"Hacking" Skrill/Moneybookers, Bitbucket, Github, Heroku etc
homakov.blogspot.ca
homakov.blogspot.ca
Sorry all that I took your time for considering the problem.
I see you are not interested to do/solve anything and my arguments worth nothing.
Deleted comment
Warning top bar is only my proposal. You can dislike it - but you cannot dislike the fact that CSRF is dangerous.
And, Please, note. The real problem with CSRF - while we (developers, browsers) are fighting - USERS SUFFER. E.g. they lose money from skrill account. They follow spam subscriptions. ETC. Isn't it awful?
I think you're wrong about it being a browser bug, or even that it's amenable to browser fixes. Maybe I'm wrong. But I'm only interested in the engineering discussion, not the morality play.
I'm either. Yes, those all are just security bugs. Known, sometimes fixed, sometimes reported. But I wont even try to check Alexa Top for XSS - I m pretty sure I won't find anyting. Bugs are different, that's why CSRF seems the most dangerous to me.
And he has a point. While I dislike the whole "lean startup" thing a lot of people promote and adore it. And along Learn, Measure, Adapt, Innovate and other big words, I don't see a Secure your Damn App section.
When I write my controllers I can't focus completely on my product - I also have to think if this mass assignment is vulnerable.
From the article: I don't even mention middle and small websites. they're just doomed...
Being at a small website and working day and night, at the end of it I look back, feel like I've accomplished a lot, but deep down know that I understand almost nothing about the security implications for 90% of what I touch.
My security is based on obscurity. I know it. And it keeps me up at night.
homakov has just done some damn fine work, and it deserves actual discussion, not dismissal and downvotes.
Honest question: could many of these have been addressed if the browser simply didn't send a cookie along with a post or get to a domain that violated the usual same-origin rules? At a glance, it looks like most of the sites are receiving some kind of account or session information from the browser, with Slideshare being a notable exception (they just flatly Did It Wrong).
> That was an expected behavior, so I hope, this post makes them to face facts. 2+2=4 and CSRF = the huge, wide-spreaded problem that should be solved now or never.
From the previous discussion, your critics were mostly concerned about your "solution" to CSRF. As was said there, it's not a browser vulnerability. It's an application vulnerability. I agree with you that CSRF is a problem that desperately needs as much attention as SQL injection has gotten over the years, but don't get sour because your solution to block all POST requests to different domains[0] is inadequate.
Aside from the bitterness towards people pointing out inaccuracies in your previous post, this was great. Developers should be thinking about CSRF (and basic security) more!
[0]: http://news.ycombinator.com/item?id=3779160 "Please point out where in my post I said to deny ALL requests. I was talking about ONLY POST requests."
We'll get there. This is a much more straightforward problem to solve than XSS, which is the real bitch.
I always wondered if it'd be possible to use the type system of a language to do something similar - make a "safe to output" type, and a "not safe to output" type, which are not mutually convertible, and then write a function that converts between UnsafeStr and SafeStr. Then, you can write all your code to only work on and only print a SafeStr.
1. What is "safe content"? That entirely depends on the context in which you're using a particular string. (See https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%... for a summary of the kinds of things you have to think about)
2. The system you're describing is somewhat similar to http://yehudakatz.com/2010/02/01/safebuffers-and-rails-3-0/. People still find plenty of XSS vulnerabilities in Rails applications.
>>> foo = u'I <3 you.'
>>> bar = Markup(u'<h1>') + foo + Markup(u'</h1>')
>>> print bar
<h1>I <3 you.</h1>Kudos for finding them, I hope you reported them.
Second time he's shown vulnerabilities in Github. Maybe he's not great at reporting but I would still value him more then the sexist rockstars that seem to have no problem getting jobs.