Comments on: Thank you and good night Planet PHP http://www.thespanner.co.uk/2007/09/05/thank-you-and-good-night-planet-php/ A tool for designers dealing with programmers dealing with designers... Tue, 14 Oct 2008 01:45:33 +0000 http://wordpress.org/?v=2.6.2 By: Tom Macklin http://www.thespanner.co.uk/2007/09/05/thank-you-and-good-night-planet-php/#comment-554 Tom Macklin Fri, 07 Sep 2007 12:39:12 +0000 http://www.thespanner.co.uk/2007/09/05/thank-you-and-good-night-planet-php/#comment-554 Dave- Of course I wouldn't have spotted the problems with that vulnerability without careful investigation, if ever! In security, people often have their own technique for finding particular types of problems. Also, just because I strive to write correct software doesn't mean I do it. However, we do have a responsibility to ensure our software does what we claim it does, and most software products claim to be secure. BTW- I don't intend to get involved in a flame war that clogs up this blog... good luck doing your thing. Dave-

Of course I wouldn’t have spotted the problems with that vulnerability without careful investigation, if ever! In security, people often have their own technique for finding particular types of problems. Also, just because I strive to write correct software doesn’t mean I do it. However, we do have a responsibility to ensure our software does what we claim it does, and most software products claim to be secure.

BTW- I don’t intend to get involved in a flame war that clogs up this blog… good luck doing your thing.

]]> By: Gareth Heyes http://www.thespanner.co.uk/2007/09/05/thank-you-and-good-night-planet-php/#comment-553 Gareth Heyes Fri, 07 Sep 2007 12:31:43 +0000 http://www.thespanner.co.uk/2007/09/05/thank-you-and-good-night-planet-php/#comment-553 Thanks Tom much appreciated, I always blog about the stuff I'm passionate about and that's why I find it easy to do, you're right it's not for everyone but I'm not trying to appeal to everyone, I just want to share knowledge and talk to clever people. In the last few months I've talked to some outstanding programmers and starting blogging was probably one of the best decisions I've made. Thanks Tom much appreciated, I always blog about the stuff I’m passionate about and that’s why I find it easy to do, you’re right it’s not for everyone but I’m not trying to appeal to everyone, I just want to share knowledge and talk to clever people.

In the last few months I’ve talked to some outstanding programmers and starting blogging was probably one of the best decisions I’ve made.

]]> By: Tom Macklin http://www.thespanner.co.uk/2007/09/05/thank-you-and-good-night-planet-php/#comment-552 Tom Macklin Fri, 07 Sep 2007 12:19:46 +0000 http://www.thespanner.co.uk/2007/09/05/thank-you-and-good-night-planet-php/#comment-552 Gareth- I never have gotten around to saying "thanks" for such an *informative* blog. Most blogs seem to focus on sound bytes-- I think this one focuses on, well, focused substance. Not for everyone, but great for those it is for. Gareth- I never have gotten around to saying “thanks” for such an *informative* blog. Most blogs seem to focus on sound bytes– I think this one focuses on, well, focused substance. Not for everyone, but great for those it is for.

]]> By: Gareth Heyes http://www.thespanner.co.uk/2007/09/05/thank-you-and-good-night-planet-php/#comment-551 Gareth Heyes Fri, 07 Sep 2007 10:55:38 +0000 http://www.thespanner.co.uk/2007/09/05/thank-you-and-good-night-planet-php/#comment-551 Richard thanks a lot, it helps a great deal if I know people are learning or enjoy my posts. Richard thanks a lot, it helps a great deal if I know people are learning or enjoy my posts.

]]> By: Richard Fletcher http://www.thespanner.co.uk/2007/09/05/thank-you-and-good-night-planet-php/#comment-550 Richard Fletcher Fri, 07 Sep 2007 10:51:23 +0000 http://www.thespanner.co.uk/2007/09/05/thank-you-and-good-night-planet-php/#comment-550 Hi Gareth, I've been educated and entertained by your posts, and will be subscribing to your own feed. Thanks for sharing your work. Regards Richard Hi Gareth,

I’ve been educated and entertained by your posts, and will be subscribing to your own feed.

Thanks for sharing your work.

