Nice smirky attitiude! My name is Eric and I built the site.
>Betcha they're running SQL Server too.
We are indeed running SQL2k. The server is doing fine, btw, though we seem to have maxed out the pipe with the recent/. traffic.
>How much to you want to bet everything including
>the front page is dynamically generated for each
>and every request?
I will take your bet! I am using an XML caching system I built so that calls to the DB are minimized, which means that the front page is not dynamically created every time (unless you count an XSL transformation). Each entry description page, and even the list of all entries are pulled from cached XML now (the list/was/ created dynamically so as to show up to the second stats for the entries, but it was a matter of changing few lines of code to have it used the cached XML.)
To help prove how serious this security hole is, I have set up the following demonstration. You must be using IE, and have checked "remember me" when you logged on to Blogger, or have logged on (and not off) to Blogger in your current browser session.
Go create a new account at http://www.blogger.com (unless you want me to mess with your real account), check "rememeber me" when you log on.
Create a new blog, enter you FTP password if you want me to be able to actually publish changes I make.
Add a blog entry that says you want me (Eric Costello) to add an entry to prove I was there.
Slashdot Mirror
Nice smirky attitiude! My name is Eric and I built the site.
/. traffic.
/was/ created dynamically so as to show up to the second stats for the entries, but it was a matter of changing few lines of code to have it used the cached XML.)
>Betcha they're running SQL Server too.
We are indeed running SQL2k. The server is doing fine, btw, though we seem to have maxed out the pipe with the recent
>How much to you want to bet everything including
>the front page is dynamically generated for each
>and every request?
I will take your bet! I am using an XML caching system I built so that calls to the DB are minimized, which means that the front page is not dynamically created every time (unless you count an XSL transformation). Each entry description page, and even the list of all entries are pulled from cached XML now (the list
Anyway, thanks for your interest in the contest.
> it takes a heck of a lot of bad code for page to make a browser constantly crash.
No it doesn't! All it takes is code that aggravates one of the zillion netscape bugs.
- Go create a new account at http://www.blogger.com (unless you want me to mess with your real account), check "rememeber me" when you log on.
- Create a new blog, enter you FTP password if you want me to be able to actually publish changes I make.
- Add a blog entry that says you want me (Eric Costello) to add an entry to prove I was there.
- Go to http://www.glish.com/cookies.html.
I will get your cookie info and will soon have access to your blog. I have confirmed this works by hacking into pixelpony's blog.