Ho fucking ho
Jun. 12th, 2004 05:06 pm![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
dennySorry about the 'this is interesting' crap I had in my journal a minute ago (if you clicked on 'this' it posted itself into your journal - a javascript/html forms exploit that's currently amusing the empty-headed). Unfortunately because I've been catching up on 4 days of friends posts, I can't remember where I picked it up from.
Update: in fact, I'm going to follow the example of![[livejournal.com profile]](https://www.dreamwidth.org/img/external/lj-userinfo.gif)
zotz and log out of LJ until they fix this exploit. As deliberateblank points out in this post, this exploit is not constrained to only posting new entries in your journal. It can be used to exploit any LJ form - which includes easily deleting recent posts or even your entire journal. If you're logged out, it won't work - it relies on your system having an existing login session cookie for LJ.
Anyone who posts anything important to a friends-only or filter list before I post here that I'm logged back in, I'm not going to see it. Let me know by email if it's important.
Updated update: actually, I think I can live without JavaScript for the time being (the exploit uses JavaScript). It makes a few sites I use regularly a bit quirky, but nothing too terrible. So, I'm still logged in.
Update: in fact, I'm going to follow the example of
zotz and log out of LJ until they fix this exploit. As deliberateblank points out in this post, this exploit is not constrained to only posting new entries in your journal. It can be used to exploit any LJ form - which includes easily deleting recent posts or even your entire journal. If you're logged out, it won't work - it relies on your system having an existing login session cookie for LJ.Anyone who posts anything important to a friends-only or filter list before I post here that I'm logged back in, I'm not going to see it. Let me know by email if it's important.
Updated update: actually, I think I can live without JavaScript for the time being (the exploit uses JavaScript). It makes a few sites I use regularly a bit quirky, but nothing too terrible. So, I'm still logged in.
