121–130 of 236 posts
Earlier quoted context omitted.
That's the point--who.is won't play music by itself. Its lookup of the DNS records of jaimehawkins.co.uk injected the music into the page.
Oh I see. This makes sense. This doesn't seem challenging to prevent. A simple replacement of characters on the HTML entity table would have prevented this instead of putting arbitrary text onto standard output.
Earlier quoted context omitted.
I saw "ASN.1" in the draft and immediately thought "over-engineered".
When bytes count (and they often don't, but in this case they probably do), what would be your preferred system? And what do you see as your favoured approach's main advantage(s) over ASN.1/BER?
(creds: http://tools.ietf.org/html/rfc1697)
I am half serious, but how about making HTML served in TXT records a standard trick for serving small web pages very quickly? There are way fewer network round trips: 1. DNS query for TXT record for example.com 2. DNS reply with HTML content Compared with the traditional 7 steps: 1. DNS query for A record for example.com 2. DNS reply with x.x.x.x 3. TCP SYN to port 80 4. TCP SYN/ACK 5. TCP ACK 6. HTTP GET 7. HTTP rep…
(Why? Lots of captive portal wifi hotspots (think hotel/train etc) seem to allow DNS resolutions before stopping your other traffic.)
* DNS uses port 53 which is the same as the atomic number for Iodine ;)
Earlier quoted context omitted.
When bytes count (and they often don't, but in this case they probably do), what would be your preferred system? And what do you see as your favoured approach's main advantage(s) over ASN.1/BER?
ASN.1/BER is a pain in the ass. I'd rather gzip json. Or poke chopsticks in my eyes. (creds: http://tools.ietf.org/html/rfc1697 )
Earlier quoted context omitted.
"Again, I am only half serious" (said two times...) Why say that at all? Is it a way to fend off ridicule? Or does this show a lack of confidence in the idea and what you are saying? Reminds me of comments that start "Am I the only one who thinks that..." I've gotten out of the habit of apologizing for things that I say or prefacing them with phrases such as that. The reason is that I found that it was a lazy way to…
As someone who prefaces comments with similar things, I don't think it's unreasonable. Sometimes we know ideas are a bit of a cludge (Thinking back to the first time I did an IP over DNS tunnel) but it's still fun and interesting; but that doesn't stop some people jumping down your throat if they think you're suggesting it in earnest. Twice, maybe much? But the sentiment itself, I can see where it's coming from.
Or downvoting as they have done with my comment.
Earlier quoted context omitted.
"Again, I am only half serious" (said two times...) Why say that at all? Is it a way to fend off ridicule? Or does this show a lack of confidence in the idea and what you are saying? Reminds me of comments that start "Am I the only one who thinks that..." I've gotten out of the habit of apologizing for things that I say or prefacing them with phrases such as that. The reason is that I found that it was a lazy way to…
As someone who prefaces comments with similar things, I don't think it's unreasonable. Sometimes we know ideas are a bit of a cludge (Thinking back to the first time I did an IP over DNS tunnel) but it's still fun and interesting; but that doesn't stop some people jumping down your throat if they think you're suggesting it in earnest. Twice, maybe much? But the sentiment itself, I can see where it's coming from.
I enumerated all IPv4 PTR records a few years back, and I saw a couple XSS things there as well. If anyone wants to host that data set somewhere, let me know, would be interesting to see what others do with it. Edit: I found my data and have a grep running on it, will share what turns up. Edit2: Somewhat less exciting than I remember: $ fgrep -- '>' * x.x.101.130.csv:1298607746,155.92.101.130, .nebula.msoe.edu. x.x.1…
Put it somewhere I can grab it and I'll be happy to host it (I do some work for an ISP and have my own servers in the datacenter). Email is in profile.
I am half serious, but how about making HTML served in TXT records a standard trick for serving small web pages very quickly? There are way fewer network round trips: 1. DNS query for TXT record for example.com 2. DNS reply with HTML content Compared with the traditional 7 steps: 1. DNS query for A record for example.com 2. DNS reply with x.x.x.x 3. TCP SYN to port 80 4. TCP SYN/ACK 5. TCP ACK 6. HTTP GET 7. HTTP rep…
For another fantastic abuse of DNS, the Iodine* project uses DNS to tunnel IP which is just obscene. http://code.kryo.se/iodine/ (Why? Lots of captive portal wifi hotspots (think hotel/train etc) seem to allow DNS resolutions before stopping your other traffic.) * DNS uses port 53 which is the same as the atomic number for Iodine ;)
Earlier quoted context omitted.
Yes but you gain a lot of interesting information about what's going on, plus you are back in control. Whitelist places you trust. Keep things blocked that you don't like. If that breaks the experience, walk.
Sure. I used script blockers for a while. But after having to whitelist a huge number of them and loosing very long and precious time, I gave in. I do not put sensitive and important data on my computer. (Actually I was not doing that for a very long time even before giving in.) I always work on remote hosts. Therefore I treat my desktop as a security research one. Of course I would not do that on my desktop I were r…
Earlier quoted context omitted.
Stuff like this is why NoScript and RequestPolicy were invented.
For making your life living hell in the name of overbearing security measures.