News for hackers. Stuff that matters.

A comment on Disclosure timeline for vulnerabilities under active attack.

Re:Disclosure timeline for vulnerabilities under active attack by joshdance on Thursday May 30, 2013 @11:43AM (#5793172)
More aggressive reporting and patching I support.

On a side note, I have a hard time taking any blog at a .blogspot.com domain seriously. Don't know why.

[ Parent | on HN ]
Re:Disclosure timeline for vulnerabilities under active attack by moonboots on Thursday May 30, 2013 @12:30PM (#5793459)
Using different domains reduces attack surface area [1]. That said, I agree that the blogspot domain and site design look amateurish.

[1] https://github.com/blog/1466-yummy-cookies-across-domains

[ Parent | on HN ]
Re:Disclosure timeline for vulnerabilities under active attack by tonfa on Thursday May 30, 2013 @01:36PM (#5793910)
It's a policy issue:

> If we receive a removal request that violates local law, that content may no longer be available to readers on local domains where those laws apply.

https://support.google.com/blogger/answer/2402711?hl=en

[ Parent | on HN ]
Re:Disclosure timeline for vulnerabilities under active attack by dalore on Thursday May 30, 2013 @12:59PM (#5793656)
Not only that, its a .blogspot.com.br domain.

When I removed the .br part it redirected me to .blogspot.co.uk

[ Parent | on HN ]
Re:Disclosure timeline for vulnerabilities under active attack by Wilya on Thursday May 30, 2013 @01:24PM (#5793829)
Likely, the .br is there because the original submitter (here on HN) is from Brazil. Blogspot tends to redirect to the subdomain of the reader's country for some reason.
[ Parent | on HN ]
Re:Disclosure timeline for vulnerabilities under active attack by tnorthcutt on Thursday May 30, 2013 @01:32PM (#5793888)
.br isn't a subdomain, it's a TLD.
[ Parent | on HN ]
Re:Disclosure timeline for vulnerabilities under active attack by dalore on Friday May 31, 2013 @10:00AM (#5798611)
If you want to get technical. A TLD is the subdomain of the root.

It really is .br. but the last . is left of for convenience.

[ Parent | on HN ]
Re:Disclosure timeline for vulnerabilities under active attack by benmanns on Thursday May 30, 2013 @12:17PM (#5793373)
Agreed. I don't think there is anything stopping me from registering googleinternetsecurity.blogspot.com or officialonlinesecurity.blogspot.com if they filter out "google."
[ Parent | on HN ]
Re:Disclosure timeline for vulnerabilities under active attack by CGamesPlay on Thursday May 30, 2013 @12:31PM (#5793461)
Nor googleinternetsecurity.com. A TLD doesn't make it more legit, but at least under Blogspot, Google can shut down an imposter once discovered.
[ Parent | on HN ]
Re:Disclosure timeline for vulnerabilities under active attack by packetslave on Thursday May 30, 2013 @12:35PM (#5793490)
The Google security folks have been getting more and more selective about what goes under google.com (especially user-generated content) because stealing google.com cookies gives you the user's auth tokens.
[ Parent | on HN ]
Re:Disclosure timeline for vulnerabilities under active attack by TeMPOraL on Thursday May 30, 2013 @12:33PM (#5793477)
How about internetsecurity.google.com? They control their own TLD, they can make subdomains.
[ Parent | on HN ]
Re:Disclosure timeline for vulnerabilities under active attack by jcrites on Thursday May 30, 2013 @10:41PM (#5796565)
I think you mean they control a second-level domain. The top level domain is "com" in the example of "internetsecurity.google.com".

http://en.wikipedia.org/wiki/Top-level_domain

[ Parent | on HN ]
Re:Disclosure timeline for vulnerabilities under active attack by TeMPOraL on Saturday June 01, 2013 @04:13PM (#5805770)
Yes, that was what I meant :).
[ Parent | on HN ]
Re:Disclosure timeline for vulnerabilities under active attack by mixedbit on Thursday May 30, 2013 @05:21PM (#5795326)
internetsecurity.google.com could set cookies on google.com
[ Parent | on HN ]