Hacker News Reader

Hacker News

Comment by code_duck | Hacker News Reader

Full thread

code_duck

Thankfully, curl can't be tricked in such a manner.

I'd have a more substantial comment, I hope, if the site was loading.

View on HN

Thankfully, curl can't be tricked in such a manner.

fetch http://jcs.org/tmp/nothing.html through curl:

      jcs@air:~> curl -s http://jcs.org/tmp/nothing.html 
      there is really nothing here, i can promise you that.

but you just aren't seeing the content.

     jcs@air:~> curl -s http://jcs.org/tmp/nothing.html | vis
     View source in Firefox. \^H\^H\^H\^H\^H\^H\^H\^H\^H\^H\^H[...]

Clever and true... I didn't say I'd view it in the terminal, though!

    curl http://jcs.org/tmp/nothing.html | vim -

Depending on how well your terminal deals with things like high unicode characters and RTL, I wonder if you could trick curl. You could also send the curl user agent harmless HTML and send Firefox / IE user agents a nasty exploit - that would probably fool me for a while.

You don't have to view the output in a terminal, though - generally I wouldn't if I was really trying to look at a file.

Server side user agent discrimination is a good point. One has have the option to send his or her own lies regarding that, though. There's always a a way to follow whatever script path to its various ends...

Yep. Sounds interesting but seems like it's meta-comments only at this stage.

If anyone happens to load this elusive "View Source Spoof" page, please leave a nice detailed description for the rest of us.

Our minds can draw the pictures :)

Cache (no images):

https://webcache.googleusercontent.com/search?q=cache:http:/...

Reply on news.ycombinator.com