How to find security holes | Hacker News Reader

How to find security holes

canonical.org

16 pointsiamwil14 comments

From the article:

"Note: I haven't found any security holes, so take this with a pillar of salt."

Also canonical.org != the people who make Ubuntu (that's canonical.com)

Yeah, we point that out on the front page of the site. We didn't think it was necessary to point it out on every single page. The page in question was last edited five years before Canonical Ltd. was formed.

I was fooled for a few reasons really, hacker news tells you the domain and before I clicked on it I assumed that this would have been written by someone at canonical. After seeing the structure of the url, I assumed at first that it was a personal homepage of someone working at canonical and that given the dates stated in the post, assumed that you had moved your pages from a previous employer. I also thought it was quite likely given the content and title that someone at canonical.com could have written it. It was only after looking around a bit that suspected that something wasn't right and hacked your url back to the domain. For me the first page I ever saw on your site was this one not the "front page".

I get the point that you had the domain first but unfortunately Canonical is now a large brand in the hacker space. I think at this point you risk misleading people unless you put a disclaimer on every page or change your domain :-(

For what it's worth, I have found a few since I wrote the article, and I still think the article is okay (although kind of outdated in some ways). I've fixed a few, too. Hopefully I've fixed more than I've created.

That's good to know, I would suggest for credibility, stating these instead of the sentence you have.

Wow, when I click this link I get

opera:fraud-warning:

The page you are trying to open has been reported as fraudulent. It will likely attempt to trick you into sharing personal or financial information. Opera Software strongly discourages visiting this page.

I don't know why, so I'm not continuing... I've only seen this message once before.

I think thats because of what rythie said: "Also canonical.org != the people who make Ubuntu (that's canonical.com)"

Wow, holy shit. Is there someone we can talk to at Opera about that? Would you be willing to get me a screenshot of the message and tell me what version of Opera you're running? I'd like to find out who reported that, and why. The page in question doesn't contain any scripts or interactive features of any kind. (I just looked at it on the server with less to make sure nobody had, say, injected some script tags since the last time I looked. Nope.)

it's the same as what happened as reported here, same image as well http://www.joycebabu.com/blog/google-being-reported-as-fraud...

:-) Somewhat related: Bruce Schneier's "Self-Study Course in Block Cipher Cryptanalysis," http://www.schneier.com/paper-self-study.html

This paper is pretty cryptic and (I think) unhelpful, for a couple reasons, not least the fact that protocol breaks kill far more systems than block cipher analysis. But it is still an interesting challenge.

Worth mentioning here is that there may be 5000 full-time vulnerability researchers worldwide, and fewer than .1% of them will ever even do protocol crypto. Not that that those 5 people aren't awesome.

Correct. At the same time, even trying to break a protocol is an interesting activity and improves the fertility of mind. That would help in the areas like identifying security holes in a system.

This is a fine way to get started looking for vulnerabilities, but a very bad yardstick for testing software by.

Reply on news.ycombinator.com