Also!

[coraa]

You might want to avoid Twitter for the next couple of days, due to a pretty enormous security hole.

(We'll see if crossposting works properly this time.)

Comments

[jonquil]

That fix is STUPID STUPID STUPID.

Damn. There are fricking *books* on XSS. There's open-source software to detect it.

This is a genuinely hard problem, and you don't attack it with a simple patch. W@#$@#$@#$. Doesn't anybody here know how to play this game?

[coraa]

That was kind of my response. I'm not a programmer and I'm certainly not a website developer and I've even heard of that exploit; it surprises me that such a large and popular website has screwed it up so badly.

[green-knight.livejournal.com]

Crossposting works. That is a very worrying hole indeed. (And I'm not sure I can avoid Twitter that long... Ooops.)