Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

This JPEG is also a webpage

lcamtuf.coredump.cx

Post reply on HN
Print view View original

171–180 of 236 posts

Re: This JPEG is also a webpage

#171

Post by slice-beans »

fosk wrote: post #157
slice-beans wrote: post #155

Earlier quoted context omitted.

Here's the request and response from router: http://pastebin.com/e7rxLsGJ The router itself is a BT Internet (UK) branded one. Not sure of the exact model but I'll try to find out...

Besides the model number, can you also tell us the firmware version?

BT Home Hub 5 (Type A) Software version 4.7.5.1.83.8.204.1.11

But, false alarm anyway, nothing interesting is happening. The firmware had updated and reset parental control settings on the router. The domain is on some blacklist apparently so it was redirecting to a page to finalise parental control preferences.

Sorry it wasn't any more interesting than that.

Edit: the reason it took me a while to figure this out was that the settings page it was redirecting to was nothing to do with parental controls!

Re: This JPEG is also a webpage

#172

Post by alanh »

slice-beans wrote: post #155
alanh wrote: post #116

Earlier quoted context omitted.

Well now, that is interesting… deep packet inspection? or just a truly insane bug? What router is it?

Here's the request and response from router: http://pastebin.com/e7rxLsGJ The router itself is a BT Internet (UK) branded one. Not sure of the exact model but I'll try to find out...

"Deployed on one out of four residential gateways globally, Cisco Videoscape OpenRG is the industry's most widely used residential gateway software." -- Cisco

At least we know a little about the software issuing this redirect!

Re: This JPEG is also a webpage

#173

Post by gioele »

krapp wrote: post #70
amavisca wrote: post #54

This site uses the xmp tag (deprecated in HTML 3.2, removed in HTML5) which I found interesting and had never seen! https://developer.mozilla.org/en-US/docs/Web/HTML/Element/xm... It's similar to the pre tag but doesn't require the escaping. I guess you just have to make sure you don't have a closing xmp tag :)

is great when you absolutely, positively, do not want any entities rendered under any circumstances. It's unfortunate that it's being deprecated, since it has its uses.

> is great when you absolutely, positively, do not want any entities rendered under any circumstances. It's unfortunate that it's being deprecated, since it has its uses.

  > will not interpreted ]]>
There is no need for special-casing xmp, when SGML and XML already define CDATA escapes.

Re: This JPEG is also a webpage

#175

Post by michaelmior »

mkagenius wrote: post #137
michaelmior wrote: post #106

Earlier quoted context omitted.

This is why it's important to correctly set the Content-Type header when serving files. Also why it's a good idea to have user-uploaded content served from a separate domain.

Some browsers might try to sniff the mime type, so an additional header would help : "X-Content-Type-Options: nosniff"[1] 1. https://blogs.msdn.microsoft.com/ie/2008/09/02/ie8-security-...

Thanks! I remembered something like that existing but I couldn't remember the header name :)

Re: This JPEG is also a webpage

#176

Post by rad_gruchalski »

slice-beans wrote: post #171
fosk wrote: post #157

Earlier quoted context omitted.

Besides the model number, can you also tell us the firmware version?

BT Home Hub 5 (Type A) Software version 4.7.5.1.83.8.204.1.11 But, false alarm anyway, nothing interesting is happening. The firmware had updated and reset parental control settings on the router. The domain is on some blacklist apparently so it was redirecting to a page to finalise parental control preferences. Sorry it wasn't any more interesting than that. Edit: the reason it took me a while to figure this out was…

The HomeHub 5 is a Thomson (Technicolor) router, if I remember correctly.

Re: This JPEG is also a webpage

#177

Post by jdiez17 »

TazeTSchnitzel wrote: post #147
Houshalter wrote: post #143

Earlier quoted context omitted.

There's nothing wrong with some tolerance, like ignoring tags that it doesn't know. But if the syntax is wrong, it shouldn't try to fix it or guess what the user meant, just display an error. Accepting invalid syntax means all HTML parsing becomes vastly more complicated. Which creates room for bugs, exploits, and unexpected situations like OP's post.

> But if the syntax is wrong, it shouldn't try to fix it or guess what the user meant, just display an error. Accepting invalid syntax means all HTML parsing becomes vastly more complicated. Why push the complexity onto the user? Someone who just wants to make a working website doesn't care about your pedantry. Do they want their page to fail to render entirely when PHP outputs a warning? Do they want their website t…

> Do they want their page to fail to render entirely when PHP outputs a warning?

Displaying warnings is fine. Invalid XHTML, less so.

> Do they want their website to be completely broken because they forgot to convert some of their text from Latin-1 to UTF-8 before pasting it into the document?

The encoding of the content has nothing to do with the document markup.

> Moreover, strictness can backfire when you have such a diversity of implementations.

On the contrary: this prevents subtle bugs in the interpretation of invalid data by different implementations.

Re: This JPEG is also a webpage

#178

Post by jschwartzi »

metrognome wrote: post #75

You could do the same thing with a .wav file, embedding the HTML after the data sub-chunk. Adobe Audition uses this method to embed application-specific metadata for the file (marker and sub-marker locations, for example).

WAV is actually a specialization of an old container format called RIFF. RIFF allows for extensibility by allowing the embedding of arbitrary data.

So this is technically a legitimate use of RIFF because it's designed to support multi-purpose contents, not just PCM data.

Re: This JPEG is also a webpage

#180

Post by Viper007Bond »

qz_ wrote: post #63
mrb wrote: post #52

Earlier quoted context omitted.

1. Most Gmail users can receive money by email ( https://support.google.com/mail/answer/3141103 and coredump.cx MX records point to Gmail) 2. Ask him his Bitcoin address 3. Paypal to this address :)

Isn't Google Wallet ded?

Nope! I pay my rent using it for example.
Post reply on HN