Yahoo and Hotmail Filter Flaw

gandam writes "Israeli computer security firm GreyMagic Software has detected a serious security flaw in Yahoo's Web e-mail service and Microsoft Corp.'s Hotmail service, which could allow hackers to run malicious scripts on users' computers. I tried sending a mail to my yahoo account and it never reached my mailbox. According to the website, all attempts to contact Yahoo unfortunately failed. Mail was sent to security and secure at yahoo.com and at yahoo-inc.com. No replies were received to date. Works only in IE5, though."

Comments

Re:Works only in IE5, though?

[jrockway]

You are widening the goddamn page! Don't do this!

Re:Works only in IE5, though?

[jrockway]

Well according to the FAQ, you get banned if you make a page widening post. I'm reporting this one too.

Re:Works only in IE5, though?

[jrockway]

I'm using Firefox. And yes, it is the browser's problem. But slashdot makes an effort to keep page widening posts off slashdot. Why did you widen the page anyway? Wanted to lose some Karma? Keep up the great work. You are truly an asset to the slashdot community *yeahright*.

Re:Hotmail evidently fixed

[BrynM]

I'm not sure about that... Hotmail is essentially one big server side program - they don't have to worry about breaking much other than the html code, and they only have to worry about patching a relatively few number of machines (basically just fix the code on the hotmail servers).

If 5,000 machines is just a few, I'd hate to see a large server environment. From the Hotmail Migration Case Study:"The current network of more than 5,000 servers is organized into about a dozen clusters; each consisting of front-end servers linked to data storage machines."

Mind you that it's grouped into "about a dozen" clusters, but that's still quite a patch rollout. I'm stunned that Ms managed to finally get Hotmail migrated completely to Windows. I wonder how many Linux boxen that service would require... Then they could run it on a single IBM 390 system with lots of virtualized Linux installs.

For giggles, let's do some math:

• 5,000 copies of W2k3 at $999 each: $4,995,000 (They would probably work a volume licencing deal with you at this point)
• Client Licences bought in 20 packs at $799 each for "100 million active users" minus the 125,000 client licences 5,000 copies of W2k3 server would provide: $3,990,006,250 (again, they'd work a bulk deal I bet)
• Being MS and not having to think about how much this would cost for a real company to do: Priceless (I wonder if they write off the licencing costs as lost income)

Wow! That sure makes the price of patching those 5,000 servers quickly seem like a drop in the bucket.