Not cool. We deliberately don't put that much effort into security, because this is a community based on trust, not a bank. And by choosing to publish this rather than e.g. simply sending me an email about it, he's inviting people to do this.
I think a lot of people are missing the point here. Sure what he did wasn't "cool" since it deceived users who are part of a community that is based on trust and responsibility. But he found a potential exploit and instead of using it irresponsibly he brought it to the attention of the community. Maybe the right thing would have been to contact PG. Maybe he takes lessons from the Windows world of bugs... If it's not made public for exploitation, it may never get fixed.
In my opinion this should be looked at as a learning experience for web developers. We need to take these issues/exploits into account when building websites. I'm pretty sure PG accounts for XSS attacking, no? If we trust each, shouldn't we trust each other enough not to post malicious code? Unfortunately it just doesn't work like that. Security by obscurity is never the answer!
As much as this was done irresponsibly, is a fix planned for this? CSRF is, by now, a widely investigated field of web application development; most of the mystery is gone. To borrow a term from The Old New Thing, it's one of the taxes everybody has to pay.
This is not how the community functions however. The community functions by being made up of a group of people who believe in courtesy. It is not vulnerable to any sort of software hack, instead it is vulnerable to the slow drift towards thoughtlessness.
That's kind of the point, nothing was said that wasn't already public available information, yet people got angry at Xach for saying it.
The lack of trust is not trusting the community not to abuse an explained hack, and the whole is made dumb by the fact that anyone can figure out the hack for themselves even if it wasn't explained to them.
It was an interesting manipulation of the system, but as pointed out it's a dangerous slope. A community based on trust will sour very quickly if a lot of these tricks pop up.
Sharing the trick is entirely reasonable: small hacks like this are something to be proud of, given that you've acted in a reasonable way (e.g. contacted the site and informed them before telling others, not actually using it game the system, etc.)
Hackers should know how to secure their own website. Between this and the JS injection hack (from the same fellow), it's clear that security is porous at best.
As a kid I never understood why some of the kinds made it a hobby to trash the sandcastles built by the others. It was an interesting phenomenon to watch :)
Maybe they thought that if they wanted to, they can do better, but they never did.
Or maybe it's a cop-out to say that you didn't care about your sand castle's security in the first place. If you knew of a way to keep it from getting knocked over, you'd use it.
I'm sick of security. I wish we could make things without worrying about the myriad ways there are to destroy a thing?
What did xach have to gain by doing this experiment that he would have lost by emailing PG quietly, beyond the childish feeling of destroying a good thing?
Really though, this is such a simple attack you'd think that it would be protected against. Any argument about "trust" is irrelevant due to the frustratingly simple way this system has been gamed. Usernames, that's it? I'm surprised this didn't happen sooner.
Not hilarious if we start getting swamped with budding script kiddie attacks. This is a nice community, it would be great if we didn't start attracting that type of attention.
Comments
Not cool. We deliberately don't put that much effort into security, because this is a community based on trust, not a bank. And by choosing to publish this rather than e.g. simply sending me an email about it, he's inviting people to do this.
I think a lot of people are missing the point here. Sure what he did wasn't "cool" since it deceived users who are part of a community that is based on trust and responsibility. But he found a potential exploit and instead of using it irresponsibly he brought it to the attention of the community. Maybe the right thing would have been to contact PG. Maybe he takes lessons from the Windows world of bugs... If it's not made public for exploitation, it may never get fixed.
In my opinion this should be looked at as a learning experience for web developers. We need to take these issues/exploits into account when building websites. I'm pretty sure PG accounts for XSS attacking, no? If we trust each, shouldn't we trust each other enough not to post malicious code? Unfortunately it just doesn't work like that. Security by obscurity is never the answer!
XSS, yes. CSRF, no, or at least not completely. You still need to know the user's username, which is better than it could have been.
This was a CSRF attack, which is mostly unrelated to XSS.
As much as this was done irresponsibly, is a fix planned for this? CSRF is, by now, a widely investigated field of web application development; most of the mystery is gone. To borrow a term from The Old New Thing, it's one of the taxes everybody has to pay.
You're adding to the drama. Just let it go.
Trust, but verify.
Don’t trust. Just verify.
So the community is based on trust yet you don't trust the community with information on how the community functions.
The code for HN is open source:
http://arclanguage.org/
This is not how the community functions however. The community functions by being made up of a group of people who believe in courtesy. It is not vulnerable to any sort of software hack, instead it is vulnerable to the slow drift towards thoughtlessness.
Huh? You can download the source code for HN, and you can infer how voting happens from Firebug. Where's the lack of trust part?
That's kind of the point, nothing was said that wasn't already public available information, yet people got angry at Xach for saying it.
The lack of trust is not trusting the community not to abuse an explained hack, and the whole is made dumb by the fact that anyone can figure out the hack for themselves even if it wasn't explained to them.
you should fix it instead of making excuses
Hilarious. The head of "Hacker News" is mad because his news has been hacked.
It was an interesting manipulation of the system, but as pointed out it's a dangerous slope. A community based on trust will sour very quickly if a lot of these tricks pop up.
Sharing the trick is entirely reasonable: small hacks like this are something to be proud of, given that you've acted in a reasonable way (e.g. contacted the site and informed them before telling others, not actually using it game the system, etc.)
Could have gone that way. Didn't.
What? It's bad for security bugs to be exposed to the public rather than to have people silently exploit them?
Hackers should know how to secure their own website. Between this and the JS injection hack (from the same fellow), it's clear that security is porous at best.
Where do you work, erlanger? Let's have a look.
As a kid I never understood why some of the kinds made it a hobby to trash the sandcastles built by the others. It was an interesting phenomenon to watch :)
Maybe they thought that if they wanted to, they can do better, but they never did.
Or maybe it's a cop-out to say that you didn't care about your sand castle's security in the first place. If you knew of a way to keep it from getting knocked over, you'd use it.
Being an asshole is just that - being an asshole.
It doesn't really involve anyone else.
Know who knocks over a sand castle? A dick.
I'm sick of security. I wish we could make things without worrying about the myriad ways there are to destroy a thing?
What did xach have to gain by doing this experiment that he would have lost by emailing PG quietly, beyond the childish feeling of destroying a good thing?
Hilarious, if you consider the only definition of "hacker" to be someone who breaks into or otherwise exploits computer systems.
Obviously that's not the definition we use here. If you haven't figured that out by now, perhaps this isn't the place for you.
> If you haven't figured that out by now, perhaps this isn't the place for you.
God forbid anybody here should have a sense of irony.
Err, that's my point, it's not ironic if you don't use your definition of "hacker".
It was the way he did it. If he'd just sent me an email about this hack I'd have been amused and grateful.
Really though, this is such a simple attack you'd think that it would be protected against. Any argument about "trust" is irrelevant due to the frustratingly simple way this system has been gamed. Usernames, that's it? I'm surprised this didn't happen sooner.
Not hilarious if we start getting swamped with budding script kiddie attacks. This is a nice community, it would be great if we didn't start attracting that type of attention.
He didn't necessarily say he was mad.
He did say it wasn't cool - which is a fact.
What xach did wasn't cool, although perhaps inevitable on a public site.
I think using the excuse of "trust" for having security holes is not justified.