News for hackers. Stuff that matters.

mrfu

mrfu on Hacker News

Re:CSRF: Cross-Site Request Forgeries on Thursday July 19, 2012 @10:54AM (#4266244)
* These are submitted with a form (over POST, hopefully) *

I don't think that the author implies that using POST prevents CSRFs but the article seems to imply it. In case anyone thinks it is the case: using POST won't prevent a CSRF.

Cross Site Request Forgeries occur when a user opens an "evil" page on site B, while being logged on site A. If site A solely relies on cookies in order to identify logged users, there is a risk of CSRF. The attack exploits the fact that the user's browser will always send the auth cookies when issuing a request to siteA. If the evil page on siteB embeds an image (or script, or any resource that can be loaded using an URL) whose source is an URL on siteA, the browser will request the resource on siteA with the auth cookie coming along.

In order to issue a POST request to siteA from the evil page, the attacker only has to submit a crafted POST form using an iframe.

Re:Reducing Java Memory Usage and GC with UseCompressedOops VM Option on Friday March 16, 2012 @03:29PM (#3714885)
It is not clear whether it reduces the heap size, or the overall footprint of the java process.

By the way, if anyone knows of a method to reduce the RSS size of the java process, I'd be more than grateful to hear about it.

Re:I am a great programmer, but horrible algorithmist on Friday February 10, 2012 @08:46AM (#3575738)
As a programmer, I have been hugely influenced by mathematics. I don't say it in the sense that I use math heavy concepts when programming, but the practice and experience I gained through mathematics have improved my programming style (more rigorous approach) as well as my understanding of algorithms.
Re:Your Phone Loses Value Pretty Fast (Unless It's an iPhone) on Wednesday February 08, 2012 @02:24PM (#3568004)
"At Priceonomics, we firmly believe that resale value is the best objective indicator of product quality."

I may have missed something, but given that prices are supposed to reflect the supply vs demand ratio (in a sane market), how can they end up "firmly" believing that resale value is an objective indicator for quality ?

Re:The Spider of Doom on Wednesday October 12, 2011 @12:08PM (#3103417)
There are two problems.

1: disabling cookies bypasses security checks

2: a GET request is not side-effect free

The root cause is the combination of both issues.

Re:Using Wolfram Alpha to prove 1=0 on Thursday April 21, 2011 @05:19AM (#2469892)
Riddle me this: what value does the power series Σn=0∞xn/n! have, in terms of x? Of course, the answer is ex

From my (fuzzy) math memories, I thought that:

exp(x)= 1 + (x^1/1!) + (x^2/2!) + ... + (x^n/n!) + o(x^n) _near_ x=0

Re:SVG Girl IE9 HTML5 Promo on Monday April 18, 2011 @09:28AM (#2458980)
More like a less gloomy http://en.wikipedia.org/wiki/Serial_Experiments_Lain
Re:Why Africa May Never Produce a Facebook, Groupon, Zynga or Google on Friday April 08, 2011 @04:15AM (#2422921)
I totally agree that each country is different (I am half-african and I've lived in a west african country for more than 15 years). The issue is way more complex than it appears. But as far as my experience can tell, corruption makes every single effort required to build something a real pain.
Re:Why Africa May Never Produce a Facebook, Groupon, Zynga or Google on Friday April 08, 2011 @03:57AM (#2422888)
How about corruption and lack of political stability ?
Re:Hotz fires a powerful blast back at Sony's California jurisdictiona... on Monday March 28, 2011 @04:21PM (#2379912)
I "vote" with my money too. I wonder if there is an opportunity for an app that would easily enable a consumer to check whether the company (s)he is willing to buy from is in line with its ethics.
Re:Your code should be taken out back, lined up against a wall, and ma... on Tuesday July 27, 2010 @03:12PM (#1552343)
For further information http://insecure.org/stf/smashstack.html is an interesting read.