Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

This JPEG is also a webpage

lcamtuf.coredump.cx

Post reply on HN
Print view View original

51–60 of 236 posts

Re: This JPEG is also a webpage

#51

Post by eyelidlessness »

danbruc wrote: post #36
rimantas wrote: post #30

Earlier quoted context omitted.

Or one of the best. Switch wen browsers to strict processong and you will hardly find working web page.

Which are the faults of the authors. No one expects malformed source code to compile, a video with corrupted headers to play properly or a binary containing invalid instructions not to crash. This decision allowed people to get away with broken web pages instead of forcing them to fix their mistakes.

It's a better web environment than it was years ago, but there was a time that even simple layouts required invalid code to display similarly across the browsers of the time.

Re: This JPEG is also a webpage

#52

Post by mrb »

tomw1808 wrote: post #32

> Pretty radical, eh? Send money to: lcamtuf@coredump.cx How to send money to your email address? Not that I would send you some, but I wondered how you want to have that money received?

1. Most Gmail users can receive money by email (https://support.google.com/mail/answer/3141103 and coredump.cx MX records point to Gmail)

2. Ask him his Bitcoin address

3. Paypal to this address

:)

Re: This JPEG is also a webpage

#54

Post by amavisca »

This site uses the xmp tag (deprecated in HTML 3.2, removed in HTML5) which I found interesting and had never seen!

https://developer.mozilla.org/en-US/docs/Web/HTML/Element/xm...

It's similar to the pre tag but doesn't require the escaping. I guess you just have to make sure you don't have a closing xmp tag :)

Re: This JPEG is also a webpage

#55

Post by 45h34jh53k4j »

tomw1808 wrote: post #32

> Pretty radical, eh? Send money to: lcamtuf@coredump.cx How to send money to your email address? Not that I would send you some, but I wondered how you want to have that money received?

Not to be rude, but in the USA (where SWIFT or bank wire transfers can be expensive) an email address as a recipient of an online fund transfer is a pretty common; ie: paypal, venmo, chase quickpay

now specifically in this case, lcamtuf (at google security) is joking and doesn't want your money.

this hack is actually pretty crazy - an arbitrary HTML / jpeg polyglot file that fooled a browser could be used for js injection, say from a site that allowed jpeg file uploads, and validated mime type.

Re: This JPEG is also a webpage

#56

Post by notahacker »

nolok wrote: post #46
rimantas wrote: post #30

Earlier quoted context omitted.

Or one of the best. Switch wen browsers to strict processong and you will hardly find working web page.

Well of course if correctness is not a requirement then it's not being paid attention to. That doesn't in any way indicate that it was a good decision not to require it in the first place.

If it had been made as difficult as possible for enthusiasts learning a markup language to get what was essentially text document to actually display anything, it's probably not too much of an exaggeration to say the World Wide Web wouldn't have existed in its current form.

It's not as if many of the web's security holes are related to whether a page displays valid HTML markup or not.

Re: This JPEG is also a webpage

#58

Post by loudmax »

You can see this in action for yourself on a unix cli:

  $ curl -o squirrel.html http://lcamtuf.coredump.cx/squirrel/
  $ file squirrel.html
  squirrel.html: JPEG image data, JFIF standard 1.01, comment: "body { visibility: hidden; } .n { visibilit"
Open the file in a browser and read the page. Then:

  $ mv squirrel.html squirrel.jpg
Open the renamed file in a browser and only the image appears.

I'm not sure what the security implications are. I'm not creative or devious enough to think of anything offhand, but a lot of attack vectors start off with this sort of misdirection.

Re: This JPEG is also a webpage

#59

Post by TazeTSchnitzel »

danbruc wrote: post #27

A testament to one of the worst decisions in computing history - not to fail displaying a web page with an error message in case it is not a valid HTML document.

Being flexible about what markup is accepted has meant the web could gain new features and gracefully degrade, and has made it more fault-tolerant. It's not at all a failing.

Compare that to JavaScript, which will happily fail if you use new syntax or a missing function, and thus web pages which rely on JS often show up as just a full screen of white when something goes wrong, which it frequently does. That's not to say JS should be as flexible as HTML is here, but it provides an interesting contrast.

Re: This JPEG is also a webpage

#60

Post by gkya »

C'mon, don't be so stingy, give him a Ben at least :)

   _____________________________________________________________________
  |                                                                      |
  |  =================================================================== |
  | |%/^\\%&%&%&%&%&%&%&%&{ Federal Reserve Note }%&%&%&%&%&%&%&%&//^\%| |
  | |/inn\)===============------------------------===============(/inn\| |
  | |\|UU/              { UNITED STATES OF AMERICA }              \|UU/| |
  | |&\-/     ~~~~~~~~   ~~~~~~~~~~=====~~~~~~~~~~~  P8188928246   \-/&| |
  | |%//)     ~~~_~~~~~          // ___ \\                         (\\%| |
  | |&(/  13    /_\             // /_ _\ \\           ~~~~~~~~  13  \)&| |
  | |%\\       // \\           :| |/ ~ \| |:  3.21  /|  /\   /\     //%| |
  | |&\\\     ((iR$)> }:P ebp  || |"- -"| ||        || |||| ||||   ///&| |
  | |%\\))     \\_//      sge  || (|e,e|? ||        || |||| ||||  ((//%| |
  | |&))/       \_/            :| `._^_,' |:        || |||| ||||   \((&| |
  | |%//)                       \\ \\=// //         || |||| ||||   (\\%| |
  | |&//      R265402524K        \\U/_/ //   series ||  \/   \/     \\&| |
  | |%/>  13                     _\\___//_    1932              13
source: http://chris.com/ascii/index.php?art=objects/money
Post reply on HN