Solidarity to all of the folks who have had to work with elected officials. I got ripped a new one because I recommended we disable a PHP project in the mid-2000s because a hay bale reporting app (report counts of bay hales on farms) due to an RCE bug. Within a few hours of the app being disabled there was drama from a politician who got a phone call from a prominent farmer...
The authority section (which contains the host domain) must begin with "//" whether there's a scheme prefix or not. Otherwise it's just part of the path (or query or fragment). IIRC, these semantics are also fixed by HTML such that any attribute like HREF or SRC is parsed as-if using the canonical regex (but after entity substitution and whitespace trimming). Browsers might have implemented this differently many years ago, but I doubt it as it would conflict with being able to use a bare path atom (e.g. foo.html).
[1] I normally eschew using regular expressions for proper parsing, but for URLs the canonical expression is both adequate and advisable for correctness.
Seems to have a bit. Cut and paste from the guy who set up \"><SCRIPT SRC=MJT.XSS.HT></SCRIPT> LTD
...
>I am in the process of contacting every website that has triggered my script which has a readily available contact for submitting security issues, or a hackerone account or similar. Alas, the sort of websites that have XSS problems rarely list IT security contacts.
FWIW for most of these sorts of things you can scrub it via passing the text through an NFKC or NFKD transform. I'd hope that a screen reader can be updated to handle this case.
These are Unicode characters intended for use in mathematical formulas, not text, so they break all sorts of things. It might make some sense to use them in mathematical Python code (where they do seem to work), but they're hard to type.
<blink>Blink</blink> -- It's a deprecated tag now, and most browsers don't support it, but I would have loved to have seen that as a company... <marquee> is still supported though....
I was wondering how much it costs to open a company in the UK to do something like that, and it seems to be really cheap (and quick):
a) Incorporate directly via Companies House
The standard registration fee to set up a company is just £12 for the ‘standard’ Companies House web incorporation service, which takes up to 24 hours to turnaround. You can pay via credit card, debit card or PayPal.
I'm disappointed that the discussion seems more about debating whether that person acted in good faith or that the law regarding acceptable characters in company names should be changed, as opposed to the bigger concern of why were they not sanitizing company names? Even without intent to insert HTML, characters such as < or > would still break their pages.
Is Companies House's website not done by GDS or something? I worked on a few GDS projects for DFT, we had to have independent pen testers test our services before they moved between phases.
No I mean the fact that this was possible on their website, XSS is one of the simplest things to test, in fact it was one of the standard tests UI testers would do on new screens.
On a related topic, the name of the company I work for starts with a colon. The rest of the name is a common adjective. As you can imagine, it is virtually ungooglable at the moment. Any thoughts on how to get around this?
BASIC programming ironicly may return better results than if you search for something about a more mainstream current language e.g. python. I often find the first few results are some search engine spam... tutorialspoint or geeksforgeeks etc, when a link to the API would be the logical first result. (Usually the first link to the api is for 3.4 or some random version also)
I've often wondered if any metallurgists have tried to run computer simulations of the annealing process. How would you find their research if they had?
Actually yes :) At least the optimization crowd don't use the phase 'heat treatment', which helps somewhat. But who I really feel bad for is the recruiters trying to hire a chemist who specialises in the element lead.
I don't know whether they actually do it but it seems really easy to treat "BASIC" as a distinct idiomatic token from "basic" when the searcher bothers to get the casing right.
Those people made it so that one-letter identifier names and junk like ‘fmt’ and ‘Fprintln(w)’ is again okay. So the unusable name fits the spirit quite well.
I was curious what googling only a negative query would do and for this, -"Yahoo" returns just the dictionary definition of the word "yahoo" and no search results.
It really is amazing how big a difference this makes.
I've started using Apple's Aperture software recently (I'm well aware it's been discontinued). I really like it, but my biggest frustration is that it's difficult to learn how to do new things, because "aperture" is a generic word in photography. I can't search for the name and get results about the software.
Limiting the dates to indexes before 2016 might help (at least with google). You can usually train google to get you what you want after a few searches. This was initially a problem with the Elixir programming language, but it learned what I actually wanted it started letting me just type in the term elixir without specifying it was a programming language. On other computers not associated with that account, it does revert back to the not-so-useful results.
> but it learned what I actually wanted it started letting me just type in the term elixir without specifying it was a programming language
Oh, you know what, this might be largely my own fault. I purposefully use Startpage.com as my search engine in order to avoid getting customized results (while still using Google's index).
I worry that customized results put me in a filter bubble—but they certainly have their advantages!
