Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NeoCities

neocities.org

Post reply on HN
Print view View original

201–210 of 222 posts

Re: NeoCities

#201

Post by _pmf_ »

kyledrake wrote: post #52
slg wrote: post #22

Don't use this for anything you view as important. I just checked and there is no collision detection for usernames. You can signup for an account using any name and your account will seemingly just replace the previous created account. That is a big enough and obvious enough flaw that it also makes we wonder if this is just a phishing expedition or a way to mine email addresses.

I just fixed it. It was a change I did last night to fix a save bug. My apologies about that, it wasn't a good bug, but hopefully it's the last security-related one. Probably goes without saying, but this is definitely a beta project. I'm doing a lot of other things to protect this kind of attack (filename scrubbing, bcrypt passwords), so I'm pretty red in the face about how dumb this one was. If you find any other b…

> Probably goes without saying, but this is definitely a beta project.

It indeed goes without saying, since you don't mention this on the site.

Re: NeoCities

#202

Post by sneak »

slg wrote: post #22

Don't use this for anything you view as important. I just checked and there is no collision detection for usernames. You can signup for an account using any name and your account will seemingly just replace the previous created account. That is a big enough and obvious enough flaw that it also makes we wonder if this is just a phishing expedition or a way to mine email addresses.

Don't use this for anything you view as important. Hosting that doesn't use a domain name that you control means that when the donation bucket is empty and the service goes under, your traffic and pagerank and brand is now lost forever.

Re: NeoCities

#203

Post by sneak »

slg wrote: post #50
ErikAugust wrote: post #34

Earlier quoted context omitted.

I'm logged in as "www" right now.

Funny enough, that is exactly how I found the problem. I created a www account (I am almost ashamed to say that was my first instinct, try to break the system before you decide the system is worthy of your use). I ended up logging out and I couldn't log back in with the same password. In hindsight, someone must have created another www account after I did and before I tried to login again. I then tried creating anoth…

> I am almost ashamed to say that was my first instinct, try to break the system before you decide the system is worthy of your use

I am proud to say that's always my first impulse when thrust into security-related circumstances.

http://www.schneier.com/blog/archives/2008/03/the_security_m...

Re: NeoCities

#204

Post by sneak »

kyledrake wrote: post #52
slg wrote: post #22

Don't use this for anything you view as important. I just checked and there is no collision detection for usernames. You can signup for an account using any name and your account will seemingly just replace the previous created account. That is a big enough and obvious enough flaw that it also makes we wonder if this is just a phishing expedition or a way to mine email addresses.

I just fixed it. It was a change I did last night to fix a save bug. My apologies about that, it wasn't a good bug, but hopefully it's the last security-related one. Probably goes without saying, but this is definitely a beta project. I'm doing a lot of other things to protect this kind of attack (filename scrubbing, bcrypt passwords), so I'm pretty red in the face about how dumb this one was. If you find any other b…

What are you doing to make sure your site (and your users' URLs) will be around in five years? How about fifteen?

(I'm not just being snarky, I have run a freenet out of pocket for sixteen years because people's urls and email addresses are important to not lose.)

Re: NeoCities

#205

Post by sneak »

clauretano wrote: post #59
kyledrake wrote: post #52

Earlier quoted context omitted.

I just fixed it. It was a change I did last night to fix a save bug. My apologies about that, it wasn't a good bug, but hopefully it's the last security-related one. Probably goes without saying, but this is definitely a beta project. I'm doing a lot of other things to protect this kind of attack (filename scrubbing, bcrypt passwords), so I'm pretty red in the face about how dumb this one was. If you find any other b…

Not only does this trigger GeoCities nostalgia, it calls back to the days when betas were really betas.

Just wait until one unknown day without notice or fanfare it disappears from the 'net forever!

Re: NeoCities

#206

Post by Luyt »

sneak wrote: post #205
clauretano wrote: post #59

Earlier quoted context omitted.

Not only does this trigger GeoCities nostalgia, it calls back to the days when betas were really betas.

Just wait until one unknown day without notice or fanfare it disappears from the 'net forever!

No problem, http://www.reocities.com/ to the rescue!

Re: NeoCities

#207

Post by jancborchardt »

kyledrake wrote: post #103
slg wrote: post #97

Earlier quoted context omitted.

You are right, I should have reached out to you directly with this issue. I took the easy route and didn't put in any effort to track you down, for that I am sorry. However, I take exception to you categorizing my post as "trashing other people's work." I feel that I also have a responsibility to publicize such a glaring security hole in your site. This is the number 1 link on HN at the moment. Thousands of people ar…

Here, I'll do one better: If anyone is concerned about the nature/security of the site, here is the source code to NeoCities, ready for anyone to do a full security audit: https://github.com/kyledrake/neocities-web Pull requests welcome!

Do you have a logo already? I would really like to add NeoCities to http://libreprojects.net

Re: NeoCities

#208

Post by Luyt »

kybernetyk wrote: post #130

Oh man, I'm sorry for OP because of all the negativity in this thread. I think his service is kinda cool in a twisted way and I can totally see me building a little 'old school' homepage on it. /edit: I did build a homepage: http://kybernetyk.neocities.org I feel better now ;)

I wonder whether this 'negativity' is really negativity, or just well-meant criticism, testing and validating the idea, maybe even playing advocate of the devil. From what I've seen in the past years, the HN community is unlikely to produce a page with tons of similar 'Nice job!' postings.

Re: NeoCities

#209

Post by reidrac »

kyledrake wrote: post #52
slg wrote: post #22

Don't use this for anything you view as important. I just checked and there is no collision detection for usernames. You can signup for an account using any name and your account will seemingly just replace the previous created account. That is a big enough and obvious enough flaw that it also makes we wonder if this is just a phishing expedition or a way to mine email addresses.

I just fixed it. It was a change I did last night to fix a save bug. My apologies about that, it wasn't a good bug, but hopefully it's the last security-related one. Probably goes without saying, but this is definitely a beta project. I'm doing a lot of other things to protect this kind of attack (filename scrubbing, bcrypt passwords), so I'm pretty red in the face about how dumb this one was. If you find any other b…

Open source your code and you may get some extra eyeballs to avoid this kind of issues.

Re: NeoCities

#210

Post by cabalamat »

corin_ wrote: post #200
cabalamat wrote: post #192

There is a bug on your dashboard; the html for viewing a page is: View Unfortunately, this means that I cannot click with the middle mouse button to bring up the page in a new tab. Please remove the extraneous target="_blank" code.

What browser? Middle mouse click works fine on links regardless of target in most browsers I'm used to (certainly in FF, Chrome, IE on Windows).

Firefox 21 on xubuntu 12.04
Post reply on HN