Hacker News Reader

Comment by ajacksified | Hacker News Reader

I was just talking about this at lunch, by really weird coincidence. You were leading the funniest GitHub pull request I've ever taken part in. It went something like this:

Me: "I've created a PR to allow .cur and .mid files, like the good ol' days."

You: "Wtf is a .cur?"

Person 2: "It's windows cursor format."

You: "(many paragraphs, tl;dr: Sorry, but we're not recreating Geocities.)"

~ one year later ~

You: "I caved. I've merged, sorry for being a dick."

After so long, I'd completely forgotten about the PR and found it hilarious that you eventually merged my PR. I'm happy to see things continue forward :D

View on HN

I've been thinking about flipping it around - instead of whitelisting certain files, simply blacklisting the problem formats. Thanks for reminding me.

I think a whitelist is better, there can be a ton of file formats that have vulnerabilities in their readers.

True. The main issue is that people love to create new web formats. For example, there was some 3D model formats we didn't support initially. It's pretty hard to keep up.

I don't think you necessarily need to keep up! Just keep moving and you'll get what you need over time.

On the other hand, a whitelist might work as a way to "trick" people into starting to contribute, by way of filing issues and submitting trivial pull requests?

Thanks for all your hard work on the site by the way! I've actually taken the opportunity to use it at my new job, as one option for students to publish/show work in our basic web/html course at Voss FHS[1].

Did you manage to keep publishing the transparent financial reports? As I've mentioned before, I personally find the openess of the whole operation to one of the most interesting bits of the site :-)

[1] http://voss.fhs.no/english/information-about-voss-folkehogsk...

Like .cur files! According to a quick google search, there was/is a buffer overflow vulnerability in XP. Makes me wonder how many SP1 XP installs hit Neocities.

Agreed. Kyle, are you also validating that the content of the uploaded file correlates with the extension? Geocities began having real issues with bot generated accounts, each of which would get one shard of a binary warez uploaded as .jpg, etc. Of course, we didn't have captcha, so your exposure might be limited. Awesome to see this -- wish you worlds of luck.

Reply on news.ycombinator.com