nbpoole

27 ms·

211.
by nbpoole 15y ago
Fair enough. The article does link to the actual blog post though ( http://www.purehacking.com/blogs/gordon-maddern/skype-0day-v... ).
212.
by nbpoole 15y ago
Unfortunately, it's not so simple. Alerting the public before a fix is out is a double-edged sword: it also means malicious attackers have a chance to replicate the finding and abuse it.
213.
by nbpoole 15y ago
It doesn't happen by chance (usually), but it's not an infrequent occurrence either. Take an example from earlier today: there's a vulnerability in Exim that can allow arbitrary remote code execution ( http://www.vupen.com/english/advisorie
214.
by nbpoole 15y ago
What does XSS have to do with remote code execution? I mean, it's possible for a Javascript parser to have vulnerabilities that can lead to arbitrary code execution, but the Amazon example seems in no way relevant here.
215.
by nbpoole 15y ago
Fair enough: you'll have a pull request shortly. ;-) Edit: Pull request created. https://github.com/jmathai/twitter-async/pull/108
216.
by nbpoole 15y ago
There was a previous HN discussion about this limit at http://news.ycombinator.com/item?id=2263093 . It included some speculation about why Google would limit the number of contacts.
217.
by nbpoole 15y ago
- It's not an issue in IE9: " The prefix JavaScript: is stripped from any text pasted into the IE9 address bar. This mitigates a socially-engineered XSS attack common on social networks wherein users were tricked into performing self-inflic
218.
by nbpoole 15y ago
Did you type it in or copy/paste? Only copy/paste is blocked. Also, keep in mind this is a new feature in IE9. Edit: Just tested again on Windows 7. Pasting javascript:alert(1) caused the javascript: part of the URI to be stripped.
219.
by nbpoole 15y ago
IE9 actually takes care of this to some degree. For example, try pasting javascript:alert(1) into your address bar and hitting enter: the Javascript is blocked. To bypass it, you need to paste part of the URL into the address bar and manual
220.
by nbpoole 15y ago
Security note: Check out the following lines, taken from the PHP API client used by this application ( https://github.com/jmathai/twitter-async/blob/master/EpiOAut... ): curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); curl_setopt
221.
by nbpoole 15y ago
There's a discussion going on at http://news.ycombinator.com/item?id=2510300
222.
by nbpoole 15y ago
Or you can switch to Linode, which provides more resources and a more fully-featured web interface for less money. I switched several months back and I haven't run into a single issue. :) Edit: To be fair to Slicehost, they provided me with
223.
by nbpoole 15y ago
The smart meter probably doesn't transfer that much data under normal circumstances. I'd assume most of the expenses were due to exceeding the "data plan" for the card.
224.
by nbpoole 15y ago
Let me play devil's advocate here. Is there any proof that the companies who are linked to are aware of the links? Isn't it possible that someone else (say, a rival company looking to tarnish a rival's reputation) is buying the links? Or th
225.
by nbpoole 15y ago
A related discussion on HN from yesterday (about a Forbes article that linked to this blog post): http://news.ycombinator.com/item?id=2494461
226.
by nbpoole 15y ago
I just took a look and there appear to be some risks associated with this vulnerability. If you log in to Posterous and check the "Remember me" box, it sets a cookie scoped to .posterous.com (which means it's within the scope of this XSS).
227.
File uploads allow for cross-site scripting in Wordpress(nealpoole.com)
1 points by nbpoole 15y ago|1 comments
228.
by nbpoole 15y ago
This only works for GET requests, but it is useful if you need to make a quick couple of requests and don't want to look up a CGI proxy server.
229.
by nbpoole 15y ago
What's wrong with http://wordpress.org/extend/plugins/syntaxhighlighter/ or http://wordpress.org/extend/plugins/wp-syntax/ ?
230.
by nbpoole 15y ago
You mean like https://developer.mozilla.org/en/Introducing_Content_Securit... ? ;-)
231.
by nbpoole 15y ago
Yes, but Facebook was already filtering out JavaScript: their filter just happened to be slightly broken ;) " According to Facebook, it turned out that some older code was using PHP's built-in parse_url function to determine allowable URLs.
232.
by nbpoole 15y ago
They do, and have for some time (although I can't vouch for the particular algorithm used). fb_dtsg is the usual parameter name. Unfortunately, an XSS vulnerability by its very nature allows an attacker to subvert those protections.
233.
by nbpoole 15y ago
Actually, I'd say that neither of those are really lessons here. Facebook already does #1 (and has for some time). #2 was already understood as part of their threat model (hence why FBJS exists), but a bug allowed an attacker to bypass thei
234.
by nbpoole 15y ago
Spawning a service on a random port that lets unauthenticated users write arbitrary files to your system is a very bad idea. ;-) If you have shell access via SSH, why not just use SFTP? Presumably it's configured as well.
235.
by nbpoole 15y ago
" After Hudson rightfully said no, the engineer responded by hijacking the site, right down to the domain name. And he did a pretty good job of it. No one could help. Other engineers didn’t have the required credentials. His hosting provide
236.
by nbpoole 15y ago
My point is that specifying the radix is a best practice: there are still a number of situations where it's unnecessary for properly functioning code (ie: if you aren't using zero-padded numbers). Specifying the radix certainly helps readab
237.
by nbpoole 15y ago
There's an important distinction between this code and the Math.random() casting that you posted earlier ( http://news.ycombinator.com/item?id=2472223 in case anyone missed it). With parseInt, we're talking about best practices: if you fai
238.
by nbpoole 15y ago
Indeed. Take a look at http://www.google.com/codesearch/p?hl=en#TXS-ndgbCls/trunk/j... for instance: if you weren't looking for an incorrect cast, it would be very hard to notice. Two out of three casts are correct: only one is missing th
239.
by nbpoole 15y ago
That's not true. Try running the following code: public class Test { public static void main(String[] args) { System.out.println("Test: " + (int)Math.random() * 100); System.out.println(
240.
by nbpoole 15y ago
Since that editorial was published (back in 2007), the person who wrote it, Nicholas Merrill, has been "partially un-gagged": he is now able to talk publicly about portions of the case. A followup Washington Post article: http://www.washin

More ›