Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

This JPEG is also a webpage

lcamtuf.coredump.cx

Post reply on HN
Print view View original

211–220 of 236 posts

Re: This JPEG is also a webpage

#211

Post by instakill »

michaelmior wrote: post #106
pgeorgi wrote: post #96

Earlier quoted context omitted.

there are websites where you can upload files such as images, but they filter html for security reasons. if you can present that html to someone (eg. through deeplinking an iframe to the document), it could contain (or load) javascript that runs in the context of that site...

This is why it's important to correctly set the Content-Type header when serving files. Also why it's a good idea to have user-uploaded content served from a separate domain.

Please elaborate on the part about UCG from a separate domain. Why is this?

Re: This JPEG is also a webpage

#212

Post by slice-beans »

neom wrote: post #210
slice-beans wrote: post #171

Earlier quoted context omitted.

BT Home Hub 5 (Type A) Software version 4.7.5.1.83.8.204.1.11 But, false alarm anyway, nothing interesting is happening. The firmware had updated and reset parental control settings on the router. The domain is on some blacklist apparently so it was redirecting to a page to finalise parental control preferences. Sorry it wasn't any more interesting than that. Edit: the reason it took me a while to figure this out was…

So how did you figure it out?

I visited some other black listed sites .> and discovered the pattern, then dug around in the router settings to see what had changed. Disabling parental controls sorted it and I can now see the squirrel/chipmunk/unidentified rodent.

Lesson learned: just use a VPN.

Re: This JPEG is also a webpage

#213

Post by jakobegger »

instakill wrote: post #211
michaelmior wrote: post #106

Earlier quoted context omitted.

This is why it's important to correctly set the Content-Type header when serving files. Also why it's a good idea to have user-uploaded content served from a separate domain.

Please elaborate on the part about UCG from a separate domain. Why is this?

If someone uses this trick to upload a PNG like this to your server, and that person is tricked into running it as HTML, then that HTML has access to your cookies and can make make AJAX requests (circumvent same origin protection).

If user content is on a separate domain, they can't do that.

Also fishing is a lot easier when you're on the real domain...

Re: This JPEG is also a webpage

#214

Post by Olap84 »

slice-beans wrote: post #212
neom wrote: post #210

Earlier quoted context omitted.

So how did you figure it out?

I visited some other black listed sites .> and discovered the pattern, then dug around in the router settings to see what had changed. Disabling parental controls sorted it and I can now see the squirrel/chipmunk/unidentified rodent. Lesson learned: just use a VPN.

aaisp - your life just became simpler.

Re: This JPEG is also a webpage

#215

Post by sievebrain »

notahacker wrote: post #126
danbruc wrote: post #71

Earlier quoted context omitted.

I don't think the assumption is justified that enforcing well-formed HTML documents would have been a significant barrier. To me it actually seems easier to have a few simple and strictly enforced rules than having a more or less random assortment of exception to save a handful of key strokes.

The failure of XHTML Strict suggests otherwise. Ultimately it's less about saving keystrokes and more about amateur enthusiasts having the opportunity to start with the browser rendering their unformatted document rather than an "Error at line 1" warning, and changes they introduce being considerably less likely to break the entire page

XHTML Strict only solved one set of leniencies in the web platform, which were also the least important kinds. Malformed HTML makes writing browsers complicated but doesn't generally seem to cause security issues or other visible, obvious, must-fix-now problems.

The real security due to leniency problems in the web platform revolve around the handling of data and how JavaScript works, which were not addressed by XHTML. In that sense it's not surprising it went nowhere.

Re: This JPEG is also a webpage

#216

Post by hollander »

aleksanb wrote: post #152
daeken wrote: post #4

I abused this concept to compress demo code in PNG files, with great success. http://demoseen.com/blog/2011-08-31_Superpacking_JS_Demos.ht... This is, at present, the most efficient way to pack demos on the web; a few characters of uncompressed bootstrap code, then the rest is deflated.

My democrew (Ninjadev) has used this technique for multiple WebGL/Javascript productions over the last few years now. You can see the final packed .PNG results here: Crankwork Steamfist https://stianj.com/crankwork-steamfist/ , Everything is Fashion https://stianj.com/fashion/ , and Inakuwa Oasis http://arkt.is/inakuwa-oasis/ . The tool used for creating both the demos and the packed .PNG is made by us and available…

That first link froze my (rather old) computer - had to reboot!

Re: This JPEG is also a webpage

#217

Post by tomelders »

voltagex_ wrote: post #194
gkya wrote: post #120

Earlier quoted context omitted.

Why? I mean as if the parent was on topic... and this is a little joke, jokes don't kill.

There's low tolerance for jokes on HackerNews. I'm not entirely sure why, but it is what it is.

To stop the place becoming like reddit, where all insightful comments are buried under a torrent of jokes. I've had my fingers burnt a few times and then sulked for a few days after one of my many hilarious quips was down-voted into oblivion.

But ultimately I think it's for the greater good.

Re: This JPEG is also a webpage

#218

Post by ftvbffg »

mrb wrote: post #52
tomw1808 wrote: post #32

> Pretty radical, eh? Send money to: lcamtuf@coredump.cx How to send money to your email address? Not that I would send you some, but I wondered how you want to have that money received?

1. Most Gmail users can receive money by email ( https://support.google.com/mail/answer/3141103 and coredump.cx MX records point to Gmail) 2. Ask him his Bitcoin address 3. Paypal to this address :)

You don't need to ask him for Bitcoin address. Just send him private key of a bitcoin wallet. Or this https://www.bctip.org/en/

Re: This JPEG is also a webpage

#219

Post by Jaruzel »

slice-beans wrote: post #212
neom wrote: post #210

Earlier quoted context omitted.

So how did you figure it out?

I visited some other black listed sites .> and discovered the pattern, then dug around in the router settings to see what had changed. Disabling parental controls sorted it and I can now see the squirrel/chipmunk/unidentified rodent. Lesson learned: just use a VPN.

> I visited some other black listed sites .>

Is that an ASCII representation of what I think it is? (a well known .cx site)

Post reply on HN