Don’t Click The WTF Link On Twitter Unless You Do Like Sex With Goats
1–10 of 17 posts
Re: Don’t Click The WTF Link On Twitter Unless You Do Like Sex With Goats
#2They are using GET requests for status updates - possibly only on new twitter.
Re: Don’t Click The WTF Link On Twitter Unless You Do Like Sex With Goats
#3They are using GET requests for status updates - possibly only on new twitter.
Which is quite astounding. These aren't novice programmers fresh from a comp-sci course and in to the big bad world. Making this kind of mistake (which is a mistake on not one, but many grounds) is extraordinary. It's as if the ideas of idempotence, REST, basic security, treating external input as hostile, etc. have never even been mentioned between them.
I'm not foolish enough to imagine that this is anything other than a blip for them - their first mover momentum and market dominance is invincible for the time being, but they don't deserve it if they keep putting users at risk as casually as they seem to be. So far, we've seen nothing too nasty (though this could be embarrassing I suppose), but it's a bad sign looking ahead.
Re: Don’t Click The WTF Link On Twitter Unless You Do Like Sex With Goats
#4They are using GET requests for status updates - possibly only on new twitter.
Which is quite astounding. These aren't novice programmers fresh from a comp-sci course and in to the big bad world. Making this kind of mistake (which is a mistake on not one, but many grounds) is extraordinary. It's as if the ideas of idempotence, REST, basic security, treating external input as hostile, etc. have never even been mentioned between them. I'm not foolish enough to imagine that this is anything other…
I agree, I can't quite believe they put something so poor security wise out. I'm not convinced when they say it's fixed that's it's really fixed yet either - in that someone could just create another page with the problem.
Re: Don’t Click The WTF Link On Twitter Unless You Do Like Sex With Goats
#5[deleted]
Re: Don’t Click The WTF Link On Twitter Unless You Do Like Sex With Goats
#6seems like it's fixed now : http://twitter.com/twitter/status/25615345589
Re: Don’t Click The WTF Link On Twitter Unless You Do Like Sex With Goats
#7More discussion here: http://news.ycombinator.com/item?id=1729601
Re: Don’t Click The WTF Link On Twitter Unless You Do Like Sex With Goats
#8They are using GET requests for status updates - possibly only on new twitter.
The fact that they're using a GET is not the problem (though it is slightly bad). The malicious javascript would have to be only slightly more complex if it was a POST. The issue is that there is no security token required when making the request to do the status update.
Re: Don’t Click The WTF Link On Twitter Unless You Do Like Sex With Goats
#9What's wrong with sex with goats?
Re: Don’t Click The WTF Link On Twitter Unless You Do Like Sex With Goats
#10They are using GET requests for status updates - possibly only on new twitter.
The fact that they're using a GET is not the problem (though it is slightly bad). The malicious javascript would have to be only slightly more complex if it was a POST. The issue is that there is no security token required when making the request to do the status update.
No, it's entirely the fault of GET. They're opening an iframe on their page with a source your post URL. If it were POST-only, they'd be blocked by Javascript being unable to communicate across domains.