anglebracket

6 ms·

1.
by anglebracket 8y ago
Yes, this isn't even the first cross-domain leakage attack on iframes using CSS. [0] There were similar issues with how hit testing was implemented for `document.elementFromPoint()`[1], and probably tons of other things I'm forget
2.
by anglebracket 8y ago
That's similar to what Kaminsky proposed with Iron Frame[0], but obviously it'd have to be opt-in. Applying Iron Frame-like rendering to all iframes would break a lot of content. [0]: https://dankaminsky.com/2015&#
3.
by anglebracket 9y ago
Not a great sign when they have only a handful of pages and still manage to have super basic XSS issues.
4.
by anglebracket 9y ago
I don't believe so. emacs-slack uses their official OAuth2 + Websocket integration https://github.com/yuya373/emacs-slack#how-to-get-token-the-...
5.
by anglebracket 9y ago
Generally if you have a CSP without `unsafe-inline` you'd have have a policy that would restrict all subresources (`default-src 'none'`,) then punch holes in the policy by resource type (`img-src`, `script-src`, etc.) For ex.
6.
by anglebracket 9y ago
They shouldn't. These examples all rely on being able to cause an image load on a host the attacker controls if the CSS rule is applied. reddit blocks stylesheets that reference off-site resources. See https://github.com&#x2
7.
by anglebracket 9y ago
> The screenshot of their app on the iOS App Store shows a bunch of credible logos of their mentions, but then quotes "VyperVPN is the best service on the market" as coming from a reddit comment by a random user. Questionable t
8.
by anglebracket 10y ago
Yep, you can see that Ubuntu has been backporting security fixes: https://launchpad.net/ubuntu/+source/curl/7.47.0-1ubuntu2.1
9.
by anglebracket 10y ago
Interesting! I haven't spent much time looking at OS X internals, but I'll remember this for next time. Have any resources for other OS X quirks like this?
10.
by anglebracket 10y ago
>i've never seen the 'my' keyword before, what exactly is this language? It's Perl: http://perldoc.perl.org/functions/my.html
11.
by anglebracket 10y ago
As a workaround you can go to "View > Page Style > No style". It honestly reads just fine without CSS.
12.
by anglebracket 10y ago
To JetBrains' credit they were very responsive throughout the disclosure process. I received a reply to my initial report in under two hours. Generally response times are measured in days unless you know someone in the company. They al
13.
by anglebracket 10y ago
No, all that's necessary to trigger it is browsing to a page containing attacker-controlled JavaScript or Flash. The browser on your own computer would be connecting to the server on your own computer, and firewalls tend to only block
14.
by anglebracket 11y ago
As far as I'm aware, Unity does not have JavaScript. It has the superficially similar "UnityScript" [0]. [0]: http://wiki.unity3d.com/index.php/UnityScript_versus_JavaScr...
15.
by anglebracket 11y ago
See https://github.com/JdeH/Transcrypt/blob/master/Transcrypt/de... There are spaces before subscript operators, before `.method()` calls, and between `def name` and `(param1, param2)`.
16.
by anglebracket 11y ago
That's fair. My point was that in reality, a ton of people end up doing it wrong in some way or another. You should cover your bases and keep your systems up to date with security patches regardless of how segregated you believe they a
17.
by anglebracket 11y ago
> Often there is no need to install updates at all on machines [...] like HVAC and SCADA systems Which, incidentally, have been the target of a lot of recent high-profile attacks.[0][1][2][3] [0] https://en.wikipedia.org/
18.
by anglebracket 11y ago
https://web.archive.org/web/20150811052336/https://blogs.ora...
19.
Seizing Control of Yahoo Mail Cross-Origin Again(blog.saynotolinux.com)
52 points by anglebracket 12y ago|1 comments
20.
by anglebracket 12y ago
Any number of things can out you as a fake. Whether or not the request's Accept-Encoding has sdch, can help you figure out if something's Chrome. You can also abuse parsing quirks to figure out which rendering engine's being
21.
by anglebracket 13y ago
>The attack made the code throw and exception and some of my escaping characters caused havoc with their error logger Heh, something similar happened to me during a recent audit. I didn't even know until an admin emailed me saying t
22.
by anglebracket 13y ago
True, but just because you trust someone to access the dashboard doesn't mean you trust them to execute code on your server. There are other things to consider as well, like MITM attacks, and that an XSS hole would let the attacker set
23.
by anglebracket 13y ago
Hmm, all these eval() calls using data from cookies[0]... is this vulnerable to remote code execution? I think those eval() calls should be json.loads(). [0] https://github.com/k3oni/pydash/blob/1317771275aa11
24.
by anglebracket 13y ago
That was my thought too, the candidate spec for this[0] seems to have taken that into consideration by requiring the scripts to be served with an `Access-Control-Allow-Origin: <origin>` header. Since the server needs to grant you full
25.
by anglebracket 13y ago
The polyfill would need to be in javascript, this is just a candidate spec and isn't actually implemented anywhere yet. Obviously it wouldn't be needed if it was implemented natively. I'm just not sure if it makes any sense t
26.
by anglebracket 13y ago
> Perhaps it's about time we had a way to specify the hash of <script> source inline so browsers can serve files from cache even if they are from different origins A spec for just that was recently proposed[0], it even has sup
27.
by anglebracket 13y ago
I was responding to the parent's unwillingness to audit the code, not so much about technical issues with PHP. The biggest security issue that I've noticed with PHP is more cultural: Developers are far more likely to write ad-hoc
28.
by anglebracket 13y ago
It doesn't take input from the user, but it does use untrusted input in a way that allows XSS. See https://news.ycombinator.com/item?id=7128442 .
29.
by anglebracket 13y ago
> WRONG. Because you have to use mysql_REAL_escape_string. Using mysql_real_escape_string is almost a sign you're doing something wrong. You should be using prepared statements with PDO or mysqli. > The point is that I can't
30.
by anglebracket 13y ago
> Works in Chrome. Hmm, looks like Chrome isn't respecting the Public suffix list for setting cookies ATM, even though the site for the list claims that it does.[0] For an example, view [1] and [2] in Chrome, and note that cookies s

More ›