nbpoole

15 ms·

91.
by nbpoole 15y ago
Context: http://news.ycombinator.com/item?id=2315618 Actual post: http://news.ycombinator.com/item?id=2317547
92.
by nbpoole 15y ago
If you want to get pedantic about it, the content is being served as text/html (as opposed to application/xhtml+xml) which means the XML declaration isn't valid.
93.
by nbpoole 15y ago
Is it responsibility of the website to make sure that the passwords are strong for the general user ? Yes. If a password is too weak and it results in a user's account getting compromised, the website gets the blame. Thus, the website man
94.
by nbpoole 15y ago
It's talking about email verification, not password reset systems. In other words, those types of URLs should only establish a connection between an account and an email address: they shouldn't act as a means of authentication.
95.
by nbpoole 15y ago
Don't forgot 'password1' ;-) And the guidelines specifically say " Blacklisted passwords should be implemented (contact infrasec for the list) " which indicates to me that known common passwords like '12345678' and 'password' will be disall
96.
by nbpoole 15y ago
One interesting/cool suggestion that I think is worth noting specifically: the use of HMAC+bcrypt instead of just bcrypt for secure password storage. https://wiki.mozilla.org/WebAppSec/Secure_Coding_Guidelines#... - The nonce for the hma
97.
by nbpoole 15y ago
Lets think about that for a minute. DES truncates at 8 characters, so you're right that if a database with DES-encrypted passwords leaks and is brute forced an attacker will only get the first 8 characters of a password. But what if my pass
98.
How the BEAST was Born(vnhacker.blogspot.com)
8 points by nbpoole 15y ago|0 comments
99.
by nbpoole 15y ago
Except if you find an XSS vulnerability in a site, you already have a serious security vulnerability that can be abused in many different ways to compromise a user. pushState simply makes one of those ways (phishing) more effective. Persona
100.
by nbpoole 15y ago
You might want to read http://www.imperialviolet.org/2011/09/23/chromeandbeast.html , which sums up Chrome's reaction to the attack.
101.
by nbpoole 15y ago
You copied it from http://www.educatedguesswork.org/2011/09/security_impact_of_...
102.
by nbpoole 15y ago
Finding SQL injection in third party applications != "Facebook servers compromised." Flagged.
103.
by nbpoole 15y ago
Your point was already addressed: http://news.ycombinator.com/item?id=2960504 .
104.
by nbpoole 15y ago
Google also has a security bug bounty program on its web applications: http://www.google.com/about/corporate/company/security.html and http://googleonlinesecurity.blogspot.com/2010/11/rewarding-w... .
105.
by nbpoole 15y ago
Got a demo set up somewhere?
106.
by nbpoole 15y ago
OK, I'm having a lot of fun reading this. One little nitpick: > What systems programming functionality does Javascript lack? Here's a starting point: a secure random number generator. Chrome has actually implemented one ( http://b
107.
by nbpoole 15y ago
I managed to dig up a recent comment thread by tptacek that explains why JS crypto is a bad idea: http://news.ycombinator.com/item?id=2855556
108.
by nbpoole 15y ago
The developer's ;-) SQLite doesn't have strict types (see http://www.sqlite.org/datatype3.html ). MySQL does. It's not SQLite's fault or ActiveRecord's fault: it's one of the many issues you have to take into account when developing softwa
109.
by nbpoole 15y ago
100% correct! The only thing I'd point out is that IE's system will disable all scripts on the page if it detects an attack. For Facebook, that means the clickjacking script will be stopped but the page will also be almost toally inoperab
110.
by nbpoole 15y ago
> In the last couple of months, Jay & Mike have been responsible for the development of Jigoshop, an exciting new commerce plugin for WordPress, as part of their previous employment gig at Jigowatt. We have decided to continue the
111.
Lessons from Facebook's Security Bug Bounty Program(nealpoole.com)
3 points by nbpoole 15y ago|0 comments
112.
Arbitrary Code Execution with Null Bytes, PHP, and Old Versions of nginx(nealpoole.com)
5 points by nbpoole 15y ago|0 comments
113.
by nbpoole 15y ago
There were two earthquakes in the past day: one in Colorado, one in Virginia.
114.
by nbpoole 15y ago
Or bcrypt, which is actually implemented in PHP as part of the crypt function ;-)
115.
by nbpoole 15y ago
I just tried it out myself: I can't get DELETE to work in IE9 forms. My code (I've tried it with both upper-case and lower-case DELETE): <form action="http://example.com" method="DELETE"> <input type="submit" />
116.
by nbpoole 15y ago
> This works great in all modern browsers, except IE9. We discovered that not only does IE9 send a real DELETE request, it also follows the redirect with another DELETE. If that redirect points to another resource, you can get a danger
117.
by nbpoole 15y ago
The original HN submission for the post it's responding to: http://news.ycombinator.com/item?id=2898087 I've also taken the time to comment on the blog post itself. Reproducing my comment here: --------------- Thanks for the response! I j
118.
by nbpoole 15y ago
It does ;-) http://news.ycombinator.com/item?id=2898201
119.
by nbpoole 15y ago
Thanks, I just responded on your blog.
120.
by nbpoole 15y ago
The former. From the GitHub description: > WordPress, Git-ified. Synced via SVN every 30 minutes, including branches and tags!

More ›