One of my favorite mobile games is Antiyoy, by Yiotro (https://github.com/yiotro/Antiyoy) who also created other games like Vodobanka, Achikaps, and Bleentoro.
The creator mentioned that he picked the names because they were pronounceable, unique, memorable, and searchable. That misses out on meaningfulness and familiarity, but those are expensive - by dropping those requirements, you gain easy SEO, trademarks, domains, etc. A big company knowing they're going to sell millions of copies can spend 5 figures on a domain and 6 figures on SEO, but I don't think it's worth it for most startups.
Huh, I play these and I didn't know that's why that had these names, I assumed they were compound words in some language I didn't know. This is like a reverse "XKCD" naming convention.
No lies detected, but because they aren't professional software I don't have to search for stuff as often. And the other "Professional" Apple app I use is Final Cut Pro, which doesn't similarly have this problem.
SiriusXM truncates a "The" prefix from artist names (so "The Cure" and "The Who" become "Cure" and "Who"). I always wondered how it would display The The. Would it be "The The" (special case), "The" (default removal of "The"), or an empty string "" (in the unlikely case the algorithm recursively removed "The" prefixes)? Eventually they played a The The song and the answer is "The The".
However, they benefitted greatly in the early ‘00s. If you had them in your Apple Music library, iTunes always put them at the top of your alphabetical music library, keeping them top of mind, ! comes before A. There might have a similar iTunes Store benefit too.
In 1997 Torsten Pröfrock released a highly sought-after dub techno album on the legendary Chain Reaction label under the name "Various Artists". It's a quintessential record in the Basic Channel genre. You can listen it here: https://youtu.be/3165Sf-q8dY
There’s a video on YouTube with three full-width explanation points as the title. I watched it once, and although it wasn’t particularly interesting, it bugs me that I cannot find it again.
Back when I worked at a comparison shopping engine, I had a bit of a laugh when I saw that the indexing pipeline was generating error messages because the "clean" function returned empty for some products in the feed from Amazon, because they had names like "++++++".
It was usually musical albums that liked to have names that made it impossible for fans to find the music.
Convince the powers-that-be in your company to invest in contracting with a marketing/SEO person or team to help come up with a new name. You want someone with marketing chops so that it's a good name, but you also want someone who knows about SEO so you don't end up on the second page for your own name search.
Just change the name. It'll be easier and more cost effective in the long run.
I've started working with some software called STACK recently, and it's almost impossible to find anything by searching (go ahead and try!). If it was a commercial product they would be sunk.
That would be a trade mark rather than a company name in this instance I think. In UK registered trademarks are standard type-written letters for word marks. If they contain symbols then they're figurative marks and it's an image of the mark which is registered.
On that point though, searching on the UK trademark registry it looks like it just strips non-alphanumeric symbols. A search for "Moz://a” returns "moza".
Relatedly, several years ago I scraped all companies on the old companies house webcheck site. There were two that interrupted my scraper: both contained '<' in the company name, and both seemed to take the webcheck service offline for a few seconds whenever I requested their pages. I can't say for sure - it might have been a temporary IP block I suppose - but it amused me nonetheless.
I giggled at the previous company name being redacted as “[NAME AVAILABLE ON REQUEST FROM COMPANIES HOUSE]” too. Not sure if that’s a common thing to do or if they made an exception for these shenanigans so they didn’t have to display the XSS.
What was the name? It’s former name is listed as “[NAME AVAILABLE ON REQUEST FROM COMPANIES HOUSE]” and it’s current name doesn’t contain any HTML tags (it’s literally the same as the headline)
Those are both funny and confusing names, but they don’t warrant comparison to sql-injections, so I am guessing there’s another name with actual HTML tags.
163 comments
[ 3.2 ms ] story [ 228 ms ] thread(Yes, the description is inaccurate.)
Edit: This is a different company, actually.
See also "BETTS & TWINE LTD" https://find-and-update.company-information.service.gov.uk/c...
SAFDASD & SFSAF \' SFDAASF\" LTD https://find-and-update.company-information.service.gov.uk/c...
Relevant - John Mellencamp using his hit song to siphon off subsidies to his family and relatives.
https://reason.com/2005/04/15/cash-on-the-scarecrow-pork-on/
Apparently the name used to be
/* THIS SUBDOMAIN HAS BEEN BANNED FROM THE XSS HUNTER SERVICE.
WE DO NOT ALLOW ABUSE OF OUR SERVICE, ALL SECURITY TESTING MUST BE AUTHORIZED.
