Josh Simmons writes about quitting Shopify, meditation, social media breaks, and blockchain, and runs a blog where each post is stored in its URL.
HN discusses the stateless blog design, where posts live in the URL, and a commenter reports it is vulnerable to XSS.
>Posts of unknown authorship have a disclaimer at the top of the page.
Problem is, the posts can contain <script> elements. So it's easy to just write a little JavaScript that removes the disclaimer at the top. See this hastily-made, immature example of mine:
https://joshcsimmons.com/post/H4sIABO8LmUC/3VT0W7aQBB85yu2QVUSiZik6QMilIqCKG6hSkVEFVV9OOw1vtS+c2/XGKN+fNeGAkpTy5Lv7J3ZmdlzE3yI1RrhKScGijVDWhImUaPht+CTpRiGHsx1mlpDLVA5x9aBjYBjTZBZ4tYOfwL1Go0mjAdf5dGEiS0gtNLlp5FVafOTctm5CvC+0XiUD3WF/w8dLDFQOSG8JKguLpxmRgMCidFhC7Q56vMOMgJlhH4p5LnDYwEUig4Uy/J5DxF3L1UkUPFhLEOQKJ3uoxCdmcTREs4gBiH6XvNagz8uYuaMuu32kxAGtGPzApu2q67tyVvyB/vr9Zvx7XT2q7O9n98s/K2W/Zf5YuLPh5vpYr5al7rI5sHNw+eZ8afjR1sOO/k1zoZ7rNyd0eCj03h7nVTvLvfBKAg11XLRgWLxLL5ttpsfQqZW6MFDHYQsBUNicGflCJSpm7CqdxhZCS6tTkpNv0RJ7CS5FF/VYX+LVXWWbJ6Ef1MrqhgTVDLGCFn400pdECsjfUVObkJ0mTJMMq9eBsRlgu/OImv4ivQWu5vNFaUqSc76o4Oy7m6IRS2bwaF8L/eDwfCFWbZgmTOEWK3ZKUaqcyAMcnFRQpSogg6nh0piTL1eO+v3KHA6435ogzxFw97ShqUXaUc8jHUSek4413hxeXeoYM3i4Pw/vxf8ltwRPiR2VdkfOe+51vO7Xnvf9Q96LLiepQMAAA==
As it stands, this really isn't the most secure system. Something much more malicious could be injected into this!
This site allows anyone to inject content, you don't need an iframe.
https://joshcsimmons.com/post/eJyVlD2PgzAMhvf8Cm8HlcD76dSlf8OSYUCMnA4GBqu%2F%2FRInBqetVDUD5ON944+H9uf3b7peYIYFRthghQl2eLsOM3w2oj4sgDqn6qRaod9ZwihlKl7kLVK9xrCZcugrizzNvvW5hXV41lQrqpNYw3QkIKUiTZwobXcdM5AJNMgU9iNnSgbuuvv9jHRPHikKDRL14XIWStw5uTcyHZ7ChDhbTMN9V0bPOrQcdcyRiBNTPkcEhviOz4Yb5ms+V0ckAqcldviWlC1AtmaDWqSwjESsQ6R3qINbtGvUoA7Oe5GItRQ115sq2hNCkw3acyNibWhSycVhBUVlrAnd16dErChKsVPXqBhyExpmPGPuygMKJbKMhtRYSNS%2FKjJy8JADScbBbGjQb2MUZh71V5iTFru0+rFI4fHiu7XMqbZI4eEc6CO8iCKZhzwatAlIXLrkbhTl4ZPC48hLXUjl4a+Ad47E48P%2FrH87iPTj
Created using
wget "https://gist.githubusercontent.com/snipe/5512408/raw/db9f4051eeb1079de436ec5ae9ba9aff2a99549c/gistfile1.txt"
python3
>>> base64.b64encode(zlib.compress(b"<pre>" + open('gistfile1.txt', 'rb').read())).replace(b'/',b'%2F')
+1 to this. I will grit my teeth and go through a leetcode/coderpad step (I get it, FizzBuzz and all that) but jumping straight to the technical stuff and not giving me the decency of talking to a human leaves the impression that I'm really just a code-producing machine for the org (Which for Amazon, I no doubt expect I would be).
As a recently posted article here said[0]: "My hunch with those companies was that it wouldn't have been a major issue if I was video-ing in from the State Penitentiary (due to murder charges) as long as I solved the algorithms correctly"
[0]:https://www.joshcsimmons.com/posts/why-i-quit-shopify
> Anything can be generated here. You could even host your own blog that uses my website as a renderer if you really wanted to. It supports markdown.
> Every post that I want to publicly claim authorship of lives at the root of this site. If you are reading a post that I have claimed it will look like this page. Posts of unknown authorship have a disclaimer at the top of the…
https://joshcsimmons.com/post/H4sIAAAAAAAAAyXMQQrCMBCF4b2neOBCBWn3nkAXegFxMTGjCW0yJTNp6e1t6%2B57PPj3uNPsGNEQNR8MUyD7r2a3u4ESshi0Fj7D1e1S5qToY8cgOPKIngkmKJw9ly3B4wKVxJIZQzVF4MJbspeR8bw%2BXsdgNuilbTNP2sxvSS5mMinNwhMsSP0GUPYLGR%2FpO121Zn7rWby7twAAAA%3D%3D
Doesn't need to release tools... gzip, base64 and uri encode uh huh.
> This blog is now STATELESS. The entire post is contained in the URL that you are visiting now. All my "blog" is now is a hard-coded main page that contains links to posts I claim authorship of. Of course the entire post is contained in each of these…