a1a

I didn't mean to trivialize the issue. You describe a problem that arise when multiple parties share data with "presumptions of trustworthiness" i.e. do not perform proper input validation. No?

Wow, this is a Hyper-V breakout! I am amazed that it's 2024 and we still have problems with basic input validation.

I looked briefly at the encoder and it looks like the ad names are truncated on the size 32. Not sure why the threat actor would do that do. I guess they need some size limitation and just picked an arbitrary number

Think there is a need for a clarification. It says _member states_ of EU have trackers on their websites. Not EU itself.

1) Is that really a bad thing? Isn't it generally a good thing that law enforcement finds law-breakers?

2) So do drunk drivers that crash.

3) You're arguing against yourself. Yes, it's bad that bad guys get notified so they can avoid checkpoints.

4) Shouldn't law enforcement spend their time enforcing the law? It's well spent time IMO. As you say in (1), they also solve other more serious crimes (e.g. finding wanted criminals)

Author here. Thanks for your comment. I think you have a valid point about users clicking anything. However I would only say that's the case if you send around 20 phishing mails. In a targeted attack you want to send one or two phishing mails and you wanna maximize your chances of success to avoid a reaction from the blue team.

I agree that the impact is low compared to other vulnerabilities. It is definitely the case that you get a t-shirt (at best) for it. Though, my point is that they could be critical for the users, not for the website itself. An attacker that don't really care about the vulnerable website can still exploit the trust in the vulnerable website to perform attacks on the user he is interested in (e.g. hash stealing or malicious redirects). In fact, I believe malicious redirects is a really common payload of XSS flaws.

So that's why there is no gravity over there?

Seriously though, the statement is ignorant at best. Please help me understand the point of posting it?