Could this be more then a giant DDoS bug?
In theory, could you submit a legitimate value for key 1. That value then is the one that gets validated. Could you then submit a second value with key 2 that hash's to the same value as key 1 overwriting the data for key 1 in the data structure. Since the application isn't expecting a get/post value with key 2 the data never gets validated. When the value for key 1 is retreived, the hashes have collided the the data for key 2 is retreived.
Thinking about PHP, the collision would occur before the script executes, so validation should get key2's value and thus validation should value. It might not be the best failure mode, but validation should catch the error. Is that a good assumption and is that true for all the implementations? I think this is theoretical, but I can't convince myself to ignore the possibility either.
Filed under: Home Entertainment
Joost, the hard-partyin', beta-stage releasin', streaming TV-service you've been watching on your PC appears to be making baby-steps towards integrating their service with somebody's third-party set-top box. Joost began making public statements this week suggesting that it's already in talks with manufacturers, although we don't know who or where. According to their executive VP of global advertising, "You will see Joost in the living room," which really only makes sense. Paradigm-shifting media delivery platform or not, people still seem to typically prefer to watch TV sitting on their couch and with their TV.Read | Permalink | Email this | Comments
Office Depot Featured Gadget: Xbox 360 Platinum System Packs the power to bring games to life!
In space, no one can hear you fart.