If it's any consolation, "ikatako" is a word that's just "squid" and "octopus" stuck together (ika / tako).

I... What.

This can't be a troll. Has anyone *seen* opensourceg.com? Not even /b/ has this much free time.

And yet they promote it as if it's still theirs?
http://fox8.tv/shows/futurama

I am very confused.

(... I am also very confused that my first attempt at commenting showed up attached to a different parent. Err.)

And yet they promote it as if it's still theirs?

http://fox8.tv/shows/futurama

I am very confused.

The powertoy one is pretty terrible, falls over, loses windows, etc.
I thoroughly recommend using VirtuaWin instead.

(I'm currently stuck with Windows at work, and it does most things GNOME virtual desktops can do.)

There's at least one (ie. the Australian Christian Lobby).

Mark Newtown and Stilgherrian are good sources of info if you want to see what's happened in the last 24 hours.

Whimsy.

Holy shit. How did you get my password?

Steve Gibson, is that you?

Mod +1, Depressingly Accurate.

I would love to refactor chunks of the systems I maintain, but when you're given a specific bug to fix and an hour to fix it in, it gets very hard to make more than superficial changes and do small amounts of tidying up.

Wait. One of us must be missing something.
For the purposes of the below, I'm excluding the JIFAR-alike vulnerability where a SWF looks like a valid JPEG; this is just regarding the renamed-SWF mentioned in the article:

Say we have two sites, one that the user is logged into (facenovel.com), and the attacker's site (mal.com).
An attacker uploads a malicious SWF (containing a javascript call that steals the cookie or what have you), except uploads it as nasty.jpg to facenovel.com to get around simple file-extension filtering.

• Accessing the file directly (facenovel.com/uploads/nasty.jpg) doesn't run it as a flash movie, it just gets interpreted as a stuffed JPEG.
• As per the above, I instead have an HTML page hosted on mal.com that embeds facenovel.com/uploads/nasty.jpg and forces a content-type of "application-x-shockwave-flash".
  The javascript does not run; it does not have permission to access anything.

I can't think of a case where a simple rename presents a vulnerability (without the previously-mentioned JIFAR-like hackery).
Help please. :S
 

Oh.
Holy shit.

(Thank you. :-) )

Also, from the article:

This is what I don't get: I understand that if a JPG is also a SWF (as per GIFAR and other manglements), it'll fool the browser into loading the content as flash.

Simply chucking a SWF on a server, renaming it to foobar.jpg, and visiting it at http://example/foobar.jpg doesn't load it as flash. Unless I'm really missing something here, I don't see how you can get the JPG to run as flash without also mucking around with content-type headers.

Can someone enlighten me, please? :-)

(Please.)

From the site:

UPDATE 10/20/09 5:45pm Pacific Time: It appears the files were NOT VANDALIZED and will open in MS-SQL Server 2005. It also appears they did redact "code" to some degree. I'm still not clear on why there are thousands of lines of source code still left in there. I'm working on scoring a copy of SQL Server 2005 ASAP so I can look for myself. Check the discussion areas to follow along in realtime.

Interesting.