HN user

diwo

29 karma
Posts0
Comments6
View on HN
No posts found.
Linux Dash – Simple web-based server monitoring 12 years ago

It looks like a cool project and the interface pretty well done too. Good job.

Is there something particular you want to specifically mention that has happened since you last shared the app five months ago? - https://news.ycombinator.com/item?id=7125153

Anyways, as this is shared here on a developer oriented forum, it would be fitting to speak of the actual implementation too. Taking quick look at the source, it seems to have some security issues ranging from XSS to potential CE. These seem to arise from common bad practices.

I would advice going through the source code and making sure all values you echo as JSON are properly encoded and that you don't use anything as-is in a shell command.

Few examples:

- https://github.com/afaqurk/linux-dash/blob/7bd5dcb637f815702... - https://github.com/afaqurk/linux-dash/blob/7bd5dcb637f815702... - https://github.com/afaqurk/linux-dash/blob/7bd5dcb637f815702...

0ThreadHN
Yo hack 12 years ago

Why are they even storing phone numbers in plain text. According to their Privacy Policy, the numbers are only used for finding friends; i.e. they look up your contacts from their database.

In which case, to do that they do not need the plain phone number, but only a hash derived from it. This is like storing passwords in plain-text.

0ThreadHN
IPv4 Address Report 12 years ago

See http://ipv6-test.com/stats/. You can filter the list by country to see results by ISP.

The data is collected from users that visit the site and take part in the test. Keep in mind that the data isn't conclusive as the end-users location, and his hardware, effects the providers offerings and the statistics.

0ThreadHN