z-factor

This is interesting, but it would help if you could provide .wav files for others to hear and see for themselves.

AMD - $2.7B

You have a strange standard for 'savvy' people.

Yes.

I understand how the attack works, the question was about how a practical exploit would actually be carried out. I've figured out how one would issue GET requests from the right environment, but I don't know if the same is possible for POST.

The request has to be issued by the attacker from the victim's browser. If the attacker can do that, why is he unable to read the response to that request?

Edit: I think I can see a scenario where a third-party website does these requests via an <iframe> or an <img>. I'm not sure there's a way to do POST quite as easily.

The attacker has to be able to issue requests on behalf of the user with injected "canary" strings. I fail to see a practical exploit where one can do this and wouldn't have access to the secret in the response anyway. What am I missing?

Speaking from personal experience (Ukraine).

There are plenty of job opportunities and the coders are relatively even more overpaid than in the West, so that's not the reason.

The real reason I believe is that people mostly can do this with impunity. There's very little being done for prevent or prosecute credit card fraud. In Ukraine and Russia CCs are still used very little, so this fraud hurts "the West" which is mostly seen as a good thing by the general population. Rampant piracy is practically encouraged for the same reason.

Of course this creates a barrier for doing legitimate business online. For example PayPal simply does not allow merchant accounts from Ukraine and Russia to reduce fraud. These countries are the safe haven for hosting illegal content etc. It would benefit local programmers to clean up the reputation of the country and to my great annoyance people just do not realize this. Crooks are accepted as keynote speakers at business conferences etc (they do make money, so what's the problem?)

Banks seem to be doing ok.

Funny thing is that code is then compiled with a compiler was not formally verified, so it's still a 'fingers crossed' situation.

> A quality of a great leader.

That or exaggeration.

I remember reading though a page where they listed their employees and I remember it was 100+, I wanted to include the link in my comment, buy couldn't find it this time.

Wikimedia employs a lot of people, I personally do not donate because I believe they employ way too many. Also pretty much all costs are already covered by corporate sponsors like Google.

They were using Akamai and not CloudFront last time I checked (which was a while ago). And of course they must have legacy systems that were built before their in-house solutions were available.