Live data from Hacker News

Tarsnap email confirmation bypass

daemonology.net

11–20 of 51 posts

Re: Tarsnap email confirmation bypass

#11
post #8

The value of writing comments intended for your future self was confirmed in a strange way for me: I once found myself googling some faintly obscure question of systems programming, and soon found an article that answered my question perfectly. At that point I noticed with considerable surprise that I was reading a web archive of a Usenet posting I had made myself, some 10 years prior - of all the people to randomly…

I have this with stackoverflow sometimes :p

Re: Tarsnap email confirmation bypass

#13
post #8

The value of writing comments intended for your future self was confirmed in a strange way for me: I once found myself googling some faintly obscure question of systems programming, and soon found an article that answered my question perfectly. At that point I noticed with considerable surprise that I was reading a web archive of a Usenet posting I had made myself, some 10 years prior - of all the people to randomly…

That's happened to me, but unfortunately I've mostly found my old questions, not my old answers!

Re: Tarsnap email confirmation bypass

#14
post #9
post #6

Earlier quoted context omitted.

Oh it really is just a summary, and no commentary as to whether TFA was long-winded or not. That's left to decide for each individually.

When you write tl;dr followed by a very short summary, doesn't that itself imply that the article was long?

The summary was certainly shorter than the article!

Re: Tarsnap email confirmation bypass

#15
post #3
post #2

tl;dr a friendly guy reported to tarsnap that you could sign up without needing the emailed confirmation link by creating that same confirmation link yourself with the cookie/token being hidden, but present in the HTML code. also, there is no bug bounties for the tarsnap website, only for tarsnap code.

a friendly guy reported to tarsnap that you could sign up without needing the emailed confirmation link by creating that same confirmation link yourself with the cookie/token being hidden, but present in the HTML code. That's a decent summary, but I didn't think I was all that long-winded...

Maybe the guy who found the bug won't get $1000, according to your rules, but he definitely deserves a cookie.

Re: Tarsnap email confirmation bypass

#16
There was a paper a couple years ago out of Microsoft research (if I recall correctly), that looked at a number of vulnerabilities in OAuth as used by Facebook, Twitter, and a few others. The ah-hah moment for me, though, was that they identified these vulnerabilities by turning the usual view of a web app inside-out: instead of viewing the client/browser as one endpoint on a communications channel, they treated the browser as a de facto man-in-the-middle. For OAuth, it is responsible for passing along messages between the OAuth provider and the authentication requesting website. In the case described in this article, the browser is just a MITM for a server sending messages to itself.

Re: Tarsnap email confirmation bypass

#17
post #9
post #6

Earlier quoted context omitted.

Oh it really is just a summary, and no commentary as to whether TFA was long-winded or not. That's left to decide for each individually.

When you write tl;dr followed by a very short summary, doesn't that itself imply that the article was long?

tl;dr has also become a general shorthand for a summary.

Re: Tarsnap email confirmation bypass

#18
post #8

The value of writing comments intended for your future self was confirmed in a strange way for me: I once found myself googling some faintly obscure question of systems programming, and soon found an article that answered my question perfectly. At that point I noticed with considerable surprise that I was reading a web archive of a Usenet posting I had made myself, some 10 years prior - of all the people to randomly…

This goes to show how useful it is to share your knowledge. You never know when you might need it back. :)

Re: Tarsnap email confirmation bypass

#19
post #8

The value of writing comments intended for your future self was confirmed in a strange way for me: I once found myself googling some faintly obscure question of systems programming, and soon found an article that answered my question perfectly. At that point I noticed with considerable surprise that I was reading a web archive of a Usenet posting I had made myself, some 10 years prior - of all the people to randomly…

I have this with stackoverflow sometimes :p

Same here. Also my old blog posts.

My weirdest one was when I was searching for an answer to a progamming question and ended up finding (and then contacting) my "long lost" cousin (the name was fairly unusual).

Turns out he became a programmer too.

Re: Tarsnap email confirmation bypass

#20
post #8

The value of writing comments intended for your future self was confirmed in a strange way for me: I once found myself googling some faintly obscure question of systems programming, and soon found an article that answered my question perfectly. At that point I noticed with considerable surprise that I was reading a web archive of a Usenet posting I had made myself, some 10 years prior - of all the people to randomly…

Ha, this actually happened to me just yesterday believe it or not. :D I looked up something and turns out it's 21 years old me who asked it in Stackoverflow four years ago.
Post reply on HN