Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NeoCities

neocities.org

Post reply on HN
Print view View original

101–110 of 222 posts

Re: NeoCities

#101

Post by gohrt »

kyledrake wrote: post #52
slg wrote: post #22

Don't use this for anything you view as important. I just checked and there is no collision detection for usernames. You can signup for an account using any name and your account will seemingly just replace the previous created account. That is a big enough and obvious enough flaw that it also makes we wonder if this is just a phishing expedition or a way to mine email addresses.

I just fixed it. It was a change I did last night to fix a save bug. My apologies about that, it wasn't a good bug, but hopefully it's the last security-related one. Probably goes without saying, but this is definitely a beta project. I'm doing a lot of other things to protect this kind of attack (filename scrubbing, bcrypt passwords), so I'm pretty red in the face about how dumb this one was. If you find any other b…

> hopefully it's the last security-related one

Guaranteed not.

I don't mean for you in particular, security requires constant vigilance.

Re: NeoCities

#102

Post by revelation »

slg wrote: post #22

Don't use this for anything you view as important. I just checked and there is no collision detection for usernames. You can signup for an account using any name and your account will seemingly just replace the previous created account. That is a big enough and obvious enough flaw that it also makes we wonder if this is just a phishing expedition or a way to mine email addresses.

Back then, this wasn't called collision detection, but proper database design. I can not even begin to fathom how you can inadvertently introduce this by fixing a save bug.

Re: NeoCities

#103

Post by kyledrake »

slg wrote: post #97
kyledrake wrote: post #52

Earlier quoted context omitted.

I just fixed it. It was a change I did last night to fix a save bug. My apologies about that, it wasn't a good bug, but hopefully it's the last security-related one. Probably goes without saying, but this is definitely a beta project. I'm doing a lot of other things to protect this kind of attack (filename scrubbing, bcrypt passwords), so I'm pretty red in the face about how dumb this one was. If you find any other b…

You are right, I should have reached out to you directly with this issue. I took the easy route and didn't put in any effort to track you down, for that I am sorry. However, I take exception to you categorizing my post as "trashing other people's work." I feel that I also have a responsibility to publicize such a glaring security hole in your site. This is the number 1 link on HN at the moment. Thousands of people ar…

Here, I'll do one better: If anyone is concerned about the nature/security of the site, here is the source code to NeoCities, ready for anyone to do a full security audit: https://github.com/kyledrake/neocities-web

Pull requests welcome!

Re: NeoCities

#105

Post by Dylan16807 »

slg wrote: post #97
kyledrake wrote: post #52

Earlier quoted context omitted.

I just fixed it. It was a change I did last night to fix a save bug. My apologies about that, it wasn't a good bug, but hopefully it's the last security-related one. Probably goes without saying, but this is definitely a beta project. I'm doing a lot of other things to protect this kind of attack (filename scrubbing, bcrypt passwords), so I'm pretty red in the face about how dumb this one was. If you find any other b…

You are right, I should have reached out to you directly with this issue. I took the easy route and didn't put in any effort to track you down, for that I am sorry. However, I take exception to you categorizing my post as "trashing other people's work." I feel that I also have a responsibility to publicize such a glaring security hole in your site. This is the number 1 link on HN at the moment. Thousands of people ar…

Honestly, the way your first post is worded is harsh enough to come across as 'trashing'.

Re: NeoCities

#106

Post by MarkHarmon »

revelation wrote: post #102
slg wrote: post #22

Don't use this for anything you view as important. I just checked and there is no collision detection for usernames. You can signup for an account using any name and your account will seemingly just replace the previous created account. That is a big enough and obvious enough flaw that it also makes we wonder if this is just a phishing expedition or a way to mine email addresses.

Back then, this wasn't called collision detection, but proper database design. I can not even begin to fathom how you can inadvertently introduce this by fixing a save bug.

Proper database design does not mean the problem couldn't happen. Consider this scenario. The database has a unique constraint on the name but the code ignores the result and overwrites the directory anyways. It wouldn't cause this exact problem but it is similar.

Re: NeoCities

#107

Post by eclipticplane »

slg wrote: post #97
kyledrake wrote: post #52

Earlier quoted context omitted.

I just fixed it. It was a change I did last night to fix a save bug. My apologies about that, it wasn't a good bug, but hopefully it's the last security-related one. Probably goes without saying, but this is definitely a beta project. I'm doing a lot of other things to protect this kind of attack (filename scrubbing, bcrypt passwords), so I'm pretty red in the face about how dumb this one was. If you find any other b…

You are right, I should have reached out to you directly with this issue. I took the easy route and didn't put in any effort to track you down, for that I am sorry. However, I take exception to you categorizing my post as "trashing other people's work." I feel that I also have a responsibility to publicize such a glaring security hole in your site. This is the number 1 link on HN at the moment. Thousands of people ar…

I don't think he was saying you were trashing his work, more that people were using that exploit to trash other people's sites on NeoCities.

Re: NeoCities

#108

Post by genesee »

slg wrote: post #97
kyledrake wrote: post #52

Earlier quoted context omitted.

I just fixed it. It was a change I did last night to fix a save bug. My apologies about that, it wasn't a good bug, but hopefully it's the last security-related one. Probably goes without saying, but this is definitely a beta project. I'm doing a lot of other things to protect this kind of attack (filename scrubbing, bcrypt passwords), so I'm pretty red in the face about how dumb this one was. If you find any other b…

You are right, I should have reached out to you directly with this issue. I took the easy route and didn't put in any effort to track you down, for that I am sorry. However, I take exception to you categorizing my post as "trashing other people's work." I feel that I also have a responsibility to publicize such a glaring security hole in your site. This is the number 1 link on HN at the moment. Thousands of people ar…

I'd just like to point out that when he said "trashing other people's work," he was likely referring to people overwriting others' pages, not your comment.

Re: NeoCities

#109

Post by belorn »

LandoCalrissian wrote: post #64
big_lou wrote: post #43

PEOPLE. This is clearly not intended as a business. Stop asking about the "business model." It strikes me as just being a cool side project that enables people to make websites. That's it. Yeesh.

I'm pretty sure that's exactly what it is. This is just for fun, I don't think they are looking for VC money or anything crazy.

As someone who has a 1gb/s flat rate at home, I have thought about doing something similar. It really isn't that expensive to have a bit of network and a server that gives out static content.

Re: NeoCities

#110

Post by zaius »

stinky613 wrote: post #17
kyledrake wrote: post #7

Earlier quoted context omitted.

The site will very easily pay for itself with donations. It's not that expensive to serve static HTML, especially when you are using Nginx and sendfile.

That wasn't really my point. It doesn't inspire confidence when the host says "hey! put your stuff here! I'm not sure that I can pay the bills each month but I sure hope we can. Oh--and I have no idea how this will scale." It's all understandable. But even if it's free and even if my content is stupid, I'd still feel a little uncomfortable because of how much doubt the owner expresses over the viability of the servic…

Really, that's what all startups are doing. At least he's being honest about it.
Post reply on HN