●Stories
●Firehose
●All
●Popular
●Polls
●Software
●Thought Leadership
Submit
●
Login
●or
●
Sign up
●Topics:
●Devices
●Build
●Entertainment
●Technology
●Open Source
●Science
●YRO
●Follow us:
●RSS
●Facebook
●LinkedIn
●Twitter
●
Youtube
●
Mastodon
●Bluesky
Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!
Forgot your password?
Close
wnewsdaystalestupid
sightfulinterestingmaybe
cflamebaittrollredundantoverrated
vefunnyunderrated
podupeerror
×
13961610
story
Posted
by
Soulskill
ly 04, 2010 @11:35AM
from the enjoy-the-holiday-google dept.
Virak writes "Several hours ago, someone found an HTML injection vulnerability in YouTube's comment system, and since then sites such as 4chan have had a field day with popular videos. The bug is triggered by placing a <script> tag at the beginning of a post. The tag itself is escaped, but everything following it is cheerfully placed in the page as is. Blacked out pages with giant red text scrolling across them, shock site redirects, and all sorts of other fun things have been spotted. YouTube has currently blocked such comments from being posted and set the comments section to be hidden by default, and appears to be in the process of removing some of these comments, but the underlying bug does not seem to have been fixed yet."
You may like to read:
Wireless Presenters Attacked Using an Arduino
Local Newspapers Use F/OSS For a Day
This discussion has been archived.
No new comments can be posted.
Load All Comments
Full
Abbreviated
Hidden
/Sea
Score:
5
4
3
2
1
0
-1
More
Login
Forgot your password?
Close
Close
Log In/Create an Account
●
All
●
Insightful
●
Informative
●
Interesting
●
Funny
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
byae1294 ( 1547521 ) writes:
All of your tubes are belonging to US now.
twitter
facebook
byKevMar ( 471257 ) writes:
Somebody set up us the script bomb
Parent
twitter
facebook
byStalks ( 802193 ) * writes:
Don't you mean...
"Somebody script up us the bomb"
byAnonymous Coward writes:
Really? They're really only removing some of them? When they can just do a simple delete query and wipe everythin with a properly escaped script tag at the top of the comment? Wow. Just wow.
The solution to this is for users to be asked if they want to participate in commented sections when signing up. Not just at youtube, but everywhere. And probably not just comments, but any user input area.
byae1294 ( 1547521 ) writes:
Really? They're really only removing some of them? When they can just do a simple delete query and wipe everythin with a properly escaped script tag at the top of the comment? Wow. Just wow.
Shhh.... one word... overtime pay.
Parent
twitter
facebook
bydaremonai ( 859175 ) writes:
That was actually two words ... Oh no, now we owe you overtime. Sneaky.
Parent
twitter
facebook
byXnavxeMiyyep ( 782119 ) writes:
Well, look at the bright side!
YouTube has currently .... set the comments section to be hidden by default
This is the greatest possible improvement to YouTube short of removing the comments section entirely.
Parent
twitter
facebook
byAnonymous Coward writes:
I went to youtube, but all I saw was crap material. Someone had injected a bunch of crap!
twitter
facebook
byAnonymous Coward writes:
The evolution of this bug exploit was quite interesting to follow up close.
At first it simply prevented any further comments to be posted.
Then text was added.
Then the text was scrolling.
Suddenly, the entire page was blacked out except for the added text.
And that's when the more technical minded people realized much much more was possible.
Bam! Popups!
Infinite popups that lead to browser crashes!
Page redirects to shock sites!
The most sophisticated version I saw actually replaced the Youtube video in-place with the 1man1jar video..
And when the exploit was blocked in the comments, it had a small resurgence as video reply title, before being smacked down once more.
