355

Tesseract dev injects malicious code into browser to illegally DDOS the dbzer0 instance (quokk.au)

submitted 4 hours ago by Quokka@quokk.au to c/fediverse@lemmy.world

111 comments fedilink hide all child comments

As part of the devs farewell message on their site, they have included malicious code to make each visitor sends 2,000 requests to the dbzer0 servers in an attempt to DDOS and take the instance offline.

you are viewing a single comment's thread
view the rest of the comments

[-] victorz@lemmy.world 9 points 2 hours ago

Expert dev. Doesn't even know the attribute for setting the language in the script tag is type, not lang. Not to mention that you are encouraged to omit the attribute altogether if the script tag contains JavaScript...

Petty, and a bad dev. Big yikes.

[-] Dojan@pawb.social 1 points 25 minutes ago

The random strikes me as curious too. I don't see the point in doing (100 - 1 + 1), you could express a random number between 1 and 100 in a simpler manner. Then he gets another random number and reuses that three times, for whatever reason.

Then again, none of his other decisions make much sense to me so why would this?

[-] Muehe@lemmy.ml 3 points 1 hour ago

Well the script tag has a deprecated attribute called language, so in older code and media you will see <script language="javascript"> a bunch. The weird thing is they instead used the lang attribute which just doesn't exist.

[-] victorz@lemmy.world 1 points 1 hour ago

Uh huh. Exactly.

[-] Ftumch@lemmy.today 1 points 49 minutes ago

There used to be a language attribute, but I don't think I've ever seen lang before.

[-] grue@lemmy.world 5 points 2 hours ago* (last edited 40 minutes ago)

To be fair, it's not as if it supports languages other than fucking Javascript anyway, so it mostly doesn't matter.

Edit: I don't want to split hairs about modules or json or whatever; I just want to be salty about how we could've had Scheme or Python in the browser.

[-] victorz@lemmy.world 5 points 1 hour ago

The type attribute is not only to specify the language. It's like one case out of several. It definitely matters in those contexts where you want to do the other things you can do with the type attribute.