Hacker News Reader

Hacker News

Comment by dguido | Hacker News Reader

Full thread

dguido

Probably should rename this to "billion reposts."

Can we move beyond this simple issue and discuss more complicated aspects of security on HN?

View on HN

Fine, you guys asked for it.

https://news.ycombinator.com/item?id=259458

https://news.ycombinator.com/item?id=3859853

https://news.ycombinator.com/item?id=1674911

https://news.ycombinator.com/item?id=301296

https://news.ycombinator.com/item?id=4619344

People that exploit these kinds of things continue to innovate, but HN seems to be stuck with XSS, SQLi, and malformed XML.

While I'm all with you on talking about advanced security, the reality is that most people here don't understand basic security. I think talking about the low-hanging fruit is important -- everyone has to start somewhere. And as always, if you want to see more advanced security stuff, post it! I'll upvote it for sure.

Edit: This does make me think that I've been meaning to write a blog post about a security issue I discovered for about 6 months now. Time to do that.

Which he did: http://news.ycombinator.com/item?id=4678309. This is a tale in which cody pretty much ends up owning ccbill.

Please consider that none of those posts with any comments in them took place within the last two years. And "sadly" gets created just to tell people to read more books. Sad indeed...

EDIT:

HN seems to be stuck with XSS, SQLi, and malformed XML

HN is not a person: half of today's HN didn't exist two years ago [1].

[1] http://blog.rjmetrics.com/surprising-hacker-news-data-analys...

The problem here is that a lot of newly minted IT professionals will write stuff that will allow a re-use of all those old exploits all over again.

Occasionally warning people about known dangers doesn't harm. Sure that's not exactly moving the needle but it may help to mitigate a few lurking problems that people were not yet aware of.

Think of it as a 'wear your seatbelt' advertisement. If you're already wearing your seatbelt then it wasn't meant for you.

Entirely appropriate. We've probably had a minimum of 20-30 reposts over the problems with saving passwords as simple salts+hashes, which is a useful introduction to bcrypt/scrypt/pbkdf2.

I'm so tired of these "seen it before, I'm smarter and more senior than you" responses.

Look, if people vote it up it means they like it. Just because its been talked about before doesn't make it less valuable.

Disagree. I didn't know about that attack and found it very interesting.

Sadly, it's because you aren't reading enough books.