Glorious.
twitter
facebook
bylarry bagina ( 561269 ) writes:
Reminds me of the slashdot <a onhover=".."> bug. It was a while back (2000-2002 era?) but inline javascript wasn't filtered from atags. The first exploit (that I saw, anyhow) simply used DHTML (as it was then known) to add (paraphrasing) "I can't believe this hasn't been fixed" to the post. (which took about 5 minutes given the speed of computers, javascript, and dom manipulation). About 30 seconds later, redirects to porn, last measure, etc appeared. Slashdot's initial response was to mod them down to -5 and then deleting them.
Parent
twitter
facebook
byhattig ( 47930 ) writes:
Hmm, I remember that, I remember embedded Freshmeat as an embedded iframe thing into a Slashdot post at the time...
I don't think I could do that off the top of my head anymore. But my cooking skills have improved!
bywmbetts ( 1306001 ) writes:
I'm really surprised it used for trolling rather than making money. That seems like a phishers wet dream.
Parent
twitter
facebook
bynurb432 ( 527695 ) writes:
Trolling is just a distraction from the real meat.
byAnonymous Coward writes:
I saw someone on /g/ claim to have pulled 300k+ youtube user cookies doing this. The bad thing is your YT account is usually tied to gmail now. Scary... glad I had noscript on.
Parent
twitter
facebook
byCyberllama ( 113628 ) writes:
Youtube is on Noscript's whitelist by default.
byVirak ( 897071 ) writes:
They actually got it fixed a bit after I submitted this story. A shame, lemonparty was a big step up from the usual level of discussion on YouTube videos. More seriously, I'm interested in finding out exactly what happened here. Hopefully Google will post some sort of explanation. YouTube is a massive site and it's somewhat bizarre seeing them make the sort of mistake you'd expect from something put together by a drooling moron with nothing but a "How to learn PHP in 24 hours!" book.
twitter
facebook
byAnonymous Coward writes:
a "How to learn PHP in 24 hours!" book
Does that mean:
1. It teaches you, over the course of an unspecified period of time, how to learn PHP in 24 hours?
2. It teaches you, over the course of 24 hours, how to learn PHP? or
3. After 24 hours have elapsed, it teaches you how to learn PHP?
Note that it doesn't actually teach you PHP. It just teaches you how to learn it.
Parent
twitter
facebook
byJamesP ( 688957 ) writes:
Actually, it teaches you PHP if you're on the cast of '24 hours'
bymaxwell demon ( 590494 ) writes:
No, it tells you how you learn the lesser-known language named "PHP in 24 hours" which differs from normal PHP in that the scripts always take 24 hours to run.
byosu-neko ( 2604 ) writes:
No, it tells you how you learn the lesser-known language named "PHP in 24 hours" which differs from normal PHP in that the scripts always take 24 hours to run.
An optimized version, then? ;)
Parent
twitter
facebook
byweicco ( 645927 ) writes:
I can't wait 24 hours! Got to get 12 hour book...
bytom17 ( 659054 ) writes:
They are a bit late, its all x.org now.
byroman_mir ( 125474 ) writes:
It does no such thing, that book talks about a guy I know, who is about to learn PHP. The guy's name is How, yes all my friends are like that.
byCODiNE ( 27417 ) writes:
I've seen the book, option 3 is the correct answer.
It's 1,440 pages of "Wait one minute, then turn the page" which sadly forces one into an inescapable loop for 24 hours. After one has starved, missed sleep and soiled oneself through this excruciating 24 hour period the last page says only this:
Buy the book titled 'This book teaches you PHP'.
I was thoroughly disappointed.
bytomhudson ( 43916 ) writes:
I'm in Canada - we're on METRIC time, you insensitive clod! 100 seconds per minute, 100 minutes per hour, 10 hours per day!
byKreigaffe ( 765218 ) writes:
The first time I hear anyone ever fucking utter the word "Kibisecond" I'm just going to shoot them in the face. There's no other choice.
Parent
twitter
facebook
bympeskett ( 1221084 ) writes:
If I ever need to refer to 1024 seconds, I'll be sure to do so when you're not around.
bymjwx ( 966435 ) writes:
If I ever need to refer to 1024 seconds, I'll be sure to do so when you're not around.
