How do you pay without adverts?
NeoCities
111–120 of 222 posts
Re: NeoCities
#112I wonder how long it'll take for Yahoo to send a C&D...
Re: NeoCities
#113Earlier quoted context omitted.
I just fixed it. It was a change I did last night to fix a save bug. My apologies about that, it wasn't a good bug, but hopefully it's the last security-related one. Probably goes without saying, but this is definitely a beta project. I'm doing a lot of other things to protect this kind of attack (filename scrubbing, bcrypt passwords), so I'm pretty red in the face about how dumb this one was. If you find any other b…
You are right, I should have reached out to you directly with this issue. I took the easy route and didn't put in any effort to track you down, for that I am sorry. However, I take exception to you categorizing my post as "trashing other people's work." I feel that I also have a responsibility to publicize such a glaring security hole in your site. This is the number 1 link on HN at the moment. Thousands of people ar…
You really attributed the duplication/overwrite bug to malice?
Re: NeoCities
#114Earlier quoted context omitted.
I'm pretty sure that's exactly what it is. This is just for fun, I don't think they are looking for VC money or anything crazy.
As someone who has a 1gb/s flat rate at home, I have thought about doing something similar. It really isn't that expensive to have a bit of network and a server that gives out static content.
Til someone puts something copyright or worse on it.
Re: NeoCities
#115Earlier quoted context omitted.
I just fixed it. It was a change I did last night to fix a save bug. My apologies about that, it wasn't a good bug, but hopefully it's the last security-related one. Probably goes without saying, but this is definitely a beta project. I'm doing a lot of other things to protect this kind of attack (filename scrubbing, bcrypt passwords), so I'm pretty red in the face about how dumb this one was. If you find any other b…
You are right, I should have reached out to you directly with this issue. I took the easy route and didn't put in any effort to track you down, for that I am sorry. However, I take exception to you categorizing my post as "trashing other people's work." I feel that I also have a responsibility to publicize such a glaring security hole in your site. This is the number 1 link on HN at the moment. Thousands of people ar…
> I feel that I also have a responsibility to publicize such a glaring security hole in your site.
It's a static web site hosting, exactly what "security holes" could we be talking about? Not theoretical holes, that you could technically exploit on the 45th blue moon of the century, things that might actually happen.
Re: NeoCities
#116Don't use this for anything you view as important. I just checked and there is no collision detection for usernames. You can signup for an account using any name and your account will seemingly just replace the previous created account. That is a big enough and obvious enough flaw that it also makes we wonder if this is just a phishing expedition or a way to mine email addresses.
I just fixed it. It was a change I did last night to fix a save bug. My apologies about that, it wasn't a good bug, but hopefully it's the last security-related one. Probably goes without saying, but this is definitely a beta project. I'm doing a lot of other things to protect this kind of attack (filename scrubbing, bcrypt passwords), so I'm pretty red in the face about how dumb this one was. If you find any other b…
On the issue of security, any possibility for HTTPS in the future?
Re: NeoCities
#117Earlier quoted context omitted.
I just fixed it. It was a change I did last night to fix a save bug. My apologies about that, it wasn't a good bug, but hopefully it's the last security-related one. Probably goes without saying, but this is definitely a beta project. I'm doing a lot of other things to protect this kind of attack (filename scrubbing, bcrypt passwords), so I'm pretty red in the face about how dumb this one was. If you find any other b…
You are right, I should have reached out to you directly with this issue. I took the easy route and didn't put in any effort to track you down, for that I am sorry. However, I take exception to you categorizing my post as "trashing other people's work." I feel that I also have a responsibility to publicize such a glaring security hole in your site. This is the number 1 link on HN at the moment. Thousands of people ar…
I read the "trashing other people's work" comment as referencing smashing someone's site by registering an account over theirs, not publishing the bug on hacker news.
Re: NeoCities
#118GeoCities clipart backgrounds still available! http://www.geocities.com/clipart/pbi/backgrounds/
Holy nostalgia trip
Re: NeoCities
#119Earlier quoted context omitted.
Back then, this wasn't called collision detection, but proper database design. I can not even begin to fathom how you can inadvertently introduce this by fixing a save bug.
Proper database design does not mean the problem couldn't happen. Consider this scenario. The database has a unique constraint on the name but the code ignores the result and overwrites the directory anyways. It wouldn't cause this exact problem but it is similar.
[deleted]
Re: NeoCities
#120Don't use this for anything you view as important. I just checked and there is no collision detection for usernames. You can signup for an account using any name and your account will seemingly just replace the previous created account. That is a big enough and obvious enough flaw that it also makes we wonder if this is just a phishing expedition or a way to mine email addresses.
I just fixed it. It was a change I did last night to fix a save bug. My apologies about that, it wasn't a good bug, but hopefully it's the last security-related one. Probably goes without saying, but this is definitely a beta project. I'm doing a lot of other things to protect this kind of attack (filename scrubbing, bcrypt passwords), so I'm pretty red in the face about how dumb this one was. If you find any other b…
I assume you have this posted on your wall nearby? http://i.imgur.com/y7Hm9.jpg
