nbpoole

39 ms·

331.
by nbpoole 16y ago
See also; http://news.ycombinator.com/item?id=2343330
332.
by nbpoole 16y ago
That wouldn't help in this case, since a typo in the config file is making the file not be parsed as PHP. If you want to avoid that possibility, you can use a non-PHP format (eg: YAML) and parse it.
333.
by nbpoole 16y ago
Because maybe there's more than one body? :P [Seriously though, I have no idea]
334.
by nbpoole 16y ago
So I take it you're not a fan of http://www.gamefaqs.com ? ;-)
335.
by nbpoole 16y ago
Not quite. Here's the cleaned up JS from the bookmarklet: function () { var i = 0, r = function (n) { return Math.floor(Math.random() * n) }, f = document.getElementsByTagName('body')[0].getElem
336.
by nbpoole 16y ago
I sincerely hope that's not what happens here. I would hate to see someone lose their job over what seems to have been a temporary lapse in judgement.
337.
by nbpoole 16y ago
Putting the legal issues aside? It doesn't matter either way: security vulnerabilities trump copycats (in my opinion). Publicly releasing details of an XSS vulnerability on a third party's site has much bigger ramifications than a copycat s
338.
by nbpoole 16y ago
I disagree. 1. There are plenty of proof of concepts you can develop that don't destroy the page. 2. The Quora engineers in question didn't enter stuff into a textbox and leave it alone. They went and publicly disclosed a cross-site scripti
339.
by nbpoole 16y ago
The full quote from Rick Ross is "I am grateful that Ben Newman and Albert Sheu of Quora have identified a (now fixed) XSS vulnerability in our test site, but I am surprised that Quora policy permits developers to engage so openly in vandal
340.
by nbpoole 16y ago
Yes, except then you're relying on data coming from untrusted users. How long do you think it would take before someone figures out a way to put themselves at the top of the list? ;) Edit: OK. Assuming you're only looking at data locally, y
341.
by nbpoole 16y ago
http://www.google.com/support/chrome/bin/answer.py?answer=95...
342.
by nbpoole 16y ago
Or you could use Portable PuTTY: http://www.straightrunning.com/XmingNotes/portableputty.php Edit: A different version is available at http://portableapps.com/apps/internet/putty_portable
343.
by nbpoole 16y ago
Mmm, from here it looks like YouTube had a sanitizer in place that failed: it's not clear that the Android Market was sanitizing the output here. That's what I meant by the underlying cause being different.
344.
by nbpoole 16y ago
http://www.google.com/search?q=site:.io
345.
by nbpoole 16y ago
It wasn't quite that simple ;-) http://www.reddit.com/r/programming/comments/cluc5/html_inje... The payload in the case of YouTube was only slightly more complex (two <script> tags instead of one), but it sounds like the underlyin
346.
by nbpoole 16y ago
Was. It's fixed now, apparently ;)
347.
by nbpoole 16y ago
Very interesting: I wonder at what point they figured out he was messing with his grades?
348.
by nbpoole 16y ago
There's a very good example here: http://www.idontplaydarts.com/2010/07/mongodb-is-vulnerable-...
349.
by nbpoole 16y ago
He built a lead in categories including "Presidential Rhyme Time," in which the correct response to "Herbert's military strategy" was "Hoover's maneuvers." Does anyone know if Watson is able to handle categories like that?
350.
by nbpoole 16y ago
A very interesting read. :-) At one point, the article seemed to conflate the running of AlterNIC with the hijacking of InterNIC (although it later clarified that the hijacking was done via a vulnerability in BIND). In case anyone else is i
351.
by nbpoole 16y ago
No. For security reasons, Wordpress.com doesn't allow you to run Javascript. See http://en.support.wordpress.com/code/
352.
by nbpoole 16y ago
He suggests switching from Wordpress.COM, Wordpress's hosting service, which presumably doesn't provide that plugin. Edit: As jamesgeck0 points out, Wordpress.com does support LaTeX: http://en.support.wordpress.com/latex/
353.
by nbpoole 16y ago
That's actually not quite what's happening. The vulnerability in vBSEO does not allow users to upload files. By all indications, it's a relatively normal persistent XSS vulnerability. However, because of the nature of XSS and the functional
354.
by nbpoole 16y ago
This is a problem for any application that has a web interface for writing to the filesystem. You can perform a similar attack against Wordpress through the template and plugin editors, for example. Does anyone know if VB enables the plugin
355.
by nbpoole 16y ago
To quote the blog post: "The reason for not supporting the DELETE/PUT methods is quite simple: by reducing the possible interactions to what a standard browser performs (GET/POST) we allow developers to interact with our api through their w
356.
by nbpoole 16y ago
Because the leading minus sign indicates that you DON'T want a particular term (in this case, moz-border-radius) in your results. Since that's your only term entered, no search happens. Try searching moz-border-radius.
357.
by nbpoole 16y ago
They've had that available for a week: http://www.oracle.com/technetwork/java/javase/downloads/inde... This fixes a number of other vulnerabilities: http://www.oracle.com/technetwork/topics/security/javacpufeb...
358.
by nbpoole 16y ago
I wonder why they were rejected? :-P
359.
by nbpoole 16y ago
Since we're talking about the Hyper Text Coffee Pot Control Protocol here, physical attributes of the teapot are irrelevant and thus outside of the scope of the RFC. The RFC ( http://www.ietf.org/rfc/rfc2324.txt ) specifically states:
360.
by nbpoole 16y ago
Except I just did: check out http://developers.facebook.com/blog/post/462 and search for "Hey look, I can comment." EDIT: If you aren't signed in to Facebook, you might not be able to see the comments.

More ›