maxjus

When was this published?

I updated the copy on the site to clear up a couple of things.

You would be right -- if the use case for this was transmitting encrypted information. The reason I made this was mostly for email. Sometimes I want to send someone a message and not have it exist forever. In that case, you could send a link to the message along with the key. Then, after n hours, the message would cease to exist anywhere (assuming the server fulfills its contract). This works better than having the server just store the whole message, since now the server gets to be ignorant of the message's content. Mostly this was a fun little project I wanted to share :)

Escape them inputs, dawg!

www.listnerd.com/lists?letter=</script><script>alert(document.cookie);</script>

That was a joke, haha, fat chance.

Interestingly, modern WebKit browsers include an "XSS auditor" that will refuse to run javascript sent in the request that loaded the page. It's pretty good (and open-source), so figuring out a way to have XSS without hitting the auditor is a big win for the attacker.

Y'all might want to limit the number of characters in a user's name...

https://www.npmjs.org/~maxj

For those unfamiliar: https://www.youtube.com/watch?v=qjOZtWZ56lc

>direct DMA access

Direct direct memory access access?

Check out https://github.com/haypo/pysandbox/

Here's a story you guys might appreciate.

I found a cross site scripting vulnerability in Bing.com that was kind of hilarious. Searching for:

  </script><script>arbitrary js</script>

in the main search box would execute the code on the results page. I mean, holy shit. I could not believe it. I emailed their whitehat service and they fixed it but I never received a bounty.

Here's the best part -- these websites are built terribly and are very open to this sort of thing.

After about 2 minutes of looking, I've just found that nic.io (or just io.) basically lets you type arbitrary html into the search boxes. Chrome's built in XSS auditor catches any scripts you put in there, but (at least) Firefox doesn't.

Check it out:

http://io./cgi-bin/whois?query=%3Ca%20href=%22%22%3E%3Cu%3EA...

If you load it in Firefox (or any browser without an XSS auditor) it'll pop an alert, otherwise you'll just see the image I loaded and a link I inserted.

This is ridiculous.

Read the following, and see if you haven't changed your mind!

http://www.datagenetics.com/blog/january42012/

It should be noted that for the actual lottery, the advice given is wrong. Because in many real lotteries the first five digits can be in any order, 1 1 1 1 1 would be less likely than, say, 13 23 42 33 2, because, though there is only one way to end up with 1 1 1 1 1, there are 5! == 120 ways to achieve the latter (I am ignoring the "bonus ball").

I had an iPhone 4 until a few weeks ago, much in the same mindset as yourself. Though it can do 99% of what the 5 does, the speed difference really makes it feel like a completely different experience. Also the new screen has a much better aspect ratio for watching videos. It sounds silly, but that was my experience. If you're due for an upgrade I would highly recommend it. I promise I don't work for Apple :)

Maybe not the 'best', but there's a great short presentation called "Wat" that I really enjoyed that talks about weird behavior in programming languages when operations are performed on variables of different types.

Definitely worth a watch

https://www.destroyallsoftware.com/talks/wat

CloudFlare is saying that the site may be down due to "excessive load." I was under the impression that this is one of the main reasons CloudFlare exists, to handle big surges in traffic like this one. Their intro video leads me to the same conclusion. Can anyone who uses CloudFlare shed some light on this?