On Fri, Jan 30, 2015 at 12:11 PM, Jackmcbarn <jackmcb...@gmail.com> wrote:
> On Fri, Jan 30, 2015 at 2:02 PM, Brion Vibber <bvib...@wikimedia.org> > wrote: > > > On Thu, Jan 29, 2015 at 5:38 PM, Brad Jorsch (Anomie) < > > bjor...@wikimedia.org > > > wrote: > > > > > On Thu, Jan 29, 2015 at 2:47 PM, Arlo Breault <abrea...@wikimedia.org> > > > wrote: > > > > https://gerrit.wikimedia.org/r/#/c/181519/ > > > > > > > > > > To clarify, the possible solutions seem to be: > > > > > > 1. Unstrip the marker and then encode the content. This is a security > > hole > > > (T73167) > > > > > > > I'd be inclined to unstrip the marker *and squash HTML to plaintext*, > then > > encode the plaintext... > > > > I don't see how that addresses the security issue. > Rollback tokens in the Special:Contributions HTML would then not be available in the squashed text that got encoded. Thus it could not be extracted and used in the timing attack. -- brion _______________________________________________ Wikitech-l mailing list Wikitech-l@lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikitech-l
