Who need XSS when you can simply ask?

http://www.reddit.com/r/programming/comments/9oj39/javascript_in_a_single_picture_seen_on_a/

by judofyr • 17 years ago

43 25 17 years ago

dredge• 17 years ago

Excellent! Took me a while to work out what was going on there. I'm going to blame it on the apparent removal of the comment that started it though.

jrp• 17 years ago

For others: scroll to the lower part of the page.

NathanKP• 17 years ago

When I viewed it there were about 50 spammed comments. That was a cute worm attack. ;)

camccann• 17 years ago

This is an excellent illustration of a core principle of security: anything relying on "educate the user so that they know better" is doomed to failure.

raganwald2• 17 years ago

To be precise, anything relying on "educate the user so that they know better" is doomed to be insecure. It is likely to be successful in the sense of becoming popular because it offers humans someone else to blame.

For example, if I am in IT and I tell people to choose a 512 character password with alphanumeric characters that changes every day and doesn't repeat any sequence that appeared in a previous password or contain a dictionary word, I can expect people to write their passwords down on paper and get hacked, even if I tell them not to write it down.

But I can always blame them for writing them down, few people will blame me for being too lazy to find another way to secure the system.

Sidnicious• 17 years ago

In most cases, users will either:

1. Choose a memorable (read: simple, dictionary, insecure) password

2. Choose a good password and write it down

If Joe the Cubedweller writes his login password down on a sticky note, the only other people who are expected to have physical access to that note are him and the other cubedwellers, and they're going to have little to gain from seeing it. I would be much more concerned with Joe picking a bad password that could be guessed by an attacker on the outside.

tessro• 17 years ago

Makes you wonder how many popular websites are using code snippets copied and pasted verbatim from the web.

mahmud2• 17 years ago

"Javascipt The Good Parts" is to the Rhino book what "The Little Lisper" is to the hyperspec.

tlrobinson• 17 years ago

The rhino book is still an invaluable reference.

I own both, I've read both, but the rhino book is the one sitting on my desk 24x7.

mahmud2• 17 years ago

No Common Lisper can live without the Hyperspec; it doesn't sit on our desks but its content is interwoven with every Lisp IDE and with SLIME.

startingup• 17 years ago

Summary (it is all a little meta for me): the reddit link above started as a fairly innocuous reddit thread comparing the sizes of the two books "Javascript - The Definitive Guide" and "Javascript - The Good Parts" - the Good Parts being a good deal smaller as the linked photograph illustrates.

Some wise guy decided to have a little joke, and posted a comment instructing people to copy and paste a snippet of Javascript on their URL location bar. A lot of people (presumably "web programmers") did as instructed. That little snippet posts a comment on that same thread, instructing the next person to do the same. That entire reddit thread is overrun with those script generated comments.

Social lesson: we are fked as far as security is concerned, if that reddit thread is any indication: even programmers would sheep-like do as they are instructed. I suppose that was the "lesson" the wise guy had in mind.

Some good samaritan posted another Javascript snippet to clean up the reddit thread - automatically downvote the spam comments or hide them.

TheElder2• 17 years ago

I would have to assume that people knew better, knew what it would do, and ran the JS anyways as a joke.

salvadors2• 17 years ago

You do, of course, know the problem with assuming?

(And Ming can be merciless about such things)

buugs• 17 years ago

At first I thought it was the picture that was causing all those posts because I didn't think people were really dumb enough to paste javascript in their browser when they don't even know what it does (especially on the programming reddit...)

Way to prove my belief wrong!

TheElder2• 17 years ago

Probably many knew what it would do, so that's why they ran it, as a prank/joke.

_b8r0• 17 years ago

Reminds me of the save this picture as foo.js shit bricks attacks on 4chan.

mcantor• 17 years ago

"Given a choice between dancing pigs and security, users will pick dancing pigs every time." - Edward Felten and Gary McGraw

throw_away• 17 years ago

It's gotten worse in the last hour or so. Someone's modified the worm so that simply looking at a page with the comment will cause you to start replying to all the posts on that page. Coupled with the fact that reddit has the "red/orange envelope" feature, whereby users are notified if somebody replies to their posts, and the fact that users tend to watch for said envelope in anticipation, the site seems to be melting down.

eli• 17 years ago

It's actually when they mouseover any link, and it's mostly thanks to a nasty bug in the Python markdown implementation.

Who need XSS when you can simply ask?

Related Stories