Top all-time · #13911
Defined Misbehaviour
Personal blog · blog.saynotolinux.comsecurityweb
Defined Misbehaviour is a personal blog at blog.saynotolinux.com about security and web. Since 2013, 5 different Hacker News readers have linked it 7 times. The last post was in 2016, but the archive is still widely read.
Too few sampled comments (3) to say how often HN recommends it.?
Why HN links it
HN readers link this blog for posts on browser security: a CSS side-channel attack on iframes, a hack of a Chromium iframe blocker, and a critique of Uber's bug bounty program. Comments only cite these posts.
Summarised by Claude from a sample of 3 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
TL;DR From at least 2013 until May 2016 JetBrains' IDEs were vulnerable to local file leakage, with the Windows (EDIT: and OS X) versions …
What Hacker News says?
Yes, this isn't even the first cross-domain leakage attack on iframes using CSS. [0] There were similar issues with how hit testing was implemented for `document.elementFromPoint()`[1], and probably tons of other things I'm forgetting. Ideally cross-origin framing would have been disallowed by default but frames were added to the spec before people spent a lot of time thinking about the same-origin-policy implicatio…
Comment linking /blog/2014/02/05/whats-that-smell-sniffing-cross-origin-frames-in-firefox/
on “Side-channel attacking browsers through CSS3 features”Submitted JetBrains IDE Remote Code Execution and Local File Disclosure as a story · 145 points
HN discussion(Wrote about this on reddit but I think it is pending approval, reposting here) Hi - I work on the security team at Uber. I am this guy: techcrunch.com/2016/03/22/uber-launches-bug-bounty-program-that-pays-hackers-to-find-security-issues/ Yesterday we changed the language on our bug bounty page and I wanted to apologize for the confusion this caused. Since we launched our public bug bounty program on Tuesday, we hav…
Comment linking /
on “Uber Bug Bounty Program – It's a Sham”Submitted Seizing Control of Yahoo Mail Cross-Origin Again as a story · 52 points
HN discussion> https://addons.mozilla.org/en-US/firefox/addon/requestpolicy... I like and use RequestPolicy on a daily baiss, but unfortunately the version on AMO hasn't been updated for some time now. There are a number of long-standing issues (like clicking links in the view source view,) including one that allows bypassing the whitelist entirely [0]. >this one has better granularity (you can specify the type of content [...]…
Comment linking /2013/11/bypassing-requestpolicys-whitelist.html
on “Chromium: I just wanted to quickly hack an iframe blocker for personal use”Submitted Leaking Clipboard Contents with Flash as a story · 3 points
HN discussionSubmitted Yahoo's Pet Show of Horrors: Leaking a User's Emails Crossdomain as a story · 3 points
HN discussion