Re:Ask YC: Your Favorite Hack
by aristus on Thursday October 18, 2007 @12:01AM
(#69502)
Thanks, but while the restrictions on XHR are heavy, they aren't stupid. An unnamed party used the same idea to implement a LAN sniffer: each successive root domain pointed to the IP addresses of well-known routers, like 192.168.15.1. The script ran down the chain and attempted to log in to the admin page of the router, using default passwords.
[ Parent
| on HN ]
The real point is that with enough smarts, you can get around the restrictions, so you might as well eliminate them altogether so that there's no false sense of security.
I feel that way sometimes when I can't do something cool. But it passes. No restrictions on user processes is a major reason why "Windows security" is a contradiction, for example. It doesn't work in an adversarial networked environment.
Re:Ask YC: Your Favorite Hack
by DanielBMarkham on Thursday October 18, 2007 @12:11AM
(#69505)
Nice.
Not that I approve. But nice.
I'm a JSON person myself. Ran into too many problems with domains and XMLHttpRequest. From a security standpoint, the entire browser is broken, but that's probably a discussion for another day. Neat how you re-routed.