chr13

6 ms·

1.
by chr13 12y ago
>"buying 1Gbps uplink is trivial" 1 Gbps dedicated uplink is not trivial everywhere in the world. You also need more quota. Facebook easily crawled more than 1 TB of data during an hour. The more the better may not be best solu
2.
by chr13 12y ago
We also have to remember that these requests are shared between 100+ Facebook server.
3.
by chr13 12y ago
Actually the number of HTTP requests is 180,000+.
4.
by chr13 12y ago
It's not clearly stated. I think what they mean to say is DoS on Facebook using brute force mechanism as testing this would bring down the Facebook system itself. Now manipulating Facebook's server to cause the attack, that'd
5.
by chr13 12y ago
I actually found this bug first in Facebook and later in Google. Facebook said they needed time to think about this and I was hoping they would fix it, so I could not disclose this back then.
6.
Using Facebook Notes to DDoS any website(chr13.com)
18 points by chr13 12y ago|2 comments
7.
A Bug in the Bug Bounty Program – Google Spreadsheet bug(chr13.com)
3 points by chr13 13y ago|0 comments
8.
by chr13 13y ago
Don't want to disclose anything at this point but at least one other huge bandwidth owner suffers from this type of attack. Combined, it is clearly a disaster for any small-medium business.
9.
by chr13 13y ago
May be they should visibly put that FeedFetcher can crawl your website can incur 1TB bandwidth in couple of hours ? May be apache and other httpd should block these crawlers by default ? How else would anyone know about a certain Google f
10.
by chr13 13y ago
Multiple spreadsheets ?
11.
by chr13 13y ago
Thanks, I've updated the post.
12.
by chr13 13y ago
Yes of course. But then do those dynamic images serve any purpose on a spreadsheet ? If a user needs a dynamic image he can download it to his own machine and upload it. Of course if he need many dynamic images, then that's another que
13.
by chr13 13y ago
Indeed, I've quoted that article. But it doesn't talk about random parameters which makes it so easy to attack any website not just your own where you know what the urls are.
14.
A method to use Google for DDoS. Bug or Not? (chr13.com)
104 points by chr13 13y ago|50 comments
15.
by chr13 13y ago
I guess you summed it up. Indeed having more depth in a language is very important and useful, I was just trying to make a point that these aren't the only things. Here is how I perceive a language, It is made up of syntax and behaves
16.
by chr13 13y ago
This is the excerpt from the reply "Sorry it took a while to respond. It took us longer than normal because we have had a few weeks of higher than average volume and this ticket was marked as fixed but we hadn't corresponded back
17.
by chr13 13y ago
Thanks for the reply, that clears things up.
18.
by chr13 13y ago
I think the report number is 173358208.
19.
by chr13 13y ago
So am I and I've mostly used a subset of C features to solve many problems. I've also seen some C 'experts' fail to come to a proper solution even if they know all the features.
20.
by chr13 13y ago
It may not be intentional but what about unintentional fixes ? What happens to bugs that were valid when posted but fixed (unintentionally) right after a release/code deployment.
21.
by chr13 13y ago
You missed a key point, "responsible disclosure". Not only to the company but to the public. I care less about whatever bounty they give or do not give. They could just deny the bug but this lingering is too much. I like Google&#x
22.
Is Facebook Bug Bounty Bogus?
11 points by chr13 13y ago|11 comments
23.
by chr13 13y ago
I guess it depends on what you consider "real problems". One can always write good and efficient code by following what he/she knows is the defined behavior. Just found weird that some things related to standards were given
24.
by chr13 13y ago
I haven't seen these tricks come into play when solving real problems at ALL. Not saying you should not know the language, but better to have problem-solving skills than rot the standard. The bit about leaving a new line after main tel