Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

So Reddit has decided that plain HTML is unsafe

cole-k.com

Post reply on HN
Print view View original

641–650 of 681 posts

Re: So Reddit has decided that plain HTML is unsafe

#641

Post by moritzwarhier »

The "plain" HTML spec is notoriously hard to analyze statically though, due to "error tolerance".

The "error tolerance" introduces algorithmic complexity into what could be a parsing problem.

Root cause: DOM parsing can lead to a different result when you take the first-pass output, serialize it to HTML again, and use it as input for the second parsing pass. And if it sounds stupid: browser do this, AFAIK.

Side note, not security-related: CSS has introduced two-pass rendering since Flexbox, AFAIK. Not the same thing regarding what "rendering" means (there, it's about boxes on screen, not about transforming HTML->HTML, but...).

Lehacy inline attributes that allow JS execution are a favorite example, but disabling them via CSP is not a silver bullet.

Even if you disallow all attributes like "onclick", "onload", etc, modern document parsing is not context-free, and allows for arbitrarily complex exploits, AFAIK (a href, src or style payload can be just as bad as arbitrary JS execution).

The author of the ancient library DOMPurify made a decent amount of money from explaining this thoroughly and providing solutions.

In short, detecting XSS is a variant of the Halting Problem in some especially hard cases, as far as I remember. Because HTML parsing is not context-feee.

Re: So Reddit has decided that plain HTML is unsafe

#642

Post by alex1138 »

prmoustache wrote: post #392
rmunn wrote: post #336

Earlier quoted context omitted.

The word "the" is doing a lot of work in your last paragraph. I initially missed seeing the word "the", and that changed the meaning entirely for me. Observe: > MySpace seemed like shit until you put Facebook next to it. This sentence would be claiming that MySpace was a lousy experience, but Facebook was even worse. Which would make it hard to explain why people jumped ship. > MySpace seemed like the shit until you…

> This sentence would be claiming that MySpace was a lousy experience, but Facebook was even worse. Which would make it hard to explain why people jumped ship. I think original[1] Facebook UX was probably fine and clear enough for anyone but I would say that most people didn't jump ship: their first social media use started with facebook. And that was because FB grew bigger and faster, not because people were migrati…

Original Facebook was still stolen from ConnectU/houseSYSTEM and Myspace was reasonable about granular privacy controls (idk about Friendster. I imagine it was) whereas FB continually subverted it because MZ doesn't believe in privacy as a concept

Re: So Reddit has decided that plain HTML is unsafe

#643

Post by cindyllm »

alex1138 wrote: post #639
monksy wrote: post #325

Earlier quoted context omitted.

> Someone internally clearly hates its spez. It's always spez.

I don't know his entire life history so this is maybe unfair but internet companies are full of people like this. They fail upward and extract value from content the users make spez/anyone else could very directly not do what they're doing. Step back and say 'this is wrong'. But they're going to alienate everyone because they can These people should be preemptively fired/never hired from any job ever. If you can't sh…

[dead]

Re: So Reddit has decided that plain HTML is unsafe

#644

Post by bix6 »

Eisenstein wrote: post #585
bix6 wrote: post #569

Earlier quoted context omitted.

Numbers please

Here are stats from from a 100k member subreddit with 15k unique visitors a day. * https://imgur.com/UTJyyl8

So the takeaway is there’s a lot of members but only about 15% are active daily? And of that 15% it’s unknown how many are human vs bot?

Re: So Reddit has decided that plain HTML is unsafe

#645

Post by Cider9986 »

inigyou wrote: post #436
Cider9986 wrote: post #147

Earlier quoted context omitted.

>You've been blocked by network security. To continue, log in to your Reddit account or use your developer token ....

It's just the "drink verification can" meme, and could have linked to any site but chose Reddit...

I use redlib so it wasn't an issue for me. I was showing how my result trying to use the website is similar to the meme.

Re: So Reddit has decided that plain HTML is unsafe

#646

Post by bigstrat2003 »

noslenwerdna wrote: post #520
kmeisthax wrote: post #108

Earlier quoted context omitted.

Powertripping mods have always been a problem with Reddit ever since they had user-created subreddits. The real problem is that Reddit has been very two-faced with what their expectations on moderators are. If we take "the purpose of a system is what it does[0]" then Reddit moderators exist primarily as unpaid volunteer employees, paid in control over the narrative of certain communities. The flipside of powertrippin…

Is the purpose of a system really what it does though? Obviously there are side effects and tradeoffs in any complex system. Is the purpose of a vaccine to make you sick - no, but that is a side effect of some vaccines on some people. If we apply the "purpose of a system is what it does" to itself, this methodology is more a way to generate interesting (and cynical) hypotheses than to get at the truth.

The purpose of a system is not, by definition, what it does. It is what it is meant to do. That saying really gets under my skin because it is so obviously untrue. By the logic of the saying, the purpose of a hospital oncology floor is for their patients to die. Which is obviously ridiculous, but true under the "it's what it does" thinking.

Re: So Reddit has decided that plain HTML is unsafe

#647

Post by Eisenstein »

bix6 wrote: post #644
Eisenstein wrote: post #585

Earlier quoted context omitted.

Here are stats from from a 100k member subreddit with 15k unique visitors a day. * https://imgur.com/UTJyyl8

So the takeaway is there’s a lot of members but only about 15% are active daily? And of that 15% it’s unknown how many are human vs bot?

Unless bots subscribe to the subreddit they wouldn't count as members.

Re: So Reddit has decided that plain HTML is unsafe

#648

Post by nothercastle »

samplatt wrote: post #389
nothercastle wrote: post #281

Earlier quoted context omitted.

Forms are sadly dead. They cost a lot to operate and maintain security updates for so without a critical mass of users they are dead

Just like with VR, you can keep on claiming forums are "dead" all you like. Me and all my friends will keep on using them daily. therearedozensofus.gif

They are dead the same way newsgroups are dead. Some local communities survive some might even thrive but in aggregate more are lost than created

Re: So Reddit has decided that plain HTML is unsafe

#649

Post by nothercastle »

numpad0 wrote: post #501
nothercastle wrote: post #281

Earlier quoted context omitted.

Forms are sadly dead. They cost a lot to operate and maintain security updates for so without a critical mass of users they are dead

How did vBulletin/phpBB came to dominate the forum space in the English internet? To me, that seem like the source of a lot of problems for the forum culture and centralization into Reddit.

vBulletin Did a better job with security. PHPbb kept getting trashed by spammers but they were the primary tools at the time for self hosting. The ease of customization and the availability of skins made it a big selling point

Re: So Reddit has decided that plain HTML is unsafe

#650

Post by nothercastle »

inigyou wrote: post #533
debugnik wrote: post #511

Earlier quoted context omitted.

Reddit mods are volunteers as well.

Reddit's system ends up giving them enough dopamine (somehow, probably related to how users get it) to do it for a while. Forums aren't as addictive.

My forum mods loved the power they had as well seemed to work well. The real problem is money. Forums cost time and money to administer, Reddit is “free”. Those of us that ran the forums grew up and have better shit to do and spend money on
Post reply on HN