News for hackers. Stuff that matters.

dgalling

Re:Firefox 3D view helps spot XSS vulnerabilities on Friday August 17, 2012 @11:54AM (#4397033)
The 3D view definitely makes it a bit more visible, but as someone who has spent a considerable amount of time testing XSS filters, it's not all that useful, since you generally know exactly where in the output your input will be, and also because looking at the raw output (not the constructed DOM tree) is a better way to identify XSS vulns.

It's a cool observation nonetheless, and props for catching XSS vulns in your QA environment, not production ;)

Re:Firefox 3D view helps spot XSS vulnerabilities on Friday August 17, 2012 @10:10AM (#4396402)
No, the 3D view can help you spot when someone has already injected content into your page.

But not really, because most of the time, the "content" injected into your page is a script tag, which doesn't show up in the 3D view.

Re:Ask HN: Where is the Hostility on HN Coming From? on Wednesday August 08, 2012 @07:30AM (#4354983)
What, in your eyes, is a better indicator of hacker news liking or not liking something? Is it the over 400 points or the stream of hate coming at them in the comments?

Sometimes these redesigns reek of audacity, sometimes they're just not done very well. In any case, hostility is not necessary to make that point. The situation is not so dire that we need to be mean to someone to tell them we don't like something. It's hard to share what you've done with the world, and it's even harder when many people from a community you respect will shit on you in the case you overlook something.

I don't mean to be impolite, but don't try and pass your anger that something has 400 points on hacker news for some sort of tough-love criticism.

Re:The story of TextMate, VIM and SublimeText on Monday January 30, 2012 @09:14AM (#3528839)
Has anyone else experienced the slowness the author described with Vim? I think it's possible he may be experiencing slow terminal update time (the OS X terminal is really slow in the scenario he described) instead of Vim being the culprit. MacVim, for example, doesn't have this problem, in my experience.
Re:The New Web Typography on Monday January 09, 2012 @05:13PM (#3444551)
ClearType is a technique used to smooth fonts on LCD displays. OpenType is a font format. Perhaps you meant to say TrueType?
In ruby 1.9, I/O is asynchronous in threads. This is a clever joke that many people who didn't read the code fell for...
Re:Watch a VC use my name to sell a con on Tuesday November 29, 2011 @09:05AM (#3290305)
I highly doubt writers can work the same way. Anyone doing any type of creative work needs these types of breaks. Similarly, one article published without adequate editing/fact-checking can do wonders to destroy the credibility of a blog...
Re:Googler: "we pushed a bad version of our iOS app for Gmail" on Wednesday November 02, 2011 @08:16PM (#3189538)
A year late to Apps users? Google+ launched on June 28 of this year...
Re:New Visual Proportions for the iOS User Interface on Friday August 19, 2011 @02:48PM (#2904400)
position: absolute; much?