News for hackers. Stuff that matters.
Re:Mitigating MIME Confusion Attacks in Firefox by _RPM on Friday August 26, 2016 @10:10AM (#12366356)
I remember trying to explain that checking the file extension of a file doesn't mean that it is actually an "image" file. I was an intern at my first internship, but wasn't taken seriously when I proposed [to the senior dev] that we do actual file validation (bytes) and not just extension validation for the uploaded images. Yes, it would take more time. But, since I was just low on the pole, I think I wasn't taken seriously.

Also maybe it wasn't my place to suggest design solutions, and or my approach wasn't as good as it should have been.

Re:Mitigating MIME Confusion Attacks in Firefox by Flimm on Friday August 26, 2016 @11:49AM (#12367043)
What Mozilla is proposing here is that metadata (the mime header if not the filename) is respected and guessing based on the contents is eliminated. So the proposal is more similar to your professor's idea than to yours.
Re:Mitigating MIME Confusion Attacks in Firefox by kyled on Friday August 26, 2016 @10:36AM (#12366556)