31–40 of 168 posts
If true, then Uber dropped the ball again when it came to PR.
When a company does something immoral, why do people always say "well that's bad because it's bad PR"? How about, that's bad because it's immoral?
Earlier quoted context omitted.
I don't understand why he didn't make an alert(document.domain), the universal "this is legit" bat signal. Instead, creating some weird form phishing demo? I think there is more to this story, it sounds like this wasn't a "Cross Site Scripting", but "Content Injection" or "Content Spoofing", a far less serious bug. You're gonna hate me, but I would award $0 for Content Injection, it's just not a big deal ¯\_(ツ)_/¯
Initially JavaScript was being escaped with their WAF. The second POC demonstrated the ability to evade both their WAF and XSS_Auditor. Their development team then verified the ability to execute arbitrary JavaScript from any *.cloudfront.net host. That's pretty much the whole story.
If you couldn't, it's plausible the non-security developers incorrectly speculated it was possible?
This is why I see these programs in general as foolish. Either you're an employee of the company and you're being paid as such or you've got a proper contract that specifies objectives and compensation. But these bounty programs that leave all the power in the hands of the company just aren't really a great idea. I wonder how many times something like this happened and it went unreported because the hacker just didn'…
Let me get this straight: there's a company built to exploit the ignorance of people of just how much it costs to drive their own car and the complete disregard of law and you thought while they don't respect their drivers and various governing bodies all over the globe they will respect you ?
Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize.
That "says" can be extended to "says, does, is". What you posted has a lot of indignation but doesn't come close to passing the "strongest plausible" test. Maybe you don't owe better to a corporation, but you owe better to this community if you want to post here.
I'm getting Uber fatigue. This company has been in the news mostly in a negative sense. It 's lost on me what innovation, technologically, or socially, they have brought to the table. Instead, perhaps we can focus on how we can fix this sharing economy, so that we can all benefit; not just the ones who happened to raise the most money from shareholders.
Earlier quoted context omitted.
Initially JavaScript was being escaped with their WAF. The second POC demonstrated the ability to evade both their WAF and XSS_Auditor. Their development team then verified the ability to execute arbitrary JavaScript from any *.cloudfront.net host. That's pretty much the whole story.
Could you make an alert(1) or not? If you couldn't, it's plausible the non-security developers incorrectly speculated it was possible?
I'm getting Uber fatigue. This company has been in the news mostly in a negative sense. It 's lost on me what innovation, technologically, or socially, they have brought to the table. Instead, perhaps we can focus on how we can fix this sharing economy, so that we can all benefit; not just the ones who happened to raise the most money from shareholders.
Start by ditching the term “sharing economy” because there is no “sharing”, person A pays and person B provides some service, so it’s just “economy”.
I'm getting Uber fatigue. This company has been in the news mostly in a negative sense. It 's lost on me what innovation, technologically, or socially, they have brought to the table. Instead, perhaps we can focus on how we can fix this sharing economy, so that we can all benefit; not just the ones who happened to raise the most money from shareholders.
I've often thought it would be cool to build a fairer ride hailing app that gives drivers more autonomy. The driver buys the app as a one time purchase, they get to set their own prices, and there is more transparency between buyer and seller. There could be a simple bidding process where users request a ride, drivers make an offer, and the user accepts one based on price, how far away the driver is, and their review…