is it just me, or is tweeting into the void kinda sad?
How do new accounts start on twitter then?
Thoughts.page: hosting a small webpage for your thoughts
41–50 of 111 posts
Re: Thoughts.page: hosting a small webpage for your thoughts
#42Earlier quoted context omitted.
In Norway, everyone's income is public information. Other countries could do the same to make things more transparent.
Never heard of it, can’t really imagine how that would work out in other countries. Is it a somewhat new regulation? Is it easy to access the information?
It's actually a fairly long tradition, it's only been online for the previous decade or so. I'ts easy to access, it's just that for the last few years, you can also see if someone has checked your taxes and who they are.
Re: Thoughts.page: hosting a small webpage for your thoughts
#43Earlier quoted context omitted.
Oh boy. Didn't think I'd see something like this in $CURRENT_YEAR.
I didn't either until I started my current job back in April and found them in a frenzy trying to firstly figure out what XSS is and secondly trying to patch all their systems before the end of the month. Fun times.
[deleted]
Re: Thoughts.page: hosting a small webpage for your thoughts
#44Earlier quoted context omitted.
In Norway, everyone's income is public information. Other countries could do the same to make things more transparent.
Never heard of it, can’t really imagine how that would work out in other countries. Is it a somewhat new regulation? Is it easy to access the information?
I think it's a Nordic thing. Tax records (including recorded income) are also public in Finland, and apparently Sweden has something similar. [1]
In case of Finland, the current legislation that makes tax information public was originally introduced in 1999 but I can't remember whether the records were also public (based on some other regulation) prior to that or not. In any case, it's not that recent. The Reuters article says Norway has had public tax information since 1863, but I don't personally know anything more about that.
AFAIK anybody's tax records are basically a phone call away. You can't just google for the information, though. I don't know how it works in Norway. (Edit: but apparently the sibling replies do.)
[1] https://www.reuters.com/article/us-panama-tax-nordics-idUSKC...
Re: Thoughts.page: hosting a small webpage for your thoughts
#45This site is subject to severe XSS via the post mechanism. Just entering alert(1) works. So be careful when going to links. See https://hacker.thoughts.page for a demo
Tools such as Zap and Burp Suite are great for web devs who want to learn how to build secure websites. I highly recommend them:
Re: Thoughts.page: hosting a small webpage for your thoughts
#46I wish there were kind of a Twitter where people would just post their thoughts (even those controversial), there would be no marketing of any kind, no personality and no flame wars. And all the posts would be organized by subjects.
A blog?
A microblog. But without strict length limits. Also without post titles. Without comments, responses and mentions. Without personal branding. Easy to discover together with many others. Easy to subscribe. Quick to read. Controversial thoughts allowed but guarded both against attacks by those who disagree/dislike and against abuse by bots/propaganda/marketing. Monetization/promotion not allowed.
Re: Thoughts.page: hosting a small webpage for your thoughts
#47This site is subject to severe XSS via the post mechanism. Just entering alert(1) works. So be careful when going to links. See https://hacker.thoughts.page for a demo
What's the output for alert(document.domain)?
Re: Thoughts.page: hosting a small webpage for your thoughts
#48This site is subject to severe XSS via the post mechanism. Just entering alert(1) works. So be careful when going to links. See https://hacker.thoughts.page for a demo
Tools such as Zap and Burp Suite are great for web devs who want to learn how to build secure websites. I highly recommend them: https://owasp.org/www-project-zap/ https://portswigger.net/burp
The creators of Burp suite have some courses as well: https://portswigger.net/web-security
Re: Thoughts.page: hosting a small webpage for your thoughts
#49This site is subject to severe XSS via the post mechanism. Just entering alert(1) works. So be careful when going to links. See https://hacker.thoughts.page for a demo
This is not called XSS.
This is just user generated html on subdomains.
Github does the same on github.io. Everybody can make a theirname.github.io page and alert whatever they like too.
So does Gitlab on yourname.gitlab.io, Wordpress on yourname.wordpress.com etc. It is a common practice.
Re: Thoughts.page: hosting a small webpage for your thoughts
#50This site is subject to severe XSS via the post mechanism. Just entering alert(1) works. So be careful when going to links. See https://hacker.thoughts.page for a demo
Hey! I'm the person who made this — I don't believe there's an actual problem here, since login cookies are set on the top-level domain (and thus are inaccessible to content on subdomains), and are HTTPOnly as well.
I do notice that Stripe sets a tracking cookie (which only happens for people who pay for the service, since I don't load the Stripe JS elsewhere), so you could track pageviews with that or something. That's unfortunate — I'll probably try to move the stripe stuff to a subdomain to avoid it — but I don't see it as a big problem.
The HTTP security model is pretty awful, so there may be something I'm missing, but I did think quite carefully about this, and allowing people to use arbitrary HTML and JS was an intentional choice.
Is there a particular threat model you see here?