Live data from Hacker News

This JPEG is also a webpage

lcamtuf.coredump.cx

131–140 of 236 posts

Re: This JPEG is also a webpage

#131
post #45

Earlier quoted context omitted.

I kinda agree, but one has to concede that XHTML has failed for a reason.

XHTML failed because doing the old, broken, tag-soupy mess still worked exactly as well from the user perspective. You just can't get people to work harder for invisible benefits. In a sense, it's a reason, but it doesn't mean that tag soup is a good thing. I often wonder how different the internet would be if Postel's prescription never gained traction and fail-fast behavior were the norm instead.

Also because all of the tooling was terrible and extensibility was non-existent. It's easy to imagine a world where XHTML worked out better because the browsers provided clear, informative errors rather than a blank page, someone at the W3C cared enough to have a usable validator which produced helpful warnings and errors, and attention was paid to the less friendly bits of the XML ecosystem[1].

Instead, it felt like we had a bunch of people who though that big lofty standards were so obviously correct that everyone else would take care of those boring implementation details, and 99.9999% of web developers correctly realized that there was very little measurable downside to sticking with something which was known to work.

1. Simple examples: namespacing is a good idea but it leads to gratuitous toil in most tools – e.g. a valid XML document which has should just work if you write a selector for /foo, as present in the document, rather than requiring you to do kludgey things like have to lard up every parser registering the same namespaces which are also declared in the document and writing fully-qualified selectors like /mychosenprefix:foo or /{http://example.org/fooschema/1.0}foo for every tag, every time.

Similarly, getting XPath 2.0 support to actually ship in enough tools to be usable would have made one of the better selling points for using XML actually exist as far as the average working programmer is concerned.

Re: This JPEG is also a webpage

#132
post #97
post #91

Earlier quoted context omitted.

Looks like some non-ascii characters didn't make the jump to hyperspeed, either, unless your friend really is named Nicolás Alvarez

It was looking fine on my end, but I realized I wasn't setting an encoding on the page. Should be UTF-8 now and not cause any more problems. Thanks for pointing it out!

This link at the beginning seems to be not working: https://demoparty.mozillalabs.com/

Re: This JPEG is also a webpage

#134

>No server-side hacks involved I doubt this. In request with Accept:"image/png,image/ ;q=0.8, /*;q=0.5" server souldn't respond with something with Content-Type:"text/html"

mkdir -p ~/tmp/squirrel

cd ~/tmp/squirrel

wget -O index.htm http://lcamtuf.coredump.cx/squirrel/

firefox index.htm

Alternately, using an actual webserver instead of opening a file://

python3 -m http.server &

firefox http://127.0.0.1:8000/

Also works.

Note that the actual img tag has src="#" so when you are looking at the file opened locally, the image is also from local disk, not from his server, so it's legit.

However, the fact that it needs to be identified as a HTML file by the server implies to me that the idea others had ITT of abusing image hosting sites using this trick probably won't work.

Re: This JPEG is also a webpage

#136
post #97

Earlier quoted context omitted.

It was looking fine on my end, but I realized I wasn't setting an encoding on the page. Should be UTF-8 now and not cause any more problems. Thanks for pointing it out!

This link at the beginning seems to be not working: https://demoparty.mozillalabs.com/

Yep, it's inactive. New URL is http://www.mozillalabs.com/en-US/demo-party/

Re: This JPEG is also a webpage

#137
post #96

Earlier quoted context omitted.

there are websites where you can upload files such as images, but they filter html for security reasons. if you can present that html to someone (eg. through deeplinking an iframe to the document), it could contain (or load) javascript that runs in the context of that site...

This is why it's important to correctly set the Content-Type header when serving files. Also why it's a good idea to have user-uploaded content served from a separate domain.

Some browsers might try to sniff the mime type, so an additional header would help : "X-Content-Type-Options: nosniff"[1]

1. https://blogs.msdn.microsoft.com/ie/2008/09/02/ie8-security-...

Re: This JPEG is also a webpage

#138

Earlier quoted context omitted.

Being flexible about what markup is accepted has meant the web could gain new features and gracefully degrade, and has made it more fault-tolerant. It's not at all a failing. Compare that to JavaScript, which will happily fail if you use new syntax or a missing function, and thus web pages which rely on JS often show up as just a full screen of white when something goes wrong, which it frequently does. That's not to…

> Compare that to JavaScript, which will happily fail if you use new syntax or a missing function, and thus web pages which rely on JS often show up as just a full screen of white when something goes wrong, which it frequently does. Isn't that more due to failure to handle exceptions and display errors to users?

Silent failure or not, the page still doesn't work.
Post reply on HN