Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

This JPEG is also a webpage

lcamtuf.coredump.cx

Post reply on HN
Print view View original

81–90 of 236 posts

Re: This JPEG is also a webpage

#81

Post by JoblessWonder »

nerevarthelame wrote: post #39
tomw1808 wrote: post #32

> Pretty radical, eh? Send money to: lcamtuf@coredump.cx How to send money to your email address? Not that I would send you some, but I wondered how you want to have that money received?

He\she isn't actually expecting payment, just as they don't really think that the trick is "pretty radical." It's just a mildly amusing way of providing contact information.

It is pretty radical in the 80's-90's sense of the word.[0]

[0] http://img03.deviantart.net/ebd4/i/2015/166/9/6/radical_dude...

Re: This JPEG is also a webpage

#82

Post by anonymfus »

aioprisan wrote: post #13

So in theory, can analytics platforms be compromised so that JPEG tracking pixels could turn into full-fledged sites interfering with the parent page at, say, a bank website? Firing off credentials in the background?

If these tracking pixels are in iframe elements instead of img elements.

Re: This JPEG is also a webpage

#86

Post by witty_username »

TazeTSchnitzel wrote: post #59
danbruc wrote: post #27

A testament to one of the worst decisions in computing history - not to fail displaying a web page with an error message in case it is not a valid HTML document.

Being flexible about what markup is accepted has meant the web could gain new features and gracefully degrade, and has made it more fault-tolerant. It's not at all a failing. Compare that to JavaScript, which will happily fail if you use new syntax or a missing function, and thus web pages which rely on JS often show up as just a full screen of white when something goes wrong, which it frequently does. That's not to…

> Compare that to JavaScript, which will happily fail if you use new syntax or a missing function, and thus web pages which rely on JS often show up as just a full screen of white when something goes wrong, which it frequently does.

Isn't that more due to failure to handle exceptions and display errors to users?

Re: This JPEG is also a webpage

#89

Post by Chernobog »

dpark wrote: post #67
ygjb wrote: post #35

Earlier quoted context omitted.

Yeah, imagine if processors gave best effort to processing binaries... what could possibly go wrong :/ The decision to allow this was made early and the liberal accept/strict transmit paradigm has in general made the web a mess. On the plus side, the consistent failure of browser vendors to apply strict controls to input means that as an application security person I will probably never be out of work :D Even though…

> as an application security person I will probably never be out of work How many security flaws are the result of malformed HTML?

Malformed HTML may escape sanitization on input in a vulnerable web app, and still render on the victim's browser because their browser wants to be helpful.

(Yes, the output should have been escaped, but that is sadly not always the case)

Post reply on HN