101–110 of 236 posts
Earlier quoted context omitted.
That's the point--who.is won't play music by itself. Its lookup of the DNS records of jaimehawkins.co.uk injected the music into the page.
Yeah... that was actually hugely annoying. A little warning maybe.
Wish there was a warning, because I accidentally clicked this link in class just now.
Earlier quoted context omitted.
Do you know anyone there or anything about the process of getting something hosted there? I can burn the data to a DVD and snail mail it to them (or even drop it off in SF).
https://archive.org/create/ Only takes 5 minutes to create an account.
I am half serious, but how about making HTML served in TXT records a standard trick for serving small web pages very quickly? There are way fewer network round trips: 1. DNS query for TXT record for example.com 2. DNS reply with HTML content Compared with the traditional 7 steps: 1. DNS query for A record for example.com 2. DNS reply with x.x.x.x 3. TCP SYN to port 80 4. TCP SYN/ACK 5. TCP ACK 6. HTTP GET 7. HTTP rep…
Use the Kitchen Sink[1] record type. It's more appropriated than TXT. [1] https://tools.ietf.org/html/draft-ietf-dnsind-kitchen-sink-0...
I am half serious, but how about making HTML served in TXT records a standard trick for serving small web pages very quickly? There are way fewer network round trips: 1. DNS query for TXT record for example.com 2. DNS reply with HTML content Compared with the traditional 7 steps: 1. DNS query for A record for example.com 2. DNS reply with x.x.x.x 3. TCP SYN to port 80 4. TCP SYN/ACK 5. TCP ACK 6. HTTP GET 7. HTTP rep…
Meh, interesting thought, but a few things come to mind: - It could take multiple days to update the website for the entire world - It would be very easy to spoof the entire site - It would probably slow down the rest of the queries the DNS server would be responding to at the time. Also, updating DNS can be a pain for sites that aren't managing their own records.
Earlier quoted context omitted.
For what it's worth, Chrome tells you which tab audio is playing from, it's nice.
I think Chrome is able to do this because it separates tabs into processes, but I don't think there's a good way for Firefox to do it since everything is in a single process. https://bugzilla.mozilla.org/show_bug.cgi?id=486262
Earlier quoted context omitted.
> Never trust user input. Never trust any input. I think this is a case where people assume that is isn't pure user input because is would have already been parsed/checked/verified. "Oh, its in the DNS system so it must be safe" is worse then "well, it came from our database so it should be fine". Don't even trust something coming out of your own database. You never know what various input checking bugs might have ac…
Thinking about it as "don't concatenate different data types" leads to even more correct software. Concepts like "trust" and "sanitization" are too often vague and misleading. It might be perfectly valid for TXT records--even trusted and sanitized ones--to contain sequences with left angle brackets that make them look like HTML tags. Either way, that's no excuse for failing to convert the text to HTML (by escaping it…
I am half serious, but how about making HTML served in TXT records a standard trick for serving small web pages very quickly? There are way fewer network round trips: 1. DNS query for TXT record for example.com 2. DNS reply with HTML content Compared with the traditional 7 steps: 1. DNS query for A record for example.com 2. DNS reply with x.x.x.x 3. TCP SYN to port 80 4. TCP SYN/ACK 5. TCP ACK 6. HTTP GET 7. HTTP rep…
"Again, I am only half serious" (said two times...) Why say that at all? Is it a way to fend off ridicule? Or does this show a lack of confidence in the idea and what you are saying? Reminds me of comments that start "Am I the only one who thinks that..." I've gotten out of the habit of apologizing for things that I say or prefacing them with phrases such as that. The reason is that I found that it was a lazy way to…
This is hilariousy, but could this potentially be a real threat to anything ?
idk why youre getting downvoted because it's a good question and people need to ask more security questions. Any website I can inject malicious javascript into, I can steal your cookies from (assuming the httponly flag isn't set on the cookie). If you were logged into one of these whois sites and they didnt have the httponly flag set on your auth cookie, an attacker could send you to a page on the site that contains…