The FCC.gov Website Lets You Upload Malware Using Its Own Public API Key

Re:The FCC.gov Website Lets You Upload Malware Using Its Own... by Filligree on Thursday August 31, 2017 @12:48PM (#15141627)

You should!

There are security implications galore, mostly due to the same-origin policy. Books can and have been written about web security; if you're writing webapps, you need to read one.

[ Parent | on HN ]

Re:The FCC.gov Website Lets You Upload Malware Using Its Own... by mattmanser on Thursday August 31, 2017 @05:21PM (#15144034)

I'm not saying you shouldn't think about it, it's just a non-obvious vulnerability.

[ Parent | on HN ]

Re:The FCC.gov Website Lets You Upload Malware Using Its Own... by Filligree on Thursday August 31, 2017 @05:36PM (#15144155)

Most of them are. Thus the book.

[ Parent | on HN ]

Re:The FCC.gov Website Lets You Upload Malware Using Its Own... by mattmanser on Thursday August 31, 2017 @08:21PM (#15145180)

My feeling is that it's like computer security, you can bleat all you like about how the millions of developers have to magically know this stuff, or you can build it in by default.

One method works, one doesn't.

But keep on telling people to read a book, for all the good it will do.

[ Parent | on HN ]

Re:The FCC.gov Website Lets You Upload Malware Using Its Own... by Filligree on Thursday August 31, 2017 @08:37PM (#15145235)

It's not like I'm in any position to do what you're suggesting. It's a bit late to revamp the entire web "security model" by this point.

[ Parent | on HN ]