nbpoole

21 ms·

1. 151.▲
   by nbpoole 15y ago

   http://svn.php.net/viewvc?view=revision&revision=300266 http://www.php.net/archive/2011.php#id2011-06-28-1 It's in PHP 5.4 alpha as well ;)
2. 152.▲
   by nbpoole 15y ago

   Not to belabor the point, since other people have assessed this library quite well, but: 1. Detecting XSS by looking for '<', '>', '(', or ')' in the URL is a very naive approach. It can be bypassed fairly easily and many XSS vector
3. 153.▲
   by nbpoole 15y ago

   Because the security email address is not a place for bug reports: it shouldn't be ranking for that query. If it did, the team would just be swamped with "bug reports" ;) Try searching for "google report security" or "security vulnerability
4. 154.▲
   by nbpoole 15y ago

   It was posted almost two years ago. While duplicate posts can be an issue, having well-written, useful content show up twice in two years doesn't seem excessive to me. There was some helpful Q&A in that old discussion though, so it's go
5. 155.▲
   by nbpoole 15y ago

   http://news.ycombinator.com/item?id=2719083 http://news.ycombinator.com/item?id=2719028
6. 156.▲
   by nbpoole 15y ago

   https://secure.trust-guard.com/certificates/secure.trust-gua... Apparently they don't run their security scanner against their own website ;-)
7. 157.▲
   by nbpoole 15y ago

   Yes, with a lot of vague, generic statements. " Security measures have been built into the design and setup of our infrastructure. " tells you absolutely nothing. Neither does " Disasters are never nice events and we hope they don’t happen.
8. 158.▲
   by nbpoole 15y ago

   > Just passed a 47,000 point security check by an independent 3rd party. Our platform is also now PCI DSS compliant. Daily tests starting now https://twitter.com/#!/ruxum/status/86827701381496833 In other words, https://secure.trus
9. 159.▲
   by nbpoole 15y ago

   > skype declares my bug as "minor issue", but skype doesn't handle domain scope properly, hence it is possible to own victim's machine https://twitter.com/#!/noptrix/status/91910866538217472 And the HN discussions about the previous
10. 160.▲
    by nbpoole 15y ago

    The difference there is "I want a link back from your site to my site." That's the point at which the offer loses all possible shreds of credibility.
11. 161.▲
    by nbpoole 15y ago

    abs.apple.com resolves to 17.112.144.82, which appears to be part of an IP range owned by Apple. It's possible that the server is running third-party software, but it does appear to be hosted by Apple.
12. 162.▲
    by nbpoole 15y ago

    So, how would you compare your site with http://www.viglink.com/ or http://skimlinks.com/ ? Edit: Never mind. I posted this before checking out your site. I see that you provide the Javascript to perform the URL rewriting but require web
13. 163.▲
    by nbpoole 15y ago

    http://kb.mozillazine.org/Network.http.redirection-limit All other browsers, to the best of my knowledge, have similar systems built in. So your premise is flawed: you can't have an "infinite redirect."
14. 164.▲
    by nbpoole 15y ago

    That has to do with how spoiler tags are set up on that subreddit: the actual spoiler content is in the title attribute of the link and the href points to /s. The CSS for the subreddit uses an attribute selector to find links pointing to /s
15. 165.▲
    by nbpoole 15y ago

    Screenshot: http://imgur.com/Uq9Fs I'm just hoping I'm not color-blind :-P
16. 166.▲
    by nbpoole 15y ago

    I posted a link ( http://news.ycombinator.com/item?id=2701527 ) to a Debian bug that explains the rationale (aside from the historical behavior argument) a little better: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=308911
17. 167.▲
    by nbpoole 15y ago

    Strange. I'm running Chrome 12 on OS X and I have no issue (although the contrast is very poor).
18. 168.▲
    by nbpoole 15y ago

    Click and drag over the text with your mouse and you should be able to see it.
19. 169.▲
    by nbpoole 15y ago

    I found an older bug report for Debian that sheds a little light on why this behavior is useful: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=308911 I can understand not changing the behaviour wrt historical precedent: I hav
20. 170.▲
    by nbpoole 15y ago

    The // prefix is actually used for protocol-relative URLs. So //google.com leads to https://google.com on a page with SSL, and it leads to http://google.com on an unencrypted page. See: http://nedbatchelder.com/blog/200710.html#e200710
21. 171.▲
    by nbpoole 15y ago

    So, the FBI has a copy of Instapaper's complete database and a copy of their website code. The database includes: - Salted SHA-1 hashed passwords for Instapaper - Encrypted passwords for linked Pinboard accounts (with the encryption key sto
22. 172.▲
    by nbpoole 15y ago

    Google Cache version: http://webcache.googleusercontent.com/search?q=cache%3Ahttp%...
23. 173.▲
    by nbpoole 15y ago

    Yes: SSH allows for password-less logins through the use of public/private key pairs.
24. 174.▲
    by nbpoole 15y ago

    From http://www.icann.org/en/topics/new-gtlds/factsheet-new-gtld-... > How much is the evaluation fee? The evaluation fee is estimated at US$185,000. Applicants will be required to pay a US$5,000 deposit fee per requested applicati
25. 175.▲
    by nbpoole 15y ago

    I wonder who's going to register "localhost" or "mail"? ;-) EDIT: There's a list of reserved TLDs that won't be allowed to be registered. It includes localhost (but not mail)! AFRINIC IANA-SERVERS NRO ALAC ICANN RFC-EDITOR APNIC IESG RIPE A
26. 176.▲
    by nbpoole 15y ago

    http://news.ycombinator.com/item?id=2671714 (Summary: Because you can Google at least some of the hashes and find they're already cracked)
27. 177.▲
    by nbpoole 15y ago

    The list I've seen has over 60k entries.
28. 178.▲
    by nbpoole 15y ago

    The crypt'ed MD5 hashes have a special prefix which indicates that's what they are. For the other hashes, the fact that there's no nonce or other value stored alongside them was a strong hint (although it doesn't rule out a site-wide nonce)
29. 179.▲
    by nbpoole 15y ago

    Yes, although some of them (especially for older accounts, which probably haven't been logged into in a while) appear to be unsalted MD5. That's not unusual: it probably means that MtGox used unsalted MD5 at some point in the past and was u
30. 180.▲
    by nbpoole 15y ago

    The title posted here is misleading. Why do you think your blog's traffic numbers imply that Google did something to impact Wordpress.com as a whole?