Stories
Slash Boxes
Comments
NOTE: use Perl; is on undef hiatus. You can read content, but you can't post it. More info will be forthcoming forthcomingly.

All the Perl that's Practical to Extract and Report

The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Friendster Security Hole 8 Comments More | Login | Reply /

 Full
 Abbreviated
 Hidden
More | Login | Reply
Loading... please wait.
  • Through back-channels (Friendster is local), I learned that they have ~40 boxes running Tomcat, and that they have substantial performance problems in-and-around data replication.

    • Re:Friendster (Score:3, Interesting)

      by Ovid (2709)

      Well, I must say that I hope they get these issues ironed out. It's long been known that we can't predict the long-term effects of the 'Net and I think experiments like Friendster are exactly the sort of thing that I like to see while we try and flesh out the new future of communication. I would love to see them succeed.

    • Interesting. The was down when I made my post. It's back up and now the password is no longer being sent. Curious timing, but I'm happy to see this :)

  • Which also stores usernames and passwords in plain text in a cookie? Well, obfuscated, at least as much as basic-auth is...

    Quite shocked me when I looked closely at my slashdot / use.perl cookies.

    -Dom

    • I post it to use.perl.org for the same reason others post post plenty of other non-Perl things here: it interests me.

      The comment about the use.perl cookie was interesting. I had suspicions about the cookie, but never looked at it that closely. If you really want fun, though, take a look at the full headers. You'll see things like: X-Bender: My full name is Bender Bending Rodriguez. and X-Fry: Hey look, it's that guy you are! .

    • FWIW: No usernames are stored, the user IDs are. And the MD5 hash of the password, not plaintext, is stored, which can be used to log in if you also have the user ID. Also, there is an option in your password prefs to not store the cookie information.

      And you can always click "Logout" to delete your cookie, too.

      As to the proper deleting of a cookie: setting the expiration date is the recommended method. In this Netscape doc [netscape.com], for example, it says: If a CGI script wishes to delete a cookie, it can do so b
Stories, comments, journals, and other submissions on use Perl; are Copyright 1998-2006, their respective owners.