Please use our contact form if you believe this ban was a mistake: https://xsshunter.com/contact */
1. https://news.ycombinator.com/item?id=24921261
Tried it in chrome and sees it as a file name on the current domain.
The authority section (which contains the host domain) must begin with "//" whether there's a scheme prefix or not. Otherwise it's just part of the path (or query or fragment). IIRC, these semantics are also fixed by HTML such that any attribute like HREF or SRC is parsed as-if using the canonical regex (but after entity substitution and whitespace trimming). Browsers might have implemented this differently many years ago, but I doubt it as it would conflict with being able to use a bare path atom (e.g. foo.html).
[1] I normally eschew using regular expressions for proper parsing, but for URLs the canonical expression is both adequate and advisable for correctness.
...
>I am in the process of contacting every website that has triggered my script which has a readily available contact for submitting security issues, or a hackerone account or similar. Alas, the sort of websites that have XSS problems rarely list IT security contacts.
𝗨𝗻𝗶𝗰𝗼𝗱𝗲 𝗵𝗮𝘀 𝗰𝗵𝗮𝗿𝗮𝗰𝘁𝗲𝗿𝘀 𝘁𝗵𝗮𝘁 𝗹𝗼𝗼𝗸 𝘀𝗶𝗺𝗶𝗹𝗮𝗿 𝘁𝗼 𝗳𝗼𝗿𝗺𝗮𝘁𝘁𝗲𝗱 𝘁𝗲𝘅𝘁.
𝑈𝑛𝑖𝑐𝑜𝑑𝑒 ℎ𝑎𝑠 𝑐ℎ𝑎𝑟𝑎𝑐𝑡𝑒𝑟𝑠 𝑡ℎ𝑎𝑡 𝑙𝑜𝑜𝑘 𝑠𝑖𝑚𝑖𝑙𝑎𝑟 𝑡𝑜 𝑓𝑜𝑟𝑚𝑎𝑡𝑡𝑒𝑑 𝑡𝑒𝑥𝑡.
𝘜𝘯𝘪𝘤𝘰𝘥𝘦 𝘩𝘢𝘴 𝘤𝘩𝘢𝘳𝘢𝘤𝘵𝘦𝘳𝘴 𝘵𝘩𝘢𝘵 𝘭𝘰𝘰𝘬 𝘴𝘪𝘮𝘪𝘭𝘢𝘳 𝘵𝘰 𝘧𝘰𝘳𝘮𝘢𝘵𝘵𝘦𝘥 𝘵𝘦𝘹𝘵.
𝑼𝒏𝒊𝒄𝒐𝒅𝒆 𝒉𝒂𝒔 𝒄𝒉𝒂𝒓𝒂𝒄𝒕𝒆𝒓𝒔 𝒕𝒉𝒂𝒕 𝒍𝒐𝒐𝒌 𝒔𝒊𝒎𝒊𝒍𝒂𝒓 𝒕𝒐 𝒇𝒐𝒓𝒎𝒂𝒕𝒕𝒆𝒅 𝒕𝒆𝒙𝒕.
𝙐𝙣𝙞𝙘𝙤𝙙𝙚 𝙝𝙖𝙨 𝙘𝙝𝙖𝙧𝙖𝙘𝙩𝙚𝙧𝙨 𝙩𝙝𝙖𝙩 𝙡𝙤𝙤𝙠 𝙨𝙞𝙢𝙞𝙡𝙖𝙧 𝙩𝙤 𝙛𝙤𝙧𝙢𝙖𝙩𝙩𝙚𝙙 𝙩𝙚𝙭𝙩.
(Don't do this: it's _terrible_ for accessibility, as screen readers can't parse these as regular text)
𝐔𝐧𝐢𝐜𝐨𝐝𝐞 𝐡𝐚𝐬 𝐜𝐡𝐚𝐫𝐚𝐜𝐭𝐞𝐫𝐬 𝐭𝐡𝐚𝐭 𝐥𝐨𝐨𝐤 𝐬𝐢𝐦𝐢𝐥𝐚𝐫 𝐭𝐨 𝐟𝐨𝐫𝐦𝐚𝐭𝐭𝐞𝐝 𝐭𝐞𝐱𝐭.
I'm curious if that copied the text or the placeholders. It's like hunter2 for the modern era.
It copied the text.
Relevant discussion on the Companies House Developer Forum:
https://forum.aws.chdev.org/t/cross-site-scripting-xss-softw...
