Tavern on the Meta

« first day (536 days earlier) ← previous day next day → last day (4478 days later) »

1:37 AM

I'm actually quite curious how anon. managed their JavaScript DDoS page (wired.com/threatlevel/2012/01/anons-rickroll-botnet)

Shouldn't cross domain restrictions prevent this from working?

mootinator

@YiJiangsProble_ I don't think so.

I came across a cross domain restriction bug yesterday.

Same origin policy

In computing, the same origin policy is an important security concept for a number of browser-side programming languages, such as JavaScript. The policy permits scripts running on pages originating from the same site to access each other's methods and properties with no specific restrictions, but prevents access to most methods and properties across pages on different sites. This mechanism bears a particular significance for modern web applications that extensively depend on HTTP cookies to maintain authenticated user sessions, as servers act based on the HTTP cookie information to revea...

Moshe

I think cross domain restrictions are dumb. I mean, any desktop or mobile app can make any HTTP request it pleases, and websites can't.

A website should be considered more secure than a desktop app, because people know that "websites can do bad stuff to your computer, like give viruses and steal credit cards".

mootinator

Harder to inject code into a desktop or mobile app.

Moshe

Right, but people are less alert to that risk.

And it makes mobile development a pain.

mootinator

1:54 AM

It's sort of amusing there are well known ways around it.

Moshe

@mootinator JSONP, for example.

But why should I need a third party server for that?

mootinator

Or in theory, they could just have sent Access-Control-Allow-Origin: * from the site they linked to.

Moshe

@mootinator Meaning that a site can turn off that restriction?

Or the destination site spoofed it?

mootinator

@Moshe I get that impression. I might have that reversed in my head.

Though I don't think it sends a request at all to a different domain.

Moshe

Ah, ok. I still think it's dumb.

Dear Interwebs, stop protecting people from HTML 3.2 hackers and bad PHP coders.

PHP 7 should be a complete restructure to obsolete the code that gives it a bad name.

Then, we can require web developers to be responsible about securing their backend databases and the web will be a happy and healthy place again.

mootinator

2:01 AM

PHP7 should be C#

New company owners keep asking if I've ever written any Java. I wonder what they have up their sleeve.

Moshe

Get a Java book and write something. Then you'll have a white lie. </bad-idea>

mootinator

Feh, they force fed me Java through university and I did a few months on a project in 2007, it isn't like it's completely foreign to me.

I have to confess though, I shudder at the thought of going back to developing without LINQ.

Moshe

What is LINQ?

mootinator

I've become a high level set operation junkie and Microsoft is my dealer.

Moshe

@mootinator I've heard about it, I think used it once to parse XML or something?

mootinator

2:08 AM

@Moshe It performs set operations. "Language INtegrated Query".

Moshe

Got an example?

Yi Jiang's Proble_

> These can, for example, be used to project and filter data into arrays, enumerable classes, XML (LINQ to XML), relational databases, and third party data sources.

mootinator

Ah, well there are many more uses, but one I like:

bool match = false;
foreach (var straw in haystack)
{
    if(straw = "needle")
    {
        match = true;
        break;
    }
}

Tim Stone

@YiJiangsProble_ Well, no, because it was proxied

mootinator

Instead I write: bool match = haystack.Any(x => x == "needle");

Moshe

2:12 AM

Ah, I see.

That's sweet.

LINQ is sweet.

^-- star me.

(I don't even really know what it is.)

mootinator

lol

Tim Stone

Based on what the article says, it seems to be some half-hearted attempt at plausible deniability, to avoid having to actually make the attack sophisticated enough to be less blatantly traceable.

Moshe

> And with that, he closed Facebook and began to productive for the remainder of the evening. The End.

> - Famous children's storybook

mootinator

Wait, what?

Moshe

@mootinator What what?

lol

mootinator

2:25 AM

Facebook is distracting?

6 hours later…