Responsible Disclosure: XSS in Macmillan's Website


Screenshot of the Macmillan website. The search box has some HTML in it - the page now looks like it says "Please enter your credit card details" with a big submit button.

Another day, another unfiltered reflection of user-supplied content! You know how this goes by now. You type into a search box <em>test and the whole page suddenly turns italic. Luckily, the Macmillan Publishers' website filtered out any <script> elements it encountered. But that still leaves the attacker with the ability to draw SVGs over the page or, more maliciously, start harvesting usernames, passwords, and credit card details from unwary visitors. Here's a quick example of what an…

Continue reading →

The point of a dashboard isn't to use a dashboard


Colourful graphs and charts. Image by Yvette W from Pixabay.

Every so often, an employer asks me to help make a dashboard. Usually, this causes technologists to roll their eyes. They have a vision of a CEO grandly staring at a giant projection screen, watching the pretty graphs go up and down, and making real-time decisions about Serious Business. Ugh! What a waste of time! The thing is - that's not what a dashboard is for. And that's generally not why a CEO wants it. A dashboard shows that you have access to your data. And that is a huge deal. If…

Continue reading →

Book Review: Animal, Vegetable, Criminal - Mary Roach


Book cover featuring a grizzly bear in front of a police line up.

The book starts by referencing one of my favourite book - The Criminal Prosecution and Capital Punishment of Animals. That book looks at the history of criminal trials of animals and gets in to the philosophy about whether a flock of geese can be considered liable for the damage they cause. It is a deeply weird, but totally enlightening book. This book is a bit more of a roving travelogue. Roach meanders through half-a-dozen countries talking to the people who suffer from "criminal" animals,…

Continue reading →

Book Review: The Historian - Elizabeth Kostova


A blood-stained book cover.

This is a massive tome. Or do I mean tomb…? What if you discovered that your widower-father was not a mild-mannered historian but, instead… A VAMPIRE HUNTER! The caper takes us all over Europe - a veritable travelogue of bustling capitals and dusty backwaters. It holds itself ever-so seriously - occasionally dropping into the meta-narrative of fictional vampires - but always treating the gothic horror with the respect the genre deserves. Genuinely creepy - without being gory and sup…

Continue reading →

Game Review: Stray (PS4)


Box art showing a ginger cat.

The philosopher Thomas Nagel wrote "What Is It Like to Be a Bat?" and attempted to show that we can never really understand another living creature's consciousness. I had hoped that Stray would answer the question "What is it like to be a cat?" But it doesn't. Frankly, it doesn't even try. It feels like the developers lost the courage of their convictions. Cats can see in the dark - but your avatar has to use a torch! Cats can follow scents - yet that's left unexplored. Cats are expert…

Continue reading →

DNS Esoterica: BIMI - SVG in DNS TXT WTF?!


Screenshot of an email.

You've been on the Internet a long time, right? Of course you know what BIMI is. All the cool kids do. But, for those of you who aren't hip to the jive of the Infobahn... BIMI (Brand Indicators for Message Identification) is a new standard that can curb the issue of online impersonators. ... BIMI is a new standard that enables you to include your company’s logo alongside the emails you send. That way, your brand stands out among other emails, and your customers are sure that the emails are l…

Continue reading →