‹ BackHN Continuity

Thread

Sourcehut account takeover via build logs (XSS in ansi2html)

153 points · 29 comments · arusekk

  1. kgraves · · focus · HN ↗
    Congrats on the write up, seems extremely serious, I hope Sourcehut and Drew paid you well for this.
    1. arusekk · · focus · HN ↗
      I hope they will one day. I said I'm fine with verbal credit if they don't have money, so I won't nag them unless I end up finding more.
      1. kgraves · · focus · HN ↗
        > I hope they will one day. I said I'm fine with verbal credit if they don't have money,

        This is quite disappointing, but I guess it is your choice.

        1. rendaw · · focus · HN ↗
          What's disappointing? I feel like I missed something.
          1. arusekk · · focus · HN ↗
            I presume kgraves meant something along either lack of compensation being unfair to me, or me spoiling the market by being sort of fine with it, or both. It's a valid opinion to have.
      2. spyc · · focus · HN ↗
        A free-for-life &quot;Professional hackers&quot; package (<a href="https:&#x2F;&#x2F;sourcehut.org&#x2F;pricing&#x2F;" rel="nofollow">https:&#x2F;&#x2F;sourcehut.org&#x2F;pricing&#x2F;) would be the minimum compensation in my eyes.
Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.