Dont worry, he'll be back in a kibisecond.
byL4t3r4lu5 ( 1216702 ) writes:
Self-fulfilling prophecy?
It's been nice knowing you.
byAnonymous Coward writes:
How many Lojbanists does it take to change a broken light bulb? ...
Two: one to figure out what to change it into, and one to figure out what kind of bulb emits broken light.
byGopal.V ( 532678 ) writes:
If I had to guess, I think it's a variant of an attack [notmysock.org] I've seen before.
byPeach Rings ( 1782482 ) writes:
Ah the intricacies of the Firefox codebase.
bymikael_j ( 106439 ) writes:
Yes, this does seem like the kind of bug I'd expect halfway competent dev to take into consideration when building a site. A very simple fix is to translate all < and > characters to the & lt; and & gt; versions instead, AFAIK youtube doesn't even allow HTML in comments anyway...
byMalHavoc ( 590724 ) writes:
I'd also be interested in knowing if this bug had been an issue for a long time. It seems like the sort of exploit that would have been very quickly discovered. I'm not a big YouTube comment reader, but I've noticed some interface/UI tweaks to the way comments can be thumbed up/down in recent weeks. Perhaps this crept in as a result of those.
bythetoadwarrior ( 1268702 ) writes:
We only just had a big debate over whether going to university makes you a better coder or not in the Zoho topic. http://news.slashdot.org/story/10/07/01/208222/Zoho-Dont-Need-No-Stinking-PhD-Programmers [slashdot.org]
In there Google and their army of PhDs was mentioned as proof that a degree really matters.
It appears even with a PhD you're still susceptible to making school boy errors. Zoho can make these sorts of errors for much less by hiring kids straight out of high school. :P
byJane Q. Public ( 1010737 ) writes:
The fact that educated people make mistakes is not equivalent to whether uneducated people can make educated programming decisions.
Outside of school, do you really think someone will pick up on the math and other concepts necessary to, for just one example, calculate the Big-O of a part of their program? Or understand why they should?
byMillionthMonkey ( 240664 ) writes:
Outside of school, do you really think someone will pick up on the math and other concepts necessary to, for just one example, calculate the Big-O of a part of their program?
Sure, why not? I found it to be O(1).
byInf0phreak ( 627499 ) writes:
wait for it... wait for it... And nothing of value was lost!
twitter
facebook
byxororand ( 860319 ) writes:
Get the YouTube Comment Snob [mozilla.org] addon for Firefox.
YouTube Comment Snob filters out undesirable comments from YouTube comment threads. You can choose to have any of the following rules mark a comment for removal:
* More than # spelling mistakes: The number of mistakes is customizable, and the extension uses Firefox's built-in spell checker.
* All capital letters
* No capital letters
* Doesn't start with a capital letter
* Excessive punctuation (!!!! ????)
* Excessive capitalization
* Profanity
Parent
twitter
facebook
byRallion ( 711805 ) writes:
*Reads list of filtering options*
So does it just hide the whole comment section, or show it as being empty?
Parent
twitter
facebook
byxororand ( 860319 ) writes:
I haven't actually tried Comment Snob addon in some time and it seems that it hasn't been updated to work with the latest changes on YouTube. Maybe someone with a little free time has the passion to fix it.
bychristopherfinke ( 608750 ) writes:
I'm the author, and I uploaded a new version that works with the latest YouTube design a few days ago. It's just pending approval by Mozilla.
