mango.pdf.zone

I use uMatrix with very restrictive default settings. These[0]: https://smichel.me/hn/umatrix-global.png

When a page doesn't work, and I care enough to un-break it, I will first try enabling just js. If that doesn't work, I'll add XHRs, too.

So, I can say with confidence that there are a good deal of sites that fall into both camps. I cannot say the ratio with confidence, but there are enough sites that work enough with just js that I choose not to enable XHRs. Here are a few examples:

- Kotlin documentation gets collapsing menus and nicer code formatting: https://kotlinlang.org/docs/reference/visibility-modifiers.html

- This person's blog gets inline/popup footnotes and, er, a functional "hard mode" (top right): https://mango.pdf.zone/finding-former-australian-prime-minister-tony-abbotts-passport-number-on-instagram

- https://represent.us/ renders about halfway without js.

The final example is the most relevant to this conversation, I think. Especially, there is a phenomenon, common enough that I've noticed it as a pattern of sites that display images with js (and sometimes content), and don't require XHRs to do so.

----------

Looking through my history to find these examples, two things become clear (about the sites I visit; I don't claim my browsing is representative):

1. Regardless of whether they also need XHRs, sites that require JS fall overwhelmingly into one of two categories: either I use them regularly and they're already on my saved whitelist (eg,…

Great post, thoroughly enjoyed reading it.

BTW, on a side note, when you try and visit the blog's homepage[0] and scroll down to the bottom, you find a link to an actual (password protected) PDF file called Mango.pdf[1]. The author 'Alex' says the password for the PDF has been embedded in the page and it didn't take me a lot of time to figure the password out from the HTML source[2].

But when I opened the PDF, I was hit with this random string of characters:

cGJhdGVuZ2h5bmd2YmFmLCBsYmggZmJ5aXJxIHpsIHlodnR2IGNobW15ci4gQCB6ci
BiYSBnanZnZ3JlIGp2Z3UgbGJoZSBzbmliaGV2Z3IgcXJmZnJlZyBnYiB0cmcgbGJo
ZSBlcmpuZXEuIFZnJ2YgeXZ4ciwgYWJnIG4gaXJlbCB0YmJxIGVyam5lcSBmYiBodQ
o=

I tried to decode this using every available decoder, but it only throws up random result. Was wondering if any of you smart people here had any idea about this code.

[0] https://mango.pdf.zone/

[1] https://mango.pdf.zone/mango.pdf

[2] view-source:https://mango.pdf.zone/

EDIT: SOLVED IT!

As the commenters who replied to me mentioned, this puzzle is double-encoded. I think the trick is to figure out which decoder to use first.

As a software engineer even I sometimes can't help romanticising hacking in my imagination. But so many times it turns out to be just like some company left the front gate wide open and the "hacker" walked in and took a look around.

Eg when an airline had a public API where you could get someone's passport number and details just from their boarding pass https://mango.pdf.zone/finding-former-australian-prime-minister-tony-abbotts-passport-number-on-instagram

Sure:

- https://www.myid.gov.au/verifying-your-id-in-myid#myid-Australianpassport

- https://www.afp.gov.au/sites/default/files/PDF/NPC-100PointChecklist-18042019.pdf

- https://www.equifax.com.au/personal/identity-verification-100-point-check

The blog post has more use case examples:

https://mango.pdf.zone/finding-former-australian-prime-minister-tony-abbotts-passport-number-on-instagram/#why-is-it-bad-for-someone-else-to-have-your-passport-number

Try five:

- https://www.thedailybeast.com/i-dropped-acid-and-saw-into-the-future-my-surreal-first-time-at-ces

- https://slatestarcodex.com/2014/09/30/i-can-tolerate-anything-except-the-outgroup/

- https://www.usenix.org/system/files/1311_05-08_mickens.pdf

- https://aphyr.com/posts/341-hexing-the-technical-interview

- https://mango.pdf.zone/finding-former-australian-prime-minister-tony-abbotts-passport-number-on-instagram