Hacker News Reader

Hacker News

Comment by homm88 | Hacker News Reader

Full thread

homm88

<__>: it's fake

<__>: the SSL seal is missing

<__>: it's a javascript edit

<__>: open a https site in firefox and look at the addressbar

<__>: sec

<__>: yeah

<__>: it DOESN'T appear if you used a javascript hack to make it go away

<__>: and changed the page

View on HN

It also doesn't look like the standard Linux uptime command, which uses "load average", singular. The BSDs, including OS X, say "load averages"... does Twitter run FreeBSD, or is this copied-and-pasted from an OS X client machine?

nice catch, I definitely think that would be the nail in this coffin.

I thought Netflix used FreeBSD? https://www.freebsdfoundation.org/testimonials

Yeah, there are certainly a bunch of people running FreeBSD in production. I just didn't think Twitter was one of them.

Doesn't even need to be a javascript replace.

     $ uptime > blah
     $ open blah

Change the address bar. Screenshot.

I guess it's possible that the URL behind the black bar doesn't match the actual URL used for the exploit - further obscuring. It might be too easily guessable if it's short, no matter the censorship. And editing the URL would make the seal look like the above. Sure, it's fake, but there's a not too unreasonable explanation as to why it might not be fake fake and why he'd have made that mistake and thought it not to be relevant enough (or just didn't notice) for the central authenticity of the claim to be challenged.

It's absolutely possible it's fake. But it's also yet possible that it's not.

The address bar also has focus (blue outline), further suggesting the URL has been edited after a page load. Normally it loses focus as soon as you hit [enter].

Faking it would be much easier and not betray such evidence:

Hit F12, edit out the HTML to be whatever you want.

Everyone is freaking about the "URL edit", but it's probably that it's actually a long string exploit and he's just edited the URL to fit into the screen to take the screenshot.

It's too amateur a fake, so I'm actually leaning on the side of it being real.

Reply on news.ycombinator.com