Parent
twitter
facebook
byDoctor_Jest ( 688315 ) writes:
Thanks for the update! I was scratching my head until I realized there was a "redesign" on the part of Youtube. :)
byObsessiveMathsFreak ( 773371 ) writes:
You mean, people actually read Youtube comments enough to warrant this addon?
bychristopherfinke ( 608750 ) writes:
You can turn this option off, or you can specify the language of the dictionary you want to use for spell-checking.
byYvanhoe ( 564877 ) writes:
The day youtube implements a slashcode moderation system, internet will awake to global consciousness...
byKreigaffe ( 765218 ) writes:
at least most of the youtube comments are most likely made after the video has been viewed. they sorta have a leg up on slashdot there.
ps: no i didn't read the article
byhankwang ( 413283 ) * writes:
Obligatory: http://xkcd.com/202/ [xkcd.com]
byhttp ( 589131 ) writes:
http://www.xkcd.org/481/ [xkcd.org]
byDremth ( 1440207 ) writes:
Wow. You'd think somebody would've figured out something like this a long time ago.
byScrameustache ( 459504 ) writes:
Wow. You'd think somebody would've figured out something like this a long time ago.
But since merely gazing at youTube comments lowers your IQ by at least 20 points, I'm actually amazed someone found it. Must have used some of kind of proxy who looked at it, got dumber for it, but managed to pass along the code to someone who could look at it without being exposed to the dumb.
Parent
twitter
facebook
byAnonymous Coward writes:
Lots of people anonymously "injecting" a bunch of crap into a website for all others to see.
This exploit is just an alternative to the original "Upload Video" button.
twitter
facebook
byAnonymous Coward writes:
A lot of the comments are just troll BS. Most people log on for videos not to read the ramblings of basement dwelling trolls. I try to ignore them but they can be really obnoxious. I don't post on Youtube but I have had things pirated and posted just so they could make obnoxious comments. The work posted was just previs stuff that was just done for editing slugs but it was presented as finished work. It caused some trouble with a client so I got a lot more careful about letting development work out there. I
bygrumbel ( 592662 ) writes:
A lot of the comments are just troll BS.
Yes, but I blame the comment system for that. A comment system that doesn't allow links, doesn't allow more then a handful of characters, is a complete usability nightmare when you want to browse more then the last ten comments, doesn't allow search and doesn't support threads or replies properly is just useless when you actually want to write something insightful. A comment system should encourage informative posts, not make them impossible like the Youtube system does.
The latest changes that the highest rated comments and comments from the video upload appear on top have helped a bit to cleanup the mess, but its still far away from being a comment system where people actually can have a meaningful discussion.
Parent
twitter
facebook
byThantik ( 1207112 ) writes:
On top of that they need to implement some sort of penalty system for people who regularly post things that are downvoted. If out of 10 posts, the amount of downvotes you've gotten is higher than 80% then implement a week long "cool-off" period in which it resets to 0
byLije Baley ( 88936 ) writes:
Yes, if only they had a more sophisticated comment system, then the level of discourse would be closer to that of Slashdot or /b/.
byDr Herbert West ( 1357769 ) writes:
Really? You put client-facing work on YouTube?
Ouch.
If you don't want to spare the bandwidth on your own site (how much data are you pushing, anyway?) then try Vimeo. Cleaner, better optimization, has private (need a password) channels, offers a "pro" service where you get unlimited uploads, etc.
It's mainly used by video artists, tech demos, etc.
byREggert ( 823158 ) writes:
I wonder how many times this vulnerability was used to deliver malware.
byDRJR ( 1842278 ) writes:
I find it interesting pondering the how and why these things fail-- the insight into how the code must have been put together to fail on a particular input.
My initial guess for this one would be that they escape html and scripts separately-- scripts do not need greater than, less than, and ampersand escaped-- and that detecting the keyword 'script' switched modes from html to script. The fact that the first script tag is properly html-escaped suggests that while it was properly detected, the code to switch between html and script modes did not take this detection into account and switched anyway. I'm going to further guess that this do to some support code meant for the programmers' side inadvertently managed to cross over into user land.
My two cents.
--Dave Romig, Jr.
twitter
facebook
bymwvdlee ( 775178 ) writes:
Why would they have a distinction between a HTML and a script mode on comments? Is there any reason you'd ever want a comment to contain a script?
bylinguizic ( 806996 ) writes:
Exactly, why not just escape the whole thing? Or if you're even more paranoid, why not just strip the script tags and everything in between? That being said, the fact that this exploit exists in the first place shows that they're not doing either one of those things.
byDrYak ( 748999 ) writes:
Nice, long and contrived explanation.
