neuroticnews25
Joined 1 year ago
Karma
282
Submissions
183
Member since
Feb 25
Recent submissions
Comment · 5 days ago
I'm not being exploited any more than I'm exploiting my employer, that's a toxic way to look at voluntary interactions of people doing their best to escape suffering and death.
Comment · 8 days ago
A movie version with dialogs like this would be hilarious. I don't think it's AI, just a person who doesn't know know or care about how to write in a conventionally good way, it gave my Ayn Rand vibes.
I enjoyed reading it too, but the ending was disappointing. But not as dissapointing as most comments here.
Comment · 9 days ago
The claim regarding username is 'i can make my username "signout" and it signs people out when they click my profile', not that it can contain <img src=/signout>, so no html injection here.
Visiting https://superlogout.com/ logs you out of gmail with a cross-site GET request and it's not considered a vulnerability by google [0]
Posts could contain a safe subset of html (no scripting) including <img> as a feature - that used to be an acceptable design choice. In connection with the /signout it did allow for some unfortunate shenanigans - the kind of bug you just add additional sanitization for and move on, nothing indicative of a below average code quality.
>If you don't want to call that an XSS, what would you like to call that?
I would call the version you described a HTML injection to CSRF, but as Dylan16807 noted apparently it does fit OWASP's wide definition of XSS: "Since then, the term has widened to include injection of basically any content." [1] But that's not what happened, there was no HTML in usernames and HTML in posts was intended.
[0] https://bughunters.google.com/learn/invalid-reports/web-plat...
[1] https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Sc...
Comment · 10 days ago
>It's not blocked anywhere that much more tame sites are usually blocked
Any examples?
Comment · 10 days ago
There's actually no proof or claim of XSS vulnerability in this bizarre article. Username url confused with special url is a common bug, I've seen it "exploited" on facebook.
Comment · 11 days ago
I don't think being hacked by an anonymous entity grants much political advantage? If anything the downside is shifting the overtone window by dumping all the far right takes on the broad public and making them a bit more familiar.
Comment · 15 days ago
It's a great way to watch whatever you feel like watching on whatever device, frankly I don't even know what are the alternatives.
Comment · 16 days ago
>Its fictional opponent's inability to understand elementary explanations does much of the argumentative work
My reading is the inability to understand serves only as an educational device for the reader. After all, at the end of the article the only point of contention is whether or not the objective truth exists. Is your point that the postmodern types don't claim that it doesn't? Or that they're an easy target used to later claim victory against a larger group?
Comment · 19 days ago
There are also homeless people, not every IT guy has the wherewithal to be a trashman.
EDIT typo
Comment · 20 days ago
This sounds like you're equating the defender's right to counterattack with the attacker's right to continue the attack?
Comment · 23 days ago
This, but unironically. Why would we assume that's not possible?
Comment · 23 days ago
It's a new technology and we're figuring out important distinctions as we go, nothing necessarily intellectually dishonest about that.
Comment · 26 days ago
But isn't the wet market hypothesis equally bad looking for China?
Comment · 29 days ago
It would be way more fun if it showed by default the results for the questions I've answered instead of all the questions sorted chronologically. How could you not think of that?
Comment · 29 days ago
What about Minimax algorithm playing Tic-Tac-Toe? Is it inteligent? Is it inteligent we if we reduce the search depth so the right decision is not obvious?
EDIT with every day I hate you more and more