Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror
×

Comment Re:No hurry (Score 1) 317

It is predominant among homosexuals but that is more likely cultural than biological. Many gay men participate in far more casual and unprotected anal sex or other high risk practices. It's not becase it's two men though, it's because those two men happen to be having high risk sex. If heteros were doing the exact same acts with the same frequency, you'd see a similar infection rate.

Comment Re:No hurry (Score 3, Informative) 317

Uh no, heterosexual anal sex carries the EXACT SAME RISK with a known infected partner. But hey, way to be a bigot. Anal sex in general is far more risky as the vagina is an acidic environment that is hostile to the virus, plus microtears can occur int he rectum walls during anal sex that creates a better blood pathway.

Comment CU's dont always have securityin mind (Score 1) 205

I've tried repeatedly to warn my own credit union of a security breach in their "self-help" terminal. It's running windows and a modified version of IE (no close out x). The problem is that the "View cookies" menu item open an explorer window in focus and the whole directory can then be traversed and written to. It's also internet friendly and not firewalled for third party sites. Sounds like a perfect recipe for a keylogger to me.

Comment Re:a legit hack (Score 2, Informative) 214

Most coders don't sanitize code coming from a trusted source. They sanitize input from users, but something like a SQL injection is generally an effect of improper user-san anyway.

Imagine you have a script that just includes a user's profile data (user.php) from a flat file (stupid i know but its an example), by entering in a remote file to a field, it might be sanitized, however in a sql injection you could over right "user.php" with http://www.evilsite.com/evilscript.php

Myspace ran into this issue when they launched their mobile service. The mobile service wasn't properly stripping out javascript and the main site didn't sanitize already input data, under the assumption that sanitization had already happened. As a result, you could enter javascript into the mobile client and it would be executed on any web browser.

Comment Re:a legit hack (Score 4, Informative) 214

Uh...no. The article states they just used SQL injection to insert an include to a remote php file (the idiots apparently hadnt disabled remote file includes). The included file was basically a dashboard that did directory listings and file transfers. I did a contract cleaning up a similar mess (URL-RFI Injection). The hardest part about the entire hack was probably finding the SQL injection point.

Slashdot Top Deals

Solutions are obvious if one only has the optical power to observe them over the horizon. -- K.A. Arsdall

Working...