41–45 of 45 posts
Earlier quoted context omitted.
What made you believe this is the support site for either Scribd or Google Chrome?
The guy who founded Scridb is here as well as tons of googlers.
Earlier quoted context omitted.
The guy who founded Scridb is here as well as tons of googlers.
I am also here, and read a lot of what happens on HN; but, if my users decide to start using this as a support site for Cydia, especially so in aside comments on stories that are not even about Cydia, I will be sad: there are more appropriate and efficient channels for that sort of thing.
If you are not Internet famous I imagine you could do a lot worse than HN comments.
Earlier quoted context omitted.
There is a long history of such dialogs being used to exploit browsers and cause the execution of arbitrary code. For instance, such a dialog may be used to generate a true user click event, which the browser may then treat differently than an event that can be faked by Javascript. This entices malware developers to create dialogs in which you'll click on something, they don't really care what, they just need an auth…
Oh the plight of a Windows user. I know what you're talking about with click jacking. The implication that a "true click" is any more likely to allow a JavaScript exploit to escape the browser sandbox is complete and utter bullshit. If you can give me one example, I won't scowl at the fact that 6 other people downvoted me without saying why.
And the answer is, the browser will stop them. It treats stuff that sources from a click differently. If it didn't, there would be no "clickjacking", the attackers would simply redirect you to the desired URL. The very existence of the term is evidence. It doesn't escape the sandbox, it gets raised privs from the sandbox by design.
Earlier quoted context omitted.
Seriously, try Go for a while, it wont take long before you feel that you have three hands, and more importantly, an extra third eye.
Can you give an example in Go of how you'd solve the same problem as any of the python solutions?
[1]: https://groups.google.com/d/msg/golang-nuts/LQMv7Zsmsi0/8Aax...
[2]: https://github.com/jteeuwen/go-bindata
[3]: http://stackoverflow.com/questions/9838304/resource-bundling...
Earlier quoted context omitted.
Oh the plight of a Windows user. I know what you're talking about with click jacking. The implication that a "true click" is any more likely to allow a JavaScript exploit to escape the browser sandbox is complete and utter bullshit. If you can give me one example, I won't scowl at the fact that 6 other people downvoted me without saying why.
Think about why, if the attacker already has enough control over the page to put up a transparent iframe and bind a click event to it, why not just do the thing the attacker is trying to attack you with? And the answer is, the browser will stop them. It treats stuff that sources from a click differently. If it didn't, there would be no "clickjacking", the attackers would simply redirect you to the desired URL. The ve…
What on Earth does this have to do with vulnerabilities in the browser? Like I said, show me a single example of a vulnerability that is only exploited via a "true click". They DO NOT EXIST. It's hogwash.
I'll say again, I know what you're talking about. It is NOT relevant in this discussion about vulnerabilities.
Please show me an example otherwise.