would make the seal look like the above. Sure, it's fake, but there's a not too unreasonable explanation as to why it might not be fake fake and why he'd have made that mistake and thought it not to be relevant enough (or just didn't notice) for the central authenticity of the claim to be challenged. It's absolutely possible it's fake. But it's also yet possible that it's not.

cdcarter 12y ago

Doesn't even need to be a javascript replace. $ uptime > blah $ open blah Change the address bar. Screenshot.

geofft 12y ago

It also doesn't look like the standard Linux uptime command, which uses "load average", singular. The BSDs, including OS X, say "load averages"... does Twitter run FreeBSD, or is this copied-and-pasted from an OS X client machine?

mmmooo 12y ago
nice catch, I definitely think that would be the nail in this coffin.
krschultz 12y ago
I thought Netflix used FreeBSD? https://www.freebsdfoundation.org/testimonials https://www.freebsdfoundation.org/testimonials
- geofft 12y ago
  Yeah, there are certainly a bunch of people running FreeBSD in production. I just didn't think Twitter was one of them.

dperfect 12y ago

The address bar also has focus (blue outline), further suggesting the URL has been edited after a page load. Normally it loses focus as soon as you hit [enter].

buro9 12y ago

Faking it would be much easier and not betray such evidence: Hit F12, edit out the HTML to be whatever you want. Everyone is freaking about the "URL edit", but it's probably that it's actually a long string exploit and he's just edited the URL to fit into the screen to take the screenshot. It's too amateur a fake, so I'm actually leaning on the side of it being real.

deleted 12y ago

[deleted]