Live data from Hacker News

This JPEG is also a webpage

lcamtuf.coredump.cx

71–80 of 236 posts

Re: This JPEG is also a webpage

#71
post #46

Earlier quoted context omitted.

Well of course if correctness is not a requirement then it's not being paid attention to. That doesn't in any way indicate that it was a good decision not to require it in the first place.

If it had been made as difficult as possible for enthusiasts learning a markup language to get what was essentially text document to actually display anything, it's probably not too much of an exaggeration to say the World Wide Web wouldn't have existed in its current form. It's not as if many of the web's security holes are related to whether a page displays valid HTML markup or not.

I don't think the assumption is justified that enforcing well-formed HTML documents would have been a significant barrier. To me it actually seems easier to have a few simple and strictly enforced rules than having a more or less random assortment of exception to save a handful of key strokes.

Re: This JPEG is also a webpage

#73
post #23

Earlier quoted context omitted.

A quick search for "striped ground squirrel" turned up only one variety, the thirteen-lined ground squirrel. The animal in the photo has stripes like a chipmunk.

Look for stripes on the face: without them, it's probably a squirrel. Both ground squirrels and chipmunks have body stripes, so the face is a better indicator. http://naturemappingfoundation.org/natmap/facts/chipmunk_vs_... http://www.differencebetween.info/difference-between-squirre...

You're right, there's no stripes on its face. I stand corrected.

Sadly, that was my most upvoted comment in ~9.5 years on this site.

Re: This JPEG is also a webpage

#75
You could do the same thing with a .wav file, embedding the HTML after the data sub-chunk. Adobe Audition uses this method to embed application-specific metadata for the file (marker and sub-marker locations, for example).

Re: This JPEG is also a webpage

#76
post #63
post #52

Earlier quoted context omitted.

1. Most Gmail users can receive money by email ( https://support.google.com/mail/answer/3141103 and coredump.cx MX records point to Gmail) 2. Ask him his Bitcoin address 3. Paypal to this address :)

Isn't Google Wallet ded?

No. I use it occasionally.

Re: This JPEG is also a webpage

#77
post #73

Earlier quoted context omitted.

Look for stripes on the face: without them, it's probably a squirrel. Both ground squirrels and chipmunks have body stripes, so the face is a better indicator. http://naturemappingfoundation.org/natmap/facts/chipmunk_vs_... http://www.differencebetween.info/difference-between-squirre...

You're right, there's no stripes on its face. I stand corrected. Sadly, that was my most upvoted comment in ~9.5 years on this site.

Ahh, I was about to unvote you, but now I can't bear to do it. Keep my upvote.

Re: This JPEG is also a webpage

#78

> Pretty radical, eh? Send money to: lcamtuf@coredump.cx How to send money to your email address? Not that I would send you some, but I wondered how you want to have that money received?

Not to be rude, but in the USA (where SWIFT or bank wire transfers can be expensive) an email address as a recipient of an online fund transfer is a pretty common; ie: paypal, venmo, chase quickpay now specifically in this case, lcamtuf (at google security) is joking and doesn't want your money. this hack is actually pretty crazy - an arbitrary HTML / jpeg polyglot file that fooled a browser could be used for js inje…

This has been done in the past. I remember seeing an advisory as far back as 2010, but at the moment can only find these two more recent advisories:

https://websec.io/2012/09/05/A-Silent-Threat-PHP-in-EXIF.htm...

https://blog.sucuri.net/2013/07/malware-hidden-inside-jpg-ex...

The way we protected ourselves against it at (since we allowed image uploads at a variety of locations) was to decode and recode the image before storing and strip out comments.

Re: This JPEG is also a webpage

#79
post #63
post #52

Earlier quoted context omitted.

1. Most Gmail users can receive money by email ( https://support.google.com/mail/answer/3141103 and coredump.cx MX records point to Gmail) 2. Ask him his Bitcoin address 3. Paypal to this address :)

Isn't Google Wallet ded?

No, just pining for the fjords!

But seriously, no, it's alive and kicking... https://www.google.com/wallet/

Page Info shows the last modification was: Thu 31 Mar 2016 01:02:44 PM EDT

I don't personally use it much but I have an account to pay for my domain name though them that I use for Google Apps.

Re: This JPEG is also a webpage

#80
post #63
post #52

Earlier quoted context omitted.

1. Most Gmail users can receive money by email ( https://support.google.com/mail/answer/3141103 and coredump.cx MX records point to Gmail) 2. Ask him his Bitcoin address 3. Paypal to this address :)

Isn't Google Wallet ded?

Only google card, the debit card that was attached to GW.
Post reply on HN