Not to be confused with the equally inspired https://find-and-update.company-information.service.gov.uk/c...
a) Incorporate directly via Companies House
The standard registration fee to set up a company is just £12 for the ‘standard’ Companies House web incorporation service, which takes up to 24 hours to turnaround. You can pay via credit card, debit card or PayPal.
Source: https://www.itcontracting.com/how-much-limited-company-cost/
(Spam warning: if you form a company at your home address, you will be inundated with paper spam for office equipment. Especially from Dell.)
I also had a letter telling me I was the beneficiary of a few million dollars which was less useful :)
Issues such as what that company does after incorporation are another matter.
One day, they get a new customer called "Select". Absolutely everything stopped working.
Not saying they were compromised.
They provide data feeds to many third parties, who might themselves be vulnerable, hence the notification.
[1]: https://forum.aws.chdev.org/t/cross-site-scripting-xss-softw...
* BASIC Programming : 7 Steps - Instructables
* Learn More - Just BASIC
* The History of the BASIC Programming Language
* Programming in BASIC: the absolute beginner tutorial
* FreeBASIC Language | Home
* PureBasic - A powerful BASIC programming language
* Quite BASIC — fun, learning and nostalgia
* World of Spectrum - Documentation - ZX Spectrum manual
Only after all that is a non-basic link
* Introduction | Programming for Beginners
I've started using Apple's Aperture software recently (I'm well aware it's been discontinued). I really like it, but my biggest frustration is that it's difficult to learn how to do new things, because "aperture" is a generic word in photography. I can't search for the name and get results about the software.
Limiting the dates to indexes before 2016 might help (at least with google). You can usually train google to get you what you want after a few searches. This was initially a problem with the Elixir programming language, but it learned what I actually wanted it started letting me just type in the term elixir without specifying it was a programming language. On other computers not associated with that account, it does revert back to the not-so-useful results.
e.g.
Oh, you know what, this might be largely my own fault. I purposefully use Startpage.com as my search engine in order to avoid getting customized results (while still using Google's index).
I worry that customized results put me in a filter bubble—but they certainly have their advantages!
The creator mentioned that he picked the names because they were pronounceable, unique, memorable, and searchable. That misses out on meaningfulness and familiarity, but those are expensive - by dropping those requirements, you gain easy SEO, trademarks, domains, etc. A big company knowing they're going to sell millions of copies can spend 5 figures on a domain and 6 figures on SEO, but I don't think it's worth it for most startups.
Also relevant: "Change Your Name" http://www.paulgraham.com/name.html
Apple don't give a fuck.
You’ll never find them on YouTube or google unless you search for their informal name: chk chk chk
Terrible Google SEO, great accidental Apple SEO.
They probably exist, I just don't think I can ask a search engine to find them.
In 1997 Torsten Pröfrock released a highly sought-after dub techno album on the legendary Chain Reaction label under the name "Various Artists". It's a quintessential record in the Basic Channel genre. You can listen it here: https://youtu.be/3165Sf-q8dY
https://acommunication.co.uk
https://en.m.wikipedia.org/wiki/My_Computer_(band)
It was usually musical albums that liked to have names that made it impossible for fans to find the music.
The band 'Audiobooks' has taken this to the next level
(Or for a more modern example "!!!")
https://en.wikipedia.org/wiki/A_(band)
Even if I google ":different" company or without the colon, top results for me is a parfumerie.
When I google different australia, you're the top result.
I've started working with some software called STACK recently, and it's almost impossible to find anything by searching (go ahead and try!). If it was a commercial product they would be sunk.
https://www.legislation.gov.uk/uksi/2015/17/schedule/1/made
For example you can use the characters w,i,n,d,s,o,r but catenated in an ordered string means you have to get special permission.
Arguably the attempt to register this was an attempt to breech the Computer Misuse Act (which would make it illegal).
Seems like a regulation to add "computer code like expressions" to the list that requires prior approval of the Secretary of State might be useful.
On that point though, searching on the UK trademark registry it looks like it just strips non-alphanumeric symbols. A search for "Moz://a” returns "moza".
http://p-dpa.net/work/script-alert-mediengruppe-bitnik/
So if you're gonna Google it, don't use the URL bar.
Only 100 dollars...
Edit: Someone beat me to it. Reg #1330411-94
[0] https://prod.ceidg.gov.pl/CEIDG/ceidg.public.ui/SearchDetail... (check the reCAPTCHA and click "Dalej")
Those are both funny and confusing names, but they don’t warrant comparison to sql-injections, so I am guessing there’s another name with actual HTML tags.