Much more likely they forgot to set the correct parameter to have ALL the occurrence replaced instead of the left-most longest occurrence.
(for example, they forgot to put a "g" after the RegExp)
bymwvdlee ( 775178 ) writes:
If they didn't redirect ALL videos to a Rick Astley video, they have missed the opportunity of a lifetime.
twitter
facebook
byDachannien ( 617929 ) writes:
I wanted to watch a Rick Astley video, but it redirected me to another Rick Astley video.
bydswensen ( 252552 ) writes:
Comments turned off by default? Great! Any chance they can make that permanent?
twitter
facebook
byMax Romantschuk ( 132276 ) writes:
The comments never bothered me. I simply don't read them.
bymoonbender ( 547943 ) writes:
I'm sure there's a Greasemonkey script that removes the comments. Hell, a user CSS hack would probably do it.
byMax Romantschuk ( 132276 ) writes:
This sounds good in theory. In practice, people who read a lot generally cannot help but successfully read entire sentences in their peripheral vision. Nothing short of removing the text from my visual field will prevent the meaning of the words from becoming instantly lodged in my brain the moment they appear anywhere visible.
You're an accomplished speed reader.
I read _a lot_ myself, but never learned the skill to read anything other than what I focus on for the most part. Simply reading a lot doesn't automatically grant you the skill to be able to read like you do. You likely have a genetic advantage... Or perhaps disadvantage, in this particular case. ;)
byWingnut64 ( 446382 ) writes:
Any chance they can make that permanent?
Use Addblock Plus and add the following element hiding rules:
##div#watch-discussion
##div.watch-comment-entry
Parent
twitter
facebook
bycorychristison ( 951993 ) writes:
Use Addblock Plus
I was not aware there was a version of Adblock Plus for those of us with A.D.D. [wikipedia.org]!
Spaghetti cat!
bytwidarkling ( 1537077 ) writes:
Since this was turned in to a massive, YouTube-wide trolling effort, it's being fixed nearly immediately. What if 4chan hadn't gotten a hold of it though? What if some scammers/spammers did? And used it for weeks? It would have been more subtle, and with YouTube's traffic, it could have been massively successful. Who knows what effect that could have had if this wasn't caught quickly. Did 4chan just do a good thing?
twitter
facebook
byphoenix321 ( 734987 ) * writes:
"What if 4chan hadn't gotten a hold of it though? What if some scammers/spammers did?"
What tells you they didn't?
bymxs ( 42717 ) writes:
You assume, of course, that this bug is recent, 4chan was the first to discover it, and that there hasn't been any subtile, massively successful abuse for weeks.
bytwidarkling ( 1537077 ) writes:
Fine, assume it was. If this hadn't happened, how much *longer* would it have gone on. My main point still stands, trolling expedited the bug fix.
bydkf ( 304284 ) writes:
But until Google says otherwise, we can't know that this wasn't already the case.
Fortunately, they already have all the data with potential exploits and are reasonably well known for their ability to search for things. Depending on how things are stored, it even might be as simple as doing a first-cut by looking for an unescaped < character.
byKaenneth ( 82978 ) writes:
How much of this kind of problem is caused by the standard behavior of browsers to make a 'best guess' at interpreting 'bad' HTML, since the parsing rules are very lax compared to XML?
Should unmatched tags cause the browser to stop and say 'Parsing Error, Invalid HTML'? (or whatever user-friendly message the browser author writes)
'cause I could totally imagine someone, somewhere writing a browser that sees '<'s and auto-re-encodes them, then does it's tag parsing.
Back around 1998 I worked for a compan
byPatPending ( 953482 ) writes:
The first bug I found was that a new user could insert script tags in their username (any field, really), my employers response was "Why would anyone want to hack a website?"... I wouldn't drop the issue, so they dropped me.
