NeoCities

Post by callmeed » Fri, Jun 21, 2013, 7:32 PM UTC

Post by rschmitty » Fri, Jun 21, 2013, 7:44 PM UTC

Post by csense » Fri, Jun 21, 2013, 7:49 PM UTC

kyledrake wrote: post #103

slg wrote: post #97

Earlier quoted context omitted.

You are right, I should have reached out to you directly with this issue. I took the easy route and didn't put in any effort to track you down, for that I am sorry. However, I take exception to you categorizing my post as "trashing other people's work." I feel that I also have a responsibility to publicize such a glaring security hole in your site. This is the number 1 link on HN at the moment. Thousands of people ar…

Here, I'll do one better: If anyone is concerned about the nature/security of the site, here is the source code to NeoCities, ready for anyone to do a full security audit: https://github.com/kyledrake/neocities-web Pull requests welcome!

Post by deadfall » Fri, Jun 21, 2013, 7:59 PM UTC

Post by Zimahl » Fri, Jun 21, 2013, 8:05 PM UTC

kyledrake wrote: post #52

slg wrote: post #22

Don't use this for anything you view as important. I just checked and there is no collision detection for usernames. You can signup for an account using any name and your account will seemingly just replace the previous created account. That is a big enough and obvious enough flaw that it also makes we wonder if this is just a phishing expedition or a way to mine email addresses.

I just fixed it. It was a change I did last night to fix a save bug. My apologies about that, it wasn't a good bug, but hopefully it's the last security-related one. Probably goes without saying, but this is definitely a beta project. I'm doing a lot of other things to protect this kind of attack (filename scrubbing, bcrypt passwords), so I'm pretty red in the face about how dumb this one was. If you find any other b…