Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×

Submission + - Cross-Site Scripting Attack hits Twitter (sophos.com)

RJHelms writes: As those of you who use Twitter may have notices, the social media site appears to have been hit with cross-site scripting attacks this morning. From Sophos:

"The Twitter website is being widely exploited by users who have stumbled across a flaw which allows messages to pop-up and third-party websites to open in your browser just by moving your mouse over a link. Messages are also spreading virally exploiting the vulnerability without the consent of users."

As of 9:20AM EST, I have also seen attacks doing the same thing using an overlay, making simply viewing your account reproduce the offending messages. PC Magazine's Larry Seltzer's blog claims the attacks were stopped around 9AM but began again around 9:15. Perhaps the original fix only blocked onmouseover.

Comment Re:Eh? (Score 3, Insightful) 352

Thankfully I exaggerate, but that element of Canadian society definitely has it's home in the CPC - look at Stockwell Day, cabinet minister and young earth creationist.

The Conservative base, like it seems to be in many countries, is split between the social conservative religious wackos and the fiscal conservative "yay oil, boo climate" wackos. This move is brilliant (in a very cynical way) because it plays to both - but like most of Cabinet's actions these days, doesn't appeal to anyone else.

Comment Re:Eh? (Score 5, Informative) 352

Yup, exactly this. The Harper administration has for the past few years been increasingly exerting control on how the public service disseminates information to the public. In the past (before 2007) a bureaucrat usually only needed the approval of their direct supervisor to respond to media inquiries, unless the topic was particularly sensitive. Now it the system of Message Event Proposals created in 2007, approval frequently needs to come directly from the Prime Minister's Office, even for totally routine and innocuous communications.

I think the biggest problem is, reports on the last ice age might offend the Conservative Party's core supporters - who know that there's no such thing as 13,000 years ago, and even if there was there'd be both dinosaurs and cavemen at the same time.

Comment Re:It Shouldn't Be (Score 1) 113

Jeez, I thought "lazy" [outside of where it was necessary] was the right word as you can't by definition plagiarize your OWN WORKS.

In the academic world you can. Why do you think authors cite themselves, when referring to research they've previously published? If you couldn't plagiarize your OWN WORKS, they wouldn't bother to do so - at least if being lazy was the prime motivation for plagiarism.

Comment Re:Bit of Advice (Score 2, Interesting) 143

I was going to post exactly this. The sample Google Chrome image in the article is immediately obvious as a fake because real Chrome warning pages have proper subject-verb agreement and don't have character encoding images. I imagine Firefox warning pages don't have the two buttons overlapping.

I'm really forced to wonder this about a lot of malware and phishing scams - I somewhat frequently get e-mails telling me I won an "iPhone-4G" on "Facebooks", how hard it is to get those right?

At the same time, I think you hit on exactly why they don't bother with this. The bottom side of the intelligence bell curve is still half of the people who will see the page, and they are the same people who are more likely to fall for it even when there are no errors with the English. I imagine it simply doesn't pay to shell out any amount of money for proofreading.

Comment Re:Too close to the subject... (Score 1) 396

I am a software tester. I find bugs. I document them thoroughly. When I get a chance to poke around in a release, often most of the bugs I've found are still present.

Bug-fix development, especially close to release time, is all about triage. That late in the process, the goal isn't to have the software be bug free - far too late for that - but rather to fix the very worst ones. Unfixed bugs either get patched in the future or sit around as known issues, which hopefully the support team is made aware of.

It's not being cheap, and it's not being wasteful - at a certain point you can't afford to delay the release any further.

Comment Re:technically (Score 1) 318

I believe this is a drug-addled reference to the phrase in section 3 of the Java license agreement: "You acknowledge that Licensed Software is not designed or intended for use in the design, construction, operation or maintenance of any nuclear facility."

What that has to do with jailbreaking, however...

Comment Only one option? (Score 1) 637

I don't have a car

I don't have a mobile phone

My public health care is supplemented by employer, not paid out of pocket

I don't have a gym membership

I don't have an account with a drug dealer

I don't have ovaries

I don't have an NPR membership

So I only have a home phone line, incl. broadband. what kind of poll is this?

Slashdot Top Deals

Beware of Programmers who carry screwdrivers. -- Leonard Brandwein

Working...