undefined | Better HN

0 pointsjrochkind16y ago0 comments

I suppose more awful thing could be an accidental XSS or other vulnerability.

0 comments

Which would then compromise what? People's youtube accounts?

IE6 had plenty of nasty vulns by the time this banner had gone up (06/14/2009): https://www.cvedetails.com/vulnerability-list/vendor_id-26/p...

That said, the people with this access probably knew WTF they were doing.

darawk6y ago

Exactly. They were getting rid of IE6

chris_wot6y ago

As opposed to the denial of service style bugs like an empty src element in an img tag?

ljm6y ago

They're perfectly capable of introducing other DOS bugs that don't depend on bad markup.

dgoldstein06y ago

This is a poor argument - just because we can shoot our own feet, doesn't mean we should not try to prevent it from happening by accident.

And it sounds like it wasn't just DOS - also just plain "it doesn't work in ie6" seems the most likely outcome; crashes and DOS that the article describes just sounds like the most egregious cases.

j / k navigate · click thread line to collapse

0 comments

darawk6y ago

Which would then compromise what? People's youtube accounts?

0xDEFC0DE6y ago

IE6 had plenty of nasty vulns by the time this banner had gone up (06/14/2009): https://www.cvedetails.com/vulnerability-list/vendor_id-26/p...

That said, the people with this access probably knew WTF they were doing.

darawk6y ago

Exactly. They were getting rid of IE6

chris_wot6y ago

As opposed to the denial of service style bugs like an empty src element in an img tag?

ljm6y ago

They're perfectly capable of introducing other DOS bugs that don't depend on bad markup.

dgoldstein06y ago

This is a poor argument - just because we can shoot our own feet, doesn't mean we should not try to prevent it from happening by accident.

And it sounds like it wasn't just DOS - also just plain "it doesn't work in ie6" seems the most likely outcome; crashes and DOS that the article describes just sounds like the most egregious cases.

j / k navigate · click thread line to collapse