Welcome to /c/SoftwareGore!
This is a community where you can poke fun at nasty software. This community is your go-to destination to look at the most cringe-worthy and facepalm-inducing moments of software gone wrong. Whether it's a user interface that defies all logic, a crash that leaves you in disbelief, silly bugs or glitches that make you go crazy, or an error message that feels like it was written by an unpaid intern, this is the place to see them all!
Remember to read the rules before you make a post or comment!
Community Rules - Click to expand
These rules are subject to change at any time with or without prior notice. (last updated: 7th December 2023 - Introduction of Rule 11 with one sub-rule prohibiting posting of AI content)
You should also check out these awesome communities!
If spammers can abuse something, they gonna abuse it
I mean, allowing arbitrary characters in the name is one thing. I think I would do that as well, as there are many weird names out there.
But then actually parsing it out (or not escaping it properly), that's the real sin.
Might be the mail client being helpful and going "hey! Thats a URL. Let me make it a link"
At the very least remove slashes and periods from the name...
URLs as a person name
What do you mean?
Somebody created an account at MyEpson with OP's email address and the name "GET BITCOIN NOW link", which sends a confirmation email to OP with that name. Basically it's spam using Epson as a trojan horse to get past filters.
Did only a few of us miss this? Seems like it could have been explained better up front.
I only got it because there was another article about it earlier.
Oh I see. Interesting...
If it doesn't exclude a URL it likely doesn't block SQL either.
Time for the ol XKCD Little Bobby Tables attack
These days you have to actively work against whatever framework you are using to get SQL injection to work.
That's not how this works.
You have a database driver that takes care of communicating with the database.
In the bad old days (pre-early 2000s) the only way they knew how to do that was plain old SQL strings so you passed a string that contained both the data and the instructions on what to do with it.
Now you SHOULD be writing prepared statements that contain the instructions then passing the data separately to fill in the placeholders in the prepared statement via the driver (NOT via modifying the string).
// DO NOT DO THIS
execute("INSERT INTO foo VALUES ('a', 'b', 'c')")
vs
// DO THIS
executePrepared("INSERT INTO foo VALUES (?,?,?)", "a", "b", "c")
And yet injection is still #3 in the OWASP Top 10
Okay?
You make it sound as if it's a thing of the past when it is still a common problem.
It's a common problem for the same reason that it's a common problem for people to have precision errors when doing math with currencies... People write the wrong code because they don't know any better (in that case using float or double/floating point math instead of a BigDecimal type).
Not filtering out characters that could be part of URL has no bearing on whether or not the site is properly protected from SQL injection. I'm much more often worried about sites that explicitly filter out certain characters because it likely means they don't understand what they're doing (similar to sites that insist on annual password changes).
The fact that people are arguing about this shows how much of an issue we have with education on this topic.
Please explain how you remain confident of that "SHOULD" when they are not sanitizing the HTML out?
Because it's literally impossible for SQL injection to occur if you do this. The database has already compiled the operation. There's nothing to escape, there's no more logic that can be added, you're free to insert arbitrary gook just like you can into any old array.
"if" caring a lot of water on this here frog's back mr. scorpion.
I mean, give folk a few years and it'll be something to add to the "you can't assume X about a name field" list.
but even in the early 2000s nobody called their kid zombo.com
Something I just thought about for the first time: the sheer amount of spam content everywhere (website comments, mails, bots) seems to indicate that there must be ungodly amounts of money being made but I rarely see politicians actually talk about the topic and doing something against it.
Can anyone confirm/explain?
It's cheap easy to do, requires very little actual work , and it returns some profit.
It doesn't make a lot of money but it's more than no money at all so it is worth doing.
One of the major issues with creating legislation to block spam emails (and spam phone calls) is that it would also impact the fundraising capabilities of political parties.
Politicians don't talk about spam, because politicians use spam to raise money money for their campaigns.
Right. The rules are different in the US. Where I live, they dont/cant do that.
Scammers exist because scams work enough to be generally profitable :(
I'm not 100% sure what you're asking, but spam is generally a very low margin, very high volume kind of business. So I wouldn't assume these people are making ungodly amounts of money. I did a bit of searching and found estimates on the order of $200 million per year for spammers and spam-advertised businesses combined. Sure, it's not nothing. But on a global scale that's not necessarily ungodly amounts.
Compare for example revenues in the illegal drug trade, which globally accounts for hundreds of billions of dollars yearly.
this is how the website in question looks like btw
lol there's a whole show with crappy gifs if you continue
I guess they need a deposit of like $100 as "inactivity fee" in order to get those $64k
nope they want you to pay 6$ for "conversion fee" to convert btc to usd (probably going to ask for more and more until you give up or your wallet is drained)
the fake chat is fucking hilarious