Regards
Richard

]]> By: Gareth Heyes http://www.thespanner.co.uk/2007/09/05/thank-you-and-good-night-planet-php/#comment-541 Gareth Heyes Thu, 06 Sep 2007 21:04:21 +0000 http://www.thespanner.co.uk/2007/09/05/thank-you-and-good-night-planet-php/#comment-541 Well every browser should deny access to write access things like the document object. Firefox's behavior in this matter is the best. But this specific vulnerability is the way Safari handles local files, it seems that if a file is run locally or fooled into thinking it is local then the cross domain policy seems to go out the window. Hence why I could access data from other domains. I would recommend everyone uses an alternate browser until Apple release a fix for the beta as this vulnerability is extremely dangerous, it would be possible to hide the iframe and perform any action on any web site and retrieve data as that person. Normally I would have reported this to the manufacturer before releasing it to the public but Apple's attitude deserved otherwise. Well every browser should deny access to write access things like the document object. Firefox’s behavior in this matter is the best.

But this specific vulnerability is the way Safari handles local files, it seems that if a file is run locally or fooled into thinking it is local then the cross domain policy seems to go out the window. Hence why I could access data from other domains.

I would recommend everyone uses an alternate browser until Apple release a fix for the beta as this vulnerability is extremely dangerous, it would be possible to hide the iframe and perform any action on any web site and retrieve data as that person.

Normally I would have reported this to the manufacturer before releasing it to the public but Apple’s attitude deserved otherwise.

]]> By: David Rodger http://www.thespanner.co.uk/2007/09/05/thank-you-and-good-night-planet-php/#comment-540 David Rodger Thu, 06 Sep 2007 20:45:38 +0000 http://www.thespanner.co.uk/2007/09/05/thank-you-and-good-night-planet-php/#comment-540 Maybe it's just Safari, Tom, but I don't see a mechanism for indicating that your reply is to a specific post (unlike, say, Serendipity on Stefan Esser's site). >If you want it to work, then write correct code. Tom, do you write code for the web, where this vulnerability and its consequences would become evident? If you're not a "web type", I'm impressed that would have spotted it in a nano-second (as opposed to the long, hard slog Gareth put in to find it). Incidentally, what is it of yours that is bad? Gareth, could you tell us whether you think what the Safari beta does is what it (or any browser, for that matter) ought to do? Maybe it’s just Safari, Tom, but I don’t see a mechanism for indicating that your reply is to a specific post (unlike, say, Serendipity on Stefan Esser’s site).

>If you want it to work, then write correct code.

Tom, do you write code for the web, where this vulnerability and its consequences would become evident? If you’re not a “web type”, I’m impressed that would have spotted it in a nano-second (as opposed to the long, hard slog Gareth put in to find it). Incidentally, what is it of yours that is bad?

Gareth, could you tell us whether you think what the Safari beta does is what it (or any browser, for that matter) ought to do?

]]> By: Tom Macklin http://www.thespanner.co.uk/2007/09/05/thank-you-and-good-night-planet-php/#comment-539 Tom Macklin Thu, 06 Sep 2007 17:21:39 +0000 http://www.thespanner.co.uk/2007/09/05/thank-you-and-good-night-planet-php/#comment-539 That last comment was supposed to be a reply just to David Roger comment (#18), but it showed up as a comment on the whole article... my bad. That last comment was supposed to be a reply just to David Roger comment (#18), but it showed up as a comment on the whole article… my bad.

]]> By: Tom Macklin http://www.thespanner.co.uk/2007/09/05/thank-you-and-good-night-planet-php/#comment-538 Tom Macklin Thu, 06 Sep 2007 17:20:29 +0000 http://www.thespanner.co.uk/2007/09/05/thank-you-and-good-night-planet-php/#comment-538 The reason I hate coding w/ web-types most of the time is this attitude "of I just want it to work." If you want it to work, then write correct code. The trouble is, you don't "just want it to work"-- you want to get a lot of result w/o much effort or thought. I'd check out a different career field. The reason I hate coding w/ web-types most of the time is this attitude “of I just want it to work.” If you want it to work, then write correct code. The trouble is, you don’t “just want it to work”– you want to get a lot of result w/o much effort or thought.

I’d check out a different career field.

]]> By: Gareth Heyes http://www.thespanner.co.uk/2007/09/05/thank-you-and-good-night-planet-php/#comment-531 Gareth Heyes Thu, 06 Sep 2007 11:56:28 +0000 http://www.thespanner.co.uk/2007/09/05/thank-you-and-good-night-planet-php/#comment-531 I haven't tagged my latest post about window.name vulnerability with PHP, so it won't appear on PHP Planet. Even though that knowledge is needed by PHP developers because the very example is used for a PHPIDS system. They are trying to filter out javascript injection. But hey it's not PHP related eh? See how silly some people are. I haven’t tagged my latest post about window.name vulnerability with PHP, so it won’t appear on PHP Planet. Even though that knowledge is needed by PHP developers because the very example is used for a PHPIDS system. They are trying to filter out javascript injection.

But hey it’s not PHP related eh? See how silly some people are.

]]>