Did you then DROP their tables?
byRobotron23 ( 832528 ) writes:
Get inspired from places with mature attitudes on drug abuse; those with safe injecting sites.
Youtube feels like a drug to me at times...I'd elaborate on this viewpoint but a vid of a cat and a dog chasing their own tails at the same time interests me more.
bytuomoks ( 246421 ) writes:
It's only bad design / coding / development - who cares! It happens all the time and will happen as long as the subpar designs / development / coding is allowed. Mostly I would blame the design of these systems - it's very difficult to (safely) implement anything which is already broken, as most of the systems today! Or - if you don't agree, list the systems that haven't been broken one time or other? Or - which will not be broken in future?
Seriously - after fighting long enough years for safe and secure de
bySmallFurryCreature ( 593017 ) writes:
What I learned from this story:
That goatse.cx is very old news and that there are whole new horrors I never even heard of.
Someone must be looking out for me.
You know you are living a blessed life when you got no idea what 1man1jar or lemon party is. Reminds me of being a little kid and having no idea what the adults were talking about. Only this time I know the value of ignorance.
Let me see. 1 man 1 jar, must be about a man collecting pennies to buy a gift for his mother.
Lemon party? Sweet lemonade for a hot summer day? Sounds fun.
2girls1cup? Two girls riding the magic cup at disney?
Please, don't correct me. Ignorance is bliss.
twitter
facebook
bybsDaemon ( 87307 ) writes:
Based on the typical YouTube comment (or video, for that matter), I already hard sort of expected that to be the case.
Parent
twitter
facebook
byjack2000 ( 1178961 ) writes:
It is so bad i had to re-purpose a greasemonkey script that changes the style of youtube to hide the comments section.
What were they thinking taking out the option to hide the damn comments.
bybsDaemon ( 87307 ) writes:
i don't know... what were they thinking allowing comments in the first place?
bySpeedyDX ( 1014595 ) writes:
YouTube is supposed to be a kid-friendly place. Parents could do their best to try to responsibly monitor and guide their kids' surfing habits, but still fail because of this exploit. This is not funny, nor awesome. This is not someone finding a potential exploit and graciously letting Google know so they can patch it up. Just a bunch of 4channers screwing around, and to hell with the consequences. And people like you encouraging that type of behaviour.
Just because this is The Internet(TM), it doesn't mean that common courtesy need not apply.
Parent
twitter
facebook
byJohnFen ( 1641097 ) writes:
YouTube is supposed to be a kid-friendly place.
Good lord, that's the funniest thing I've read in a while. Thank you.
You tube itself (the videos) are generally fine, but the comment section is one of the more famous and major of the internet cesspools. I would never characterize it as "kid-friendly".
bynegRo_slim ( 636783 ) writes:
YouTube is supposed to be a kid-friendly place.
Good lord, that's the funniest thing I've read in a while. Thank you.
Yup soon the Texas Donk Squad [youtube.com] will over take Sesame Street in children's programming.
byAnonymous Coward writes:
From what I've seen, there were not only simple insults and racist annoyances, but numerous redirects to the hardest shock site you've probably ever seen. That video makes 2girls1cup, benzin.avi and even the hardest war-porn look like family-friendly softcore entertainment in comparison. It has something to do with 1 man and 1 jar and I dare you to Google that if you have doubt this is emotionally scarring material.
bymickwd ( 196449 ) writes:
Well, given that such a low ID would have been given out a number of years ago now........
People do get older, you know.
bytwidarkling ( 1537077 ) writes:
Physical age doesn't necessarily correspond to mental age. Personally, I've been getting more immature as years pass.
Parent
twitter
facebook
byJohnno74 ( 252399 ) writes:
Physical age doesn't necessarily correspond to mental age. Personally, I've been getting more immature as years pass.
