Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

This JPEG is also a webpage

lcamtuf.coredump.cx

Post reply on HN
Print view View original

221–230 of 236 posts

Re: This JPEG is also a webpage

#221

Post by mseebach »

lisper wrote: post #92
loudmax wrote: post #58

You can see this in action for yourself on a unix cli: $ curl -o squirrel.html http://lcamtuf.coredump.cx/squirrel/ $ file squirrel.html squirrel.html: JPEG image data, JFIF standard 1.01, comment: " body { visibility: hidden; } .n { visibilit" Open the file in a browser and read the page. Then: $ mv squirrel.html squirrel.jpg Open the renamed file in a browser and only the image appears. I'm not sure what the securi…

> I'm not sure what the security implications are. You can use this technique to phish signatures. Send someone a document that reads "X" in format A and "Y" in format B. The victim signs file.A thinking they are endorsing X but you can plausibly claim that they signed file.B (because it's the same file) and hence endorsed Y. This is why digital signature standards need to include meta-data, e.g.: https://github.com/…

> but you can plausibly claim

And anyone else can plausibly claim that you carefully forged a file to get a victim to sign it -- the signature will be of the whole file, not just a single view of it.

But that said, you shouldn't sign binary files unless you have a reasonable understanding of what is in it (or trust the party presenting it to you).

Re: This JPEG is also a webpage

#222

Post by gkya »

tomelders wrote: post #217
voltagex_ wrote: post #194

Earlier quoted context omitted.

There's low tolerance for jokes on HackerNews. I'm not entirely sure why, but it is what it is.

To stop the place becoming like reddit, where all insightful comments are buried under a torrent of jokes. I've had my fingers burnt a few times and then sulked for a few days after one of my many hilarious quips was down-voted into oblivion. But ultimately I think it's for the greater good.

My comment stays at 12 upvotes. Certainly nobody would want jokes to surpass serious comments, but this is not achieved by killing every single joke. Also, there's another joke on that thread.

Sth. that one needs to get used to on HN I think... Randomly picking on arguably off-topic and arguably offending posts proactively. Also, I'm shocked seeing that the mod here has so low karma and so short history of HN usage.

Re: This JPEG is also a webpage

#223

Post by castell »

danbruc wrote: post #27

A testament to one of the worst decisions in computing history - not to fail displaying a web page with an error message in case it is not a valid HTML document.

So you are one from the XHTML2 camp then? Good we got HTML5 and good that the weird years of transition to XHTML 1 and unclear vision with XHTML2 and ECMAScript for XML (E4X) are long gone.

Re: This JPEG is also a webpage

#224

Post by StavrosK »

fizzbatter wrote: post #69
StavrosK wrote: post #20

Earlier quoted context omitted.

No, the JPEG header is at the start of the file, unlike the PNG which is at the bottom.

Pardon my ignorance, but what does that matter? There's an important note in that the HTML is not at the true start of the JPEG file, it's slightly after. You can even view some of the JPEG format bytes if you view source of the HTML. So if the browser ignores some of the JPEG file, why not most of the PNG file? Perhaps you run the risk of some random byte screwing up the HTML though.. not sure.

Oh, you're right. I was thinking of the combined zip/png, and it's the zip file that has the header at the bottom, so my previous comment is completely wrong. The article seems to be adding the HTML in the EXIF data (thus making it a completely valid JPEG) and the browser tries to be very accommodating in what it accepts, thus ignoring the junk data (or what it thinks is junk data) at the start of the HTML file.

Whether JS would work or not depends on how much the browser tries to recover from errors there. I would guess not much, but what would you gain from a combined JS/JPEG file anyway?

Re: This JPEG is also a webpage

#225

Post by SmellyGeekBoy »

I'm surprised nobody in this thread has mentioned PICO-8, a "virtual console" which compresses its "cartridges" in the form of a PNG file. When viewed in a browser or on a computer the file is displayed as a neat stylised image of a cartridge with a description, box art etc but when opened in the PICO-8 executable reveals all of the game code, art and music/sound assets in fully uncompressed editable form. The cartridges can be shared freely on sites that leave the original file intact without re-compressing. Nifty!

http://www.lexaloffle.com/pico-8.php

Re: This JPEG is also a webpage

#226

Post by SmellyGeekBoy »

gcb0 wrote: post #202
slice-beans wrote: post #155

Earlier quoted context omitted.

Here's the request and response from router: http://pastebin.com/e7rxLsGJ The router itself is a BT Internet (UK) branded one. Not sure of the exact model but I'll try to find out...

the fact that it encodes "/" on a part of the url in a parameter, but not on another is a very good indication that whatever this 'feature' is doing is badly thought out and the implementation was done by the intern.

This pretty much describes the entire BT HomeHub firmware, to be honest.

Re: This JPEG is also a webpage

#227

Post by tomelders »

gkya wrote: post #222
tomelders wrote: post #217

Earlier quoted context omitted.

To stop the place becoming like reddit, where all insightful comments are buried under a torrent of jokes. I've had my fingers burnt a few times and then sulked for a few days after one of my many hilarious quips was down-voted into oblivion. But ultimately I think it's for the greater good.

My comment stays at 12 upvotes. Certainly nobody would want jokes to surpass serious comments, but this is not achieved by killing every single joke. Also, there's another joke on that thread. Sth. that one needs to get used to on HN I think... Randomly picking on arguably off-topic and arguably offending posts proactively. Also, I'm shocked seeing that the mod here has so low karma and so short history of HN usage.

The system is far from perfect, but I've never got the impression that the rules are applied malevolently. I wouldn't like the job of moderating comments, it's really hard and ironically people tend to have a zero tolerance policy if they feel hard done to by an error in judgement on behalf of the mods.

Re: This JPEG is also a webpage

#229

Post by sundarurfriend »

Jaruzel wrote: post #219
slice-beans wrote: post #212

Earlier quoted context omitted.

I visited some other black listed sites .> and discovered the pattern, then dug around in the router settings to see what had changed. Disabling parental controls sorted it and I can now see the squirrel/chipmunk/unidentified rodent. Lesson learned: just use a VPN.

> I visited some other black listed sites .> Is that an ASCII representation of what I think it is? (a well known .cx site)

I saw it as just a 'shifty-eyes' emoticon, but then again I don't know of said .cx-site so I maybe missing it.

Re: This JPEG is also a webpage

#230

Post by lisper »

mseebach wrote: post #221
lisper wrote: post #92

Earlier quoted context omitted.

> I'm not sure what the security implications are. You can use this technique to phish signatures. Send someone a document that reads "X" in format A and "Y" in format B. The victim signs file.A thinking they are endorsing X but you can plausibly claim that they signed file.B (because it's the same file) and hence endorsed Y. This is why digital signature standards need to include meta-data, e.g.: https://github.com/…

> but you can plausibly claim And anyone else can plausibly claim that you carefully forged a file to get a victim to sign it -- the signature will be of the whole file, not just a single view of it. But that said, you shouldn't sign binary files unless you have a reasonable understanding of what is in it (or trust the party presenting it to you).

> And anyone else can plausibly claim that you carefully forged a file to get a victim to sign it

Yes, of course, but by the time someone realizes this the damage may already have been done.

> you shouldn't sign binary files

There are a lot of things that people shouldn't do that they do nonetheless.

Post reply on HN