Comment by seqizz

7 months ago

I'm also not a lawyer, but wouldn't they dismiss this as a sabotage if the requester is not legally forced to request it in the first place?

4 comments

seqizz

Reply
echoangle  7 months ago

No, why would they? If I voluntarily request your website, you can’t just reply with a virus that wipes my harddrive. Even though I had the option to not send the request. I didn’t know that you were going to sabotage me before I made the request.

  • seqizz  7 months ago

    Because you requested it? There is no agreement on what or how to serve things, other than standards (your browser expects a valid document on the other side etc).

    I just assumed court might say there is a difference between you requesting all guess-able endpoints and find 1 endpoint which will harm your computer (while there was _zero_ reason for you to access that page) and someone putting zipbomb into index.html to intentionally harm everyone.

    • echoangle  7 months ago

      So serving a document exploiting a browser zero day for RCE under a URL that’s discoverable by crawling (because another page links to it) with the intent to harm the client (by deleting local files for example) would be legitimate because the client made a request? That’s ridiculous.

      1 reply →