"I have abandoned the quest for eternal youth and instead setttled for lifelong immaturity"
Parent
twitter
facebook
byCylix ( 55374 ) * writes:
Well, given that such a low ID would have been given out a number of years ago now........
People do get older, you know.
No they don't. PooFace!
byKrahar ( 1655029 ) writes:
This isn't a simple mistake, it's a sign of pure incompetence since the developer put no forethought into the uses of the tool he was developing and blindly trusted user input from a textarea. User input is dirty, dirty dirty and any developer who does not clean and sanitize it before consuming it is not doing his/her job.
The summary states that the first script tag was escaped as it should be. It was a bug, not a lack of foresight.
Parent
twitter
facebook
byThe MAZZTer ( 911996 ) writes:
Sounds like someone forgot the global flag on their regex.
bySigma 7 ( 266129 ) writes:
What idiot doesn't check user input with at least a regex replace to look for offending tags in fields *YOU KNOW* will be rendered by an HTML interpreter (browser)?
http://thedailywtf.com/articles/injection-proofd.aspx [thedailywtf.com]
Reactive regexing offending tags such as "script", "object" or "embed" don't work if you don't know they exist. As such, it's easier to simply include functions in the programming language API that escape/unescape strings sent in through user input so that junk like that doesn't get echoed into something hazardous.
bylgw ( 121541 ) writes:
YouTube doesn't support HTML in comments, so someone got too clever for their own good.
Here's a simple solution to avoid all this sort of BS forever: reject any comment with the < or & characters in it. Done. Why do extra work to create security holes?
bychristopherfinke ( 608750 ) writes:
reject any comment with the < or & characters in it.
What if you want to comment about AT&T or write a mathematical equation stating that x < y.
Users should be able to enter anything they want; htmlspecialchars() and nl2br() ensure that it will be displayed exactly as they entered it.
byLordSnooty ( 853791 ) writes:
Freedom of speech? You'll take my ampersand from my cold, dead hands.
byPeach Rings ( 1782482 ) writes:
Does anyone understand what IF_HTML_FUNCTION is supposed to mean in the exploit code? As far as I can tell it's just plain text with no special meaning, it's just copied and pasted blindly from some previous code. Am I wrong?
byPurity Of Essence ( 1007601 ) writes:
Yeah, I was wondering about this to. I ran into the exploit last night and noticed that in the page source. Fortunately, all the injected code did was insert a marquee comment asserting the video posters deviant sexuality while breaking the rest of the page.
byAnonymous Coward writes:
Indeed, which is why everyone but Perl programmers use library functions rather than writing their own regular expressions for working with markup. As a bonus you avoid little bugs like forgetting to escape '&', and it'll probably escape '"' and ''' as well so you can use it for attributes.
There may be more comments in this discussion. Without JavaScript enabled, you might want to turn on Classic Discussion System in your preferences instead.
●
509 commentsTrump Orders Treasury Secretary To Stop Minting Pennies
●
491 commentsTrump Signs Order Aiming To Close the Education Department
●
464 commentsTrump Opens Trade Talks Window While Threatening China With Steeper Tariffs
●
381 commentsScott Adams, Creator of the 'Dilbert' Comic Strip, Dies at 68
●
361 commentsChina Halts Rare Earth Exports Globally
Local Newspapers Use F/OSS For a Day
Wireless Presenters Attacked Using an Arduino
Slashdot Top Deals
Slashdot
on
●
●
of loaded
●
Submit Story
It is much harder to find a job than to keep one.
●FAQ
●Story Archive
●Hall of Fame
●Advertising
●Terms
●Privacy Statement
●About
●Feedback
●Mobile View
●Blog
Do Not Sell or Share My Personal Information
Copyright © 2026 Slashdot Media. All Rights Reserved.
×
Close
Working...
Local Newspapers Use F/OSS For a Day
460 comments
Wireless Presenters Attacked Using an Arduino
69comments
Do Not Sell or Share My Personal Information
Copyright © 2026 Slashdot Media. All Rights Reserved.
×
Close
Working...