Slashdot Mirror
Cross-Site-TRACE
quackking writes "Uh-oh! Looks bad for RFC 2068! Kudos to WhiteHat out of Santa Clara, CA for this one. ALL current web servers comply with this RFC, which means they ALL are vulnerable to this newly named attack - XST - cross-site-trace.
When misused, TRACE, part of the HTTP protocol, allows an unauthorized script to be passed to a Web server for execution even if the server is secured against running such scripts. Even devices like web-managed routers are open to this."
For the same reason that you'd go see a concert of a band that allows you to trade bootlegs of their concerts. The content may be the same, but the presentation of the for-pay version is in a format that is usually considered more desirable.
true, when you consider printer ink, printer paper, etc, the book might end up being cheaper after all...but then again, i can just print it out at work, and do away with all that overhead for me...
"Facts are meaningless. You could use facts to prove anything that's even remotely true." - Homer Simpson
as Kurt Vonnegut once said (paraphrased), good science fiction writers don't know anything about science. Personally, I would agree with him since Vonnegut is my favorite writer and I read science fiction not for the scientific facts, but for the writers interpretation of the "human condition" with perhaps the future or some crazy invention thrown in as a plot device. If I wanted a view of the future, I'd read science journals.
Don't trust a bull's horn, a doberman's tooth, a runaway horse or me.
I think most of it was a reaction to the language, which strikes me as bizarre. This is how we think! Maybe shutter-geeks are intolerant of words coined after 1960, but I hate to tell you folks, look how many pieces of language we owe to Gibson's contribution.
Check out Tales for the 1337 presents: Romeo & Juliet". That's funny shit, because of the way it illustrates how language is changing with the kids. Before you dismiss them as punks, remember that in ten years they'll be dismissing us as foges.
It's always been the case that language is purely the spoken word, and that writing is only linguistically interesting in the sense that it helps us track the progress of language. That's not exactly what I mean, but close enough. Anyway, what's come to be known as '1337' (but I'll generalize as "chat colloquialisms" b/c ppl ph34r th4t w0rd) is the first time that writing is dictating language. kewl.
When you find yourself saying - outloud - "bbl", or "brb", or "haxor, fuxor, suxor", or "warez, filez, skillz" in 'real life', you know you're part of the change. Hell, when I say "owned" wrt computer security, I know it's spelled with a zero. Writing is leading language in this case, unlike others, because within this particular group of people, writing has become the dominant communication medium. Otherwise, it would follow the same slang-path that you are probably more familiar with, like "cool", "sweet", "rock", etc, which progresses from within spoken circles to the dictionary in an orderly fashion.
Quoth sirinek,
He's right, he's not alone. But I'm not with him. I have a blog. I blog things on my blog. This comment will probably be blogged in some shape or form. And I'm thinking about starting a wiki for a different project. 'Wiki' is the only word there is for a wiki. The only way I can think of to avoid using it is to not think about the idea that 'wiki' represents
Interrobang,
Aren't we progressive? Aren't we adaptive? I've got a lot of hope riding on this generation of geeks, to look forward to the future, optimizing the world, if you will... I shudder to think that, underneath it all, we geeks think that our own language and the way we think should be constant and unchanging throughout our (adult) lives...
Because part of being a useful member of society is taking responsibility. If you wish to see the series continue, take responsibility for a part of that and help finance it.
It's not a theft issue or anything, the author isn't harmed by you reading it. You have no obligation to pay, otherwise it wouldn't have been a gift, it'd have been a guilt-trip. But stand up and be counted. If you like something, make sure it keeps happening.
Support the author. If you don't want the book (and someone who doesn't re-read them probably wouldn't) then just send what you think is a fair price (a buck or two probably is more profit than he'd see from an actual sale) through paypal. Then pass the e-book on to someone else who might like it.
Personally, I wouldn't buy the book (in paper form anyways). Paper is becoming more and more obsolete. I read on the computer with preference to paper. When I re-read 1984 I did it on the computer, when I read the last honor-harrington novels, I read them on the computer instead of from the hard-copy book I had. I like having Baen books on CD though, and if the price of that is to buy a little obsolete paper every now and then, so be it.
This isn't at all related to whats going on right now is it?
To re-iterate: your web server or site isn't vulnerable because it supports trace, that's about as silly as blaming ping packets for the ping-of-death problems on early windoze systems, sheesh.
This is all a bunch of crap that requires a browser to be vulnerable to cross scripting, and for the user to have visited a malicious site just beforehand.