Show HN: HN Card, Hacker News Profile Overlay
github.com
github.com
https://github.com/mudulo/hncard/blob/master/chrome/js/hnpro...
It depends on the origin of the iframe - if the iframe origin is the tuple (https, news.ycombinator.com, 443) then even if it's in an iframe it still has access to everything. If you put the content into its own origin (say, with <iframe src="data:text/html;base64,..."></iframe>), then it would no longer† have access to your data, but someone who put javascript on their bio could still pop up an alert with arbitrary content in your browser, for instance.
† Well, it's also debatable whether or not an iframe with a unique origin would be sufficient protection in the age of Spectre/Meltdown style vulnerabilities, where code execution in a process means you have access to the entire memory contents of that process. Chrome has strong protections against this in the form of Site Isolation [1], but Firefox does not (though they are actively working on it with Project Fission [2]), and Safari/etc do not to my knowledge. We don't _really_ need to be worried about Spectre/Meltdown vulnerabilities being used against a Hackernews profile viewer extension, but at the same time it's easy enough to write safe code that doesn't allow javascript execution in the first place, so why not do that instead?
The right way would be to either use a templating language that takes care of it for you (react/angular/vue/etc), or to write some plain javascript instead of injecting DOM with jQuery.html(). Something like:
const div = document.createElement('div');
div.textContent = 'This is the bio. <script>alert("This will not execute");</script>';
Let’s pull some rabbits out of thin air again.
But first disclaimer - I’m not saying this is why the extension was developed, or, that this is the reason OP points the vulnerability. I’m 99.999% certain this is a random case, but it is a good learning case nonetheless.
Rabbits.
Sometime in life people say things they regret. Or, they don’t regret, but their self interest is better served if no one knew they said said thing, or it is that they just worry Harvey might be offended and their career path will be ruined, so it better be taken back.
But... yak... what’s done is done.
What can you do?
Cry?
No. Rabbits!
Wouldn’t it be nice if some browser extension published on HN would have some fault that would allow someone else to post using my logged-in account?
So see, I didn’t post that comment.
It was the XSS!!!1
(Or the rabbit)
Here is the commit https://github.com/mudulo/hncard/commit/6f5d2c9dae1aee5cf6fa...
Thank you Again. I learnt something.
However, I personally like not glancing over user karma just to avoid bias. On Slashdot, for instance, I subconsciously assigned higher credibility to posts made by smaller (numeric) ids. The new reddit has it too.
If karma has to be present, it's best if it is a subtle as possible.
I am honestly torn, as I progress in my career and life, as a sort of contrarian type, I get more and more worried some background check algo is going to find my presence on platforms, troll my history, and find some random comment from 5 years ago that might be controversial and blackball me for it, unbeknownst to me. On the other hand, I hate the idea that we increasingly self censor as we all become more aware of this.
This is why I still think anonymity is important on the internet, and lean towards burning accounts every couple of years on commenting platforms. This is also why I still value what others might call cesspools that are the chans, and of course onion sites et al.
I tend to always think about this Eben Moglen talk (listen from timestamp for 4 or 5 mins) : https://youtu.be/sKOk4Y4inVY?t=427
With that, after looking through hnprofile.js and am curious if you had a roadmap in mind for improving it? These two things came to mind:
- Adding localstorage for caching info from each fetch, adding last-visited etc
- Adding formatting options for the drop
I'm interested in adding support for the first item if you'd like contributions. You can email me if you'd like to chat.
I see you updated jQuery[0], added your screenshot[1] & edited the Readme each with trivial small edits[2]... and out of the 15 commits 11 commits is related to the screenshot and Readme.
I can't see any new code written, I can't help but suspect that this repo & account was made to get karma...
If you would like some project ideas, I would urge you to modify the styles of the current HNCard plugins to match the HN asthetics; like non-styled buttons/links with the beige background colors and less margin.
[0] https://github.com/mudulo/hncard/commit/808060e869efc8205184... and https://github.com/mudulo/hncard/commit/808060e869efc8205184...
[1] https://github.com/mudulo/hncard/commit/cdfc024ba6aef1cb7562... and https://github.com/mudulo/hncard/commit/a42aaca31de97d894950...
[2] https://github.com/mudulo/hncard/commit/eae608db902b6501dc66..., https://github.com/mudulo/hncard/commit/dc756ffebdfe2d08ffaf..., https://github.com/mudulo/hncard/commit/3d78b1c3a02bf1499016..., https://github.com/mudulo/hncard/commit/1b96751bcadc8393e319..., https://github.com/mudulo/hncard/commit/6293499bb0d0bb87c889..., https://github.com/mudulo/hncard/commit/205450c6998233fad28b..., https://github.com/mudulo/hncard/commit/0c7b4d67df6b8ca19266..., https://github.com/mudulo/hncard/commit/596eef59eba83f1a0aad..., https://github.com/mudulo/hncard/commit/91e80d40f1a74c3479af...
Its more like this project is cool, but it was last updated 5 years ago, let me fix and share it.
Wow, I mean, Wow
Small typo in the readme under the Firefox instructions. It says go to the "about:debugging" section and click "This is Firefox" but it should be "This Firefox" (no 'is').