News for hackers. Stuff that matters.

diwo

Re:Linux Dash – Simple web-based server monitoring on Sunday June 22, 2014 @07:09PM (#7929529)
It looks like a cool project and the interface pretty well done too. Good job.

Is there something particular you want to specifically mention that has happened since you last shared the app five months ago? - https://news.ycombinator.com/item?id=7125153

Anyways, as this is shared here on a developer oriented forum, it would be fitting to speak of the actual implementation too. Taking quick look at the source, it seems to have some security issues ranging from XSS to potential CE. These seem to arise from common bad practices.

I would advice going through the source code and making sure all values you echo as JSON are properly encoded and that you don't use anything as-is in a shell command.

Few examples:

- https://github.com/afaqurk/linux-dash/blob/7bd5dcb637f815702... - https://github.com/afaqurk/linux-dash/blob/7bd5dcb637f815702... - https://github.com/afaqurk/linux-dash/blob/7bd5dcb637f815702...

Re:Yo hack on Friday June 20, 2014 @04:21PM (#7922675)
Why are they even storing phone numbers in plain text. According to their Privacy Policy, the numbers are only used for finding friends; i.e. they look up your contacts from their database.

In which case, to do that they do not need the plain phone number, but only a hash derived from it. This is like storing passwords in plain-text.

Re:Code Spaces data and backups deleted by hackers on Wednesday June 18, 2014 @06:06PM (#7913195)
Amazon's web services and their control panels support multi-factor authentication methods and customisable permissions models. For details see: http://aws.amazon.com/iam/
Re:CloudFlare acquires CryptoSeal (YC S11) on Wednesday June 18, 2014 @09:14AM (#7909856)
I read it as "later, in 2015" opposed to "in late 2015". Meaning, not now, but in the future -- sometime in 2015 possibly.
Re:IPv4 Address Report on Sunday June 15, 2014 @04:46PM (#7896261)
See http://ipv6-test.com/stats/. You can filter the list by country to see results by ISP.

The data is collected from users that visit the site and take part in the test. Keep in mind that the data isn't conclusive as the end-users location, and his hardware, effects the providers offerings and the statistics.

Re:Bit.ly's shady business model on Thursday June 12, 2014 @12:04PM (#7884180)
Let's see what Internet Archive says about this. In April 2013 the Bitly homepage looked like this:

http://web.archive.org/web/20130401021533/https://bitly.com/

It had the new brand in use, and it had a "You Business?" link to Enterprise site:

http://web.archive.org/web/20130404123817/http://www.enterpr...

The enterprise site advices you to contact them for pricing.