d1b

Re:"Unknown or expired link." - Why? on Tuesday October 11, 2011 @12:16PM (#3099161)

Actually _right_now_ I cannot click "more"(on the first page) without hitting the "Unknown or expired link" page ... so I cannot go past the first page :/ -- Someone should submit a patch :)

Please get the security of (your) web admin applications correct the first time!

Posted by d1b on Monday June 13, 2011 @02:08PM
from the blog.mu-cs.com dept.

http://blog.mu-cs.com/2011/06/if-you-are-going-to-do-it-differently.html

( Read More... | no comments | on HN )

Copying and pasting from untrusted sources can be harmful.

Posted by d1b on Tuesday April 26, 2011 @07:04AM
from the blog.mu-cs.com dept.

http://blog.mu-cs.com/2011/04/copying-and-pasting-from-untrusted.html

( Read More... | no comments | 2 points | on HN )

Re:Taking over your code repositories with xss on Saturday March 26, 2011 @10:25PM (#2373945)

I think in the github and launchpad case the security that a WAF normally offers would have been broken because the data to trigger the vector did not come through http nor https. I suggest you have a play around with github wiki's they already have 'html sanitization' built in.

Re:Taking over your code repositories with xss on Saturday March 26, 2011 @10:14PM (#2373918)

this isn't going to fix anything that wouldn't be fixed via ensuring that stuff is escaped already on the page...

Re:Taking over your code repositories with xss on Saturday March 26, 2011 @10:07PM (#2373903)

I spent about around 3 hours on github(found the bugs after like 2 hours and spent another 1 playing with wiki markup --- it is sanitized don't bother), 1 hour on bitbucket, 30minutes on gitorious(obviously the bug I found was found very quickly after signing up) and ~1 1/2 hour looking at the launchpad subdomain.

I did this over like the past 100 days.