November 13, 2006

Geek

Door Number Three!

I'm working with a variant of XSS-countermeasure 3 from my earlier post. I still sanitise comments (though there are some holes in the current implementation), but I won't bother with the posts or templates. Yes, the owner of a blog will be able to steal your cookie. I've just set things up so that the cookie isn't any good to him.

Which means (yay!) users can Ajax all they want* and (yay!!) I don't have an arms race with people trying to work around my sanitiser script. (Well, again, maybe in comments, but all that happens then is the comments get deleted by the bloggers.)

Which leaves just one component of the system that isn't a variation on something I've done before - trust metrics. Fortunately, while there doesn't seem to be a whole lot of stuff written about how to prevent XSS attacks (or at least, not much useful stuff**), I trip over interesting stuff on trust metrics everywhere.

* Minx is Ajax-agnostic. A page is a page; a request is a request. HTML vs. XML is just a difference in the template. And since the Minx user interface is built in Minx, this gives me a fair bit of flexibility.

** A lot of the advice consists of "Sanitise your pages really carefully. Bob didn't pay enough attention to his sanitiser script, and his company lost $50 million. Bob now washes windscreens for a living." The one worthwhile thing that I've seen come up is the first commandment of computer security: Default deny.

Posted by: Pixy Misa at 07:06 PM | Comments (498) | Add Comment | Trackbacks (Suck)

1 Packets on the floor are like dead player characters.

They can take no actions.


Posted by: Kristopher at November 14, 2006 03:03 AM (giy+l)

2 cheap@levitra.com

Posted by: generic levitra at July 14, 2007 03:40 AM (NWGK9)

3 cheap@viagra.com

Posted by: buy viagra at July 14, 2007 09:12 AM (Qwzdd)

4 cheap@cialis.com

Posted by: cheap cialis at July 15, 2007 07:47 PM (lTV96)

5 cheap@giag.com

Posted by: generic viagra at July 28, 2007 09:51 AM (p1khW)

6 sale@mp3.com

Posted by: Eagles at September 22, 2007 09:21 AM (Su5G8)

7 Try start with our site map.

Posted by: Hope C. Cortez at October 30, 2007 01:19 AM (YuVUr)

8 fo033.txt;2;5

Posted by: IfZizlRU at April 18, 2008 07:12 PM (yEjYx)

9 wholeale replica handbags from Replica Handbags Plaza
We provide high quality replica balenciaga,
replica gucci,
replica LV
replica jimmy choo
replica chloe
replica bottega veneta
replica burberry
replica chloe
replica christian dior
replica fendi
replica jimmy choo
replica miu miu
replica louis vuitton

Posted by: wholesale replica handbags at March 13, 2011 04:18 PM (gE6mh)

10 Great tip, i will try do it.

Posted by: mac cosmetics at April 21, 2011 01:28 PM (QD4o9)

11 The Adidas Titan Bounce White/Black<a href="http://www.adidasporschesdesign.com"><strong>Adidas Bounce</strong></a> Silver Metallic/Satellite G12244 provides all you need in a running shoe: comfort, versatility and lightweight.Inspiration of F50 is used in running shoes design and Hypermotion is developed. This is the lightest and fastest cushion design. Eva insole molded according to body structure is very comfortable to your feet. The new Bounce bottom tray guarantees its light weight. The reflective metallic three-tripe is more fashionable.

A force to be reckoned with, the adidas Titan running shoe employs BOUNCE(tm) for ultimate energy return, HyperMOTION for a faster and more efficient ride, and an adiWEAR(reg) outsole for high-wear durability, making this a high-tech, lightweight running<a href="http://www.adidasporschesdesign.com"><strong>Adidas Porsche Design</strong></a>.

Bounce back from a long day with the lively ride you'll come to expect from the adidas Titan. ; Air mesh upper supplies maximum ventilation for a truly breathable environment. ; Plush collar for added comfort. ; Non-slip lining for great slip in comfort and performance. ; Contoured EVA sockliner provides an anatomical fit and an exceptional feel. ; BOUNCE midsole delivers enhanced energy return with every stride. ; HyperMOTION technology with leaf springs in the heel helps to absorb the shock of impact and convert that energy for a more dynamic ride. ; adiWEAR outsole offers long-lasting wear. ; 14.00 oz. ; Product measurements were taken using size 11. Please note that measurements may vary by size

Posted by: Hermes Birkin Bags at June 27, 2011 07:50 PM (9tAYm)

Hide Comments | Add Comment






Processing 0.0, elapsed 0.0185 seconds.
16 queries taking 0.0139 seconds, 33 records returned.
Page size 13 kb.
Powered by Minx 0.8 beta.