Topic numbers in quotes can be hijjacked to point to any site suburl
-
The topic numbers in a post can be hijjacked to point to any target in the parent domain.
@sloosecannon, post:cf2dd3ce76deaca6.exe, topic:../../../uploads/default/18753 said:
Follow me for context!
Raw:
@sloosecannon, post:cf2dd3ce76deaca6.exe, topic:../../../uploads/default/18753 said:<blockquote>Follow me for context!</blockquote>
Given that uploads are not checked and can be unrestricted, this allows users to hijjack post "follow" links to arbitrary files hosted on the server, including images, HTML pages, and even EXECUTABLE FILES
Paging @pjh and @sam for security
haxxored.exe (8 Bytes)
-
inb4 shadows password, or sams?
-
inb4 shadows password, or sams?
Nah it's not malicious. It's actually just a text file renamed to .exe just to prove it can be done. But I could put something nasty there :P
-
Fucking priceless. <MyAvatarX1E100.exe>
-
Any probability of accessing a file uploader and we can rewrite bits of discourse?
-
Well since you can upload anything you want using the little "upload file" button, we already have one
-
Note that we threw out any security for uploaded files when the allowed extensions whitelist was set to
*
.
-
Duly noted
The setup at wtdwtf is probably not optimal from a security standpoint...
-
passwords.txt (7 MBytes)
-
passwords.txt (72 KBytes)
-
-
It's really that easy to fake a download link?
-
-
remember, they don't sanitize anything from posts that their side has to put in, instead of sanitizing the user input, then running it through their piece which will put in things that are functional, like @-mentions and apparently "attachment"
Good point. Because sanitizing user input and then cooking would be too much like Doing It Right™ for Jeff.
BRB.
-
-
inb4 hacked
Haxor fail.
But I did post this on meta.d:
-
Should've pointed the links to @rickroll
-
I didn't want to piss them off. I wanted them to potentially get their shit together.
Also, I had to make the topic title longer because of this:
Thank you Duckwhores for popping a toaster which covers the field you are requiring me to edit!
-
Lawl.
I posted that, but called it @rickroll
Plus it's just a youtube link. Not like one of those sites that takes over your browser with JS/Flash/html5 or something
-
When did they start displaying avatars in circles on meta.d? It looks awful now.
-
Oh dear, they've actually done it now?!
edit: Yup.
-
And for when it turns up here on the next Discoupdate™
-
did they at least take my advise and apply it everywhere?
also.... sorry....
hopefully it's in CSS so we can fix it.
edit: yep they did it everywhere.... doesn't look half bad actually....
-
Evidently my suggestion of 5% rounded corners was overlooked entirely... would have been a decent compromise too...
-
yeah, but take a look at how it came out..... also apparently Jeff is a G+ fan because G+ recently made avatars round and G+ is "cool" (apparently.... i still don't get it)
-
-
I'll admit, it's OK, but I've always preferred square.
Maybe the TDWTF style can do the slightly rounded corners...?
-
I just removed my avatar from meta.d in protest.
Not that I expect anyone will notice, much less care...
-
Oh dear, they've actually done it now?!
@codinghorror said:
I've given this a year of thought and I think rounded is the way to go.
-
LOL, I'm amused by them being confused about how long is discoursistently takes for an avatar update to work.
-
Is "bikeshedding" a term normal human beings use? ... And what does it mean?
-
what does it mean?
This is a metaphor indicating that you need not argue about every little feature just because you know enough to do so. Some people have commented that the amount of noise generated by a change is inversely proportional to the complexity of the change
-
Is "bikeshedding" a term normal human beings use?
Apparently so…
@blakeyrat said:And what does it mean?
Worrying about trivialities so much they ignore the more important issues.Edit: d
-
It's nothing I've heard before, or I'd expect normal humans to use.
The term was coined as a metaphor to illuminate Parkinson’s Law of Triviality. Parkinson observed that a committee whose job is to approve plans for a nuclear power plant may spend the majority of its time on relatively unimportant but easy-to-grasp issues, such as what materials to use for the staff bikeshed, while neglecting the design of the power plant itself, which is far more important but also far more difficult to criticize constructively. It was popularized in the Berkeley Software Distribution community by Poul-Henning Kamp[1] and has spread from there to the software industry at large.
bikeshedding (uncountable)
Futile investment of time and energy in marginal technical issues.
Procrastination.
-
-
-
eh, everything on this stupid duckwhores can be hijacked, that's the beauty* of 30 versions of markupdowncode.
*not
-
I can't, we're stuck in a 10-hour meeting about bike shed paint.
-
Why is he apologizing for that? That's all Discourse ever does!
Also "bikeshedding"? That is the term we created for that? What the fuck is wrong with people! It's like they're actively trying to make the most confusing jargon ever.
-
Thank you Duckwhores for popping a toaster which covers the field you are requiring me to edit!
We have a winner.
-
But it means you have to read it to continue posting. Surely that can't be annoying!
-
This type of avatar is a much more fun protest....
https://meta-discourse.global.ssl.fastly.net/user_avatar/meta.discourse.org/darkmatter/120/40565.png
edit: family-friendlified...ish.
-
I just had a fiendish idea …
Of course, @PJH gets first dibs to use it. :P
-
Seriously though... if I wanted a round avatar, I'd use one. Like I did here.
Now I might just make an entire square avatar that's outside the circle?
-
-
-
I prefer mine a little less… bright
-
I am surprised jeff didn't put these in his duckwhores[code] | Warning: Your mail program have not even shown you the |
| entire message yet. Logically it follows that you cannot |
| possibly have read it all and understood it. |
| |
| It is not polite to reply to an email until you have |
| read it all and thought about it. |
| |
| A cool off timer for this thread will prevent you from |
| replying to any email in this thread for the next one hour |
| |
| [Cancel] |
+--------------------------------[/code]Also
They also created the bikeshed.org website with my email, and suddenly it seemed that the bikeshed meme infected all of known computing in no time.
Where "all of known computing" = "the handful of OSS projects that he spammed with his crappy bikeshed analogy"
-
Hmmm... Actually, I think I like the greens better...
-
If my icon was rounded you wouldn't see Bleeping.
You'd see like eepin
Which is kind of cool also.