Directory traversal vulnerability in Etherpad lite

Etherpad lite is a great, node.js-based Etherpad clone. Unfortunately, the code base is young and thus the bugs are fresh and evil. Read more…

Partial function application in JavaScript

Some time ago, I introduced Andi to what he called »Advanced magic«: A JavaScript function which binds another function to its parameters without actually executing itRead more…

Why federation needs a browser-wide user resource registry

While sketching out a concept for a certain federated service, I stumbled across a technical problem which badly hurts federated services in comparison to centralized services. I’m gonna explain the problem using the example of (Facebook’s) Like button and show some possible solutions. Read more…

PHP execution vulnerability in DokuWiki

Some days ago, a new security problem in DokuWiki got reported. It allows – assuming certain web server configurations – PHP1) file execution for users permitted to create pages2). Read more…

1) This probably applies to other languages interpreted by the web server as well.
2) Under some circumstances I’ll describe, even the right to edit suffices.

Encrypt an existing Debian GNU/Linux installation with LUKS

In the following text I‘ll provide an up-to-date description of how to setup a completely encrypted Debian, using the unstable Debian distribution from August 2010. Read more…

The charset attribute of script elements

While setting up this site I saw a HTML 5 validator warning about »Required attributes missing on element script.« Read more…

 
Recent articles RSS feed Donate Powered by PHP Valid XHTML 1.0 Valid CSS Run by Debian Driven by DokuWiki