It was an interesting manipulation of the system, but as pointed out it's a dangerous slope. A community based on trust will sour very quickly if a lot of these tricks pop up.
Sharing the trick is entirely reasonable: small hacks like this are something to be proud of, given that you've acted in a reasonable way (e.g. contacted the site and informed them before telling others, not actually using it game the system, etc.)
Hackers should know how to secure their own website. Between this and the JS injection hack (from the same fellow), it's clear that security is porous at best.
As a kid I never understood why some of the kinds made it a hobby to trash the sandcastles built by the others. It was an interesting phenomenon to watch :)
Maybe they thought that if they wanted to, they can do better, but they never did.
Or maybe it's a cop-out to say that you didn't care about your sand castle's security in the first place. If you knew of a way to keep it from getting knocked over, you'd use it.
I'm sick of security. I wish we could make things without worrying about the myriad ways there are to destroy a thing?
What did xach have to gain by doing this experiment that he would have lost by emailing PG quietly, beyond the childish feeling of destroying a good thing?
Really though, this is such a simple attack you'd think that it would be protected against. Any argument about "trust" is irrelevant due to the frustratingly simple way this system has been gamed. Usernames, that's it? I'm surprised this didn't happen sooner.
Not hilarious if we start getting swamped with budding script kiddie attacks. This is a nice community, it would be great if we didn't start attracting that type of attention.
Comments
Hilarious. The head of "Hacker News" is mad because his news has been hacked.
It was an interesting manipulation of the system, but as pointed out it's a dangerous slope. A community based on trust will sour very quickly if a lot of these tricks pop up.
Sharing the trick is entirely reasonable: small hacks like this are something to be proud of, given that you've acted in a reasonable way (e.g. contacted the site and informed them before telling others, not actually using it game the system, etc.)
Could have gone that way. Didn't.
What? It's bad for security bugs to be exposed to the public rather than to have people silently exploit them?
Hackers should know how to secure their own website. Between this and the JS injection hack (from the same fellow), it's clear that security is porous at best.
Where do you work, erlanger? Let's have a look.
As a kid I never understood why some of the kinds made it a hobby to trash the sandcastles built by the others. It was an interesting phenomenon to watch :)
Maybe they thought that if they wanted to, they can do better, but they never did.
Or maybe it's a cop-out to say that you didn't care about your sand castle's security in the first place. If you knew of a way to keep it from getting knocked over, you'd use it.
Being an asshole is just that - being an asshole.
It doesn't really involve anyone else.
Know who knocks over a sand castle? A dick.
I'm sick of security. I wish we could make things without worrying about the myriad ways there are to destroy a thing?
What did xach have to gain by doing this experiment that he would have lost by emailing PG quietly, beyond the childish feeling of destroying a good thing?
Hilarious, if you consider the only definition of "hacker" to be someone who breaks into or otherwise exploits computer systems.
Obviously that's not the definition we use here. If you haven't figured that out by now, perhaps this isn't the place for you.
> If you haven't figured that out by now, perhaps this isn't the place for you.
God forbid anybody here should have a sense of irony.
Err, that's my point, it's not ironic if you don't use your definition of "hacker".
It was the way he did it. If he'd just sent me an email about this hack I'd have been amused and grateful.
Really though, this is such a simple attack you'd think that it would be protected against. Any argument about "trust" is irrelevant due to the frustratingly simple way this system has been gamed. Usernames, that's it? I'm surprised this didn't happen sooner.
Not hilarious if we start getting swamped with budding script kiddie attacks. This is a nice community, it would be great if we didn't start attracting that type of attention.
He didn't necessarily say he was mad.
He did say it wasn't cool - which is a fact.
What xach did wasn't cool, although perhaps inevitable on a public site.