In my opinion this should be looked at as a learning experience for web developers. We need to take these issues/exploits into account when building websites. I'm pretty sure PG accounts for XSS attacking, no? If we trust each, shouldn't we trust each other enough not to post malicious code? Unfortunately it just doesn't work like that. Security by obscurity is never the answer!
This was a CSRF attack, which is mostly unrelated to XSS.
This is not how the community functions however. The community functions by being made up of a group of people who believe in courtesy. It is not vulnerable to any sort of software hack, instead it is vulnerable to the slow drift towards thoughtlessness.
Sharing the trick is entirely reasonable: small hacks like this are something to be proud of, given that you've acted in a reasonable way (e.g. contacted the site and informed them before telling others, not actually using it game the system, etc.)
Could have gone that way. Didn't.
Obviously that's not the definition we use here. If you haven't figured that out by now, perhaps this isn't the place for you.
He did say it wasn't cool - which is a fact.
What xach did wasn't cool, although perhaps inevitable on a public site.
So I don't worry too much about giving my user name out, or entering it into other HN members' apps. I did it, and I'm not worried about it really. It's not like run4yourlives is my bank id or anything.
What bothers me about the whole thing though is that I've now had it confirmed that HN is too big to trust anymore. Whereas before, there was a sense of kinship with people here - none of whom I've ever met - I now have to worry that some of them are just losers looking to exploit my trust.
That's worse than off topic posts and low quality comments really. It's an attack on the fabric of the community, and the value of the users. It's clear now that I must treat HN as I would treat reddit or digg or any other room full of potential idiots; people who would much rather exploit trust than build it.
Sad but inevitable I suppose.
Frankly, if anybody has violated our trust, it's whoever wrote this exploitable code. When I use a site, especially an open source one claimed to be written by good programmers, I expect it to be protected from well-understood exploits. And pg, as the caretaker of the code (and its likely author), needs to do some talking about how "not cool" running easily exploitable code is and take some responsibility.
2. This is pg's personal pet hobby. I don't think holding him responsible for every possible vulnerability is really all that practical, especially when the code is wide open. He's putting it out there with an element of trust that a hacker to be would actually provide a fix instead of being malicious. If xach was such a great positive influence, why didn't he provide a patch?
People seem to react to this like like the record companies reacted to Napster. "OH NO! IT'LL KILL US ALL! Screw changing our ancient business model, we'll just SUE 'EM!"
Instead of updating the way you think about HN (and other sites) you choose to put down the person who enlightened you and cast him out as some sort of heretic.
Hackers INVENT, hackers BREAK STUFF, and hackers BRING OUT THE UGLY! Why is Xach getting martyred for being a real hacker?
Besides, he's giving HN huge publicity. Jeff Atwood twittered about this thread.
Perhaps you should have an account longer than an hour before you lecture me about the effects of this issue on the community.
However, as pg already pointed out it was totally uncool not notifying him before making it public. I am in the support of full but responsible disclosure. So maybe he could have published it after informing pg and the issue was taken care of.
I found this whole event funny. I'm also amused that people reacted as negatively to this prank as middle managers at my old $MEGACORP job would.
Now that this information is public none of us
will give out our usernames to external websites,
thus ending the problem.
(1) Brute force (look at who's currently active on the site)
(2) Look at browser history (HN users have to constantly look at their own profile to check for replies, and the URL contains their user name)
(3) Send whatever request the browser sends to HN normally, and gets the user name embedded in the page.
Again, I don't know enough about browsers/JS/HTTP/HN to know if any of the above would work. I'm just saying I'm not sure that explicitly giving out your user name is required for this.
Edit: typos
Maybe so, but in the case of Twitter, not many people seemed to learn their lessons - and there people were giving away their usernames and passwords.
> decide between emailing someone hoping they fix the problem, or just fixing it
But you do not know if a vendor will fix the problem as soon as you report it to them, even if they already have a past history of not caring. the balance here is responsible disclosure: maybe it's a big enough issue or maybe the right person noticed that your problem will get fixed when you first let them know..in the event you feel you are ignored though, go public. best of both worlds.
> I found this whole event funny.
I don't think it's funny or angering. It's probably educational, as more people learn what CSRF is and it's probably a little annoying in that not as many people are discussing responsible disclosure, but there's not much to get angry about. Votes? big deal....
http://seclists.org/bugtraq/2002/Feb/0271.html
In many cases, the only person who will have visited all of...
http://news.ycombinator.com/threads?id=USERNAME
http://news.ycombinator.com/submitted?id=USERNAME
http://news.ycombinator.com/saved?id=USERNAME
http://news.ycombinator.com/user?id=USERNAME
...is USERNAME. So another exploit -- still sneaky but not quite fraudulent, and not especially unique to HN -- would be to design an offsite page that does one or both of (1) greets HN users by name upon their visit; (2) logs which of some chosen set of HN users has visited the page.
I would expect someone instead to pick the leaderboard, or some other extant set of names (eg: Google [site:news.ycombinator.com inurl:user]), and just iterate over those.
(Sad aside: try that query at Google or Yahoo, and review the top 100 results. An awful lot of the usernames ranking highest are drug names.)
Was that a net gain for you?
Edit: link http://www.reddit.com/r/programming/comments/854w0/faking_vo...
It's also nowhere near as bad as the state of the Twitter API and apps, which require a username and password. People don't think twice about providing unlimited access to their Twitter account to random websites. Hopefully the OAuth API will fix that.
@pg: I think one solution would be to reject any vote requests with a Referrer header other than news.ycombinator.com
If all it is is votes, I say the right solution is "let it go".
Something to think about for your own applications