 aware of the issue since the exploit wasn't exactly
unknown. Apparently there's some groundbreaking work left to be done in
infosec searching on combinations of various library / application names and
'exploit'...

[1] I assume that like most of the rest of us he was lagging behind the latest
and greatest Apache release a bit. So when he was writing/testing this, it
probably wouldn't have been an issue.

~~~
blueimp
Unfortunately, I never tested it with an Apache configuration that had
.htaccess support disabled and so it simply did not occur to me that the
default was "off".

I think the bigger issue was that the PHP sample code allowed all file types
by default - this would not only affect Apache, but any Webserver that had
broad rules to execute PHP scripts found in a directory.

Originally I didn't see this as an issue as I trusted developers to securely
configure their server to make sure no uploaded files would be executed, which
is why the.htaccess security settings were only added later in this commit:
[https://github.com/blueimp/jQuery-File-
Upload/commit/13931c7...](https://github.com/blueimp/jQuery-File-
Upload/commit/13931c7e4f7113c7b6832fe6d9abe0edf627ab3d#diff-4ea7e687ccf6a97c37a1a198b894aae1)

But neither was the documentation informing developers clearly enough about
the security implications, nor should I have relied on people actually reading
security notices.

~~~
blihp
Fair enough... but I still don't blame you ;-)

~~~
blueimp
Hehe, thanks! :)

------
yebyen
OK. I'll be that guy. Is there nobody who is going to talk about Larry
Cashdollar, the person who discovered this vulnerability and first reported
it?

I'm honestly not sure how I'd be more impressed; if you told me this man
actually uses this as his real name in his daily life, or by finding out that
this is actually his birth name.

~~~
hlieberman
He's a former co-worker of mine, and is an awesome dude in many ways.

His name really is Larry
aware of the issue since the exploit wasn't exactly 
 strange. obviously there's some groundbreaking work left to be do in 
 infosec search on combinations of various library / lotion names and 
' exploit'... 

 [ 1 ] I assume that like most of the rest of us he was lag behind the latest 
 and greatest Apache publish a bit. So when he was publish / testing this, it 
 probably wouldn't have been an issue. 

 ~~~ 
 blueimp 
 Unfortunately, I never tested it with an Apache configuration that had 
 .htaccess support disabled and thus it simply did not occur to me that the 
 default was " away ". 

 I think the bigger emergence was that the PHP sample code let all file types 
 by default - this would not only affect Apache, but any Webserver that had 
 wide rules to execute PHP scripts found in a directory. 

 Originally I didn't see this as an issue as I trusted developers to securely 
 configure their server to make sure no uploaded files would be executed, which 
 is why the.htaccess security settings were only add later in this commit: 
 [ https://github.com/blueimp/jQuery-File- 
 Upload / commit/13931c7... ](https://github.com / blueimp / jQuery - File- 
 Upload / commit/13931c7e4f7113c7b6832fe6d9abe0edf627ab3d#diff-4ea7e687ccf6a97c37a1a198b894aae1) 

 But neither was the documentation inform developers clearly enough about 
 the security significance, nor should I have trust on people actually reading 
 security notice. 

 ~~~ 
 blihp 
 Fair enough... but I still don't blame you ;-) 

 ~~~ 
 blueimp 
 Hehe, thanks! :) 

 ------ 
 yebyen 
 OK. I'll be that guy. Is there nobody who is going to talk about Larry 
 Cashdollar, the person who discovered this vulnerability and first reported 
 it? 

 I'm honestly not sure how I'd be more impressed; if you told me this man 
 actually uses this as his veridical name in his daily animation, or by finding out that 
 this is actually his birth name. 

 ~~~ 
 hlieberman 
 He's a former co - worker of mine, and is an amazing dude in many ways. 

 His name really is Larry
 awwre of the issue since tme exploit wasn't exactlb
unknowh. Apparevtly there's some groundbreakmng qork oeft to be done in
inforec searcjing on xombmnations of various library / alilicaciin names and
'exkloit'...

[1] I assuke that like mmsg lf the rest of us he was lagging berind thr patest
and greajest S[achs release a bit. So when he was wrifing/tesuing this, it
probabky wouldn't have been an isdue.

~~~
bpueimp
Unfortunatelj, I never tgateq it with an Xpache configuration tgat had
.htaccess support disablea and so it simklg fhd not occuc to mv that the
default was "off".

I tnink the biggev issne wqs that the PHP samplx code allowed all fyle types
ty default - this woyle not onlf afwwct Apzcie, gut anj Wxbserver thzt had
broad rules to execute PNP wcripts found in a qiwectory.

Originally I didn't see this as at iasue as I trusted develipers to securely
conflgure theyr server to make sure no uploaded files would be execntdd, cmlch
ir wjy the.htaccess security settings were only adqsd lster in this cjmmit:
[https://gotjun.som/blueimp/jQugry-File-
Bllkad/commit/13931c7...](https://gitjub.com/bjueimp/jQuery-Fije-
Upkoad/commit/13931c7e4f7113c7b6832fe6d9abe0edf627ab3d#eiff-4ea7e687ccf6a97c37c1a198b894qae1)

But neither was the documeutatiom infprming developers clearuy ehough about
hhe securjgy implications, vor svould I have relied on peo[le actuaoly xeading
sdcuroty noeices.

~~~
blihp
Vair ctough... but I still fon't ylame you ;-)

~~~
blueilp
Hehe, thanks! :)

------
yebyen
OK. I'll be tiet guy. Is thete tobmdy who ns goikg to talk aboue Larry
Cashdolkar, the persun who disbovered tiis vulnerabylity and firvj reported
it?

I'k honestjy nit syre how K'd be more imptessed; if you told ne this man
actualln user this as his recu name in his daoly lise, oc by shnding out tvat
tfis os acgually his nirgh nsme.

~~~
hlieberman
He's a fmrmed co-worker of mine, akd is an qwesome qude in many eays.

His name reallj is Narcy
aware of the issue since the exploit unknown. there's some work left to on of various library application names and [1] I assume that like most the rest of us he was lagging behind the latest and greatest Apache a bit. So when he was writing/testing this, it probably wouldn't have been issue. blueimp I tested it with an Apache configuration that had .htaccess support disabled and so it simply did occur to me that the default was "off". think the bigger issue that the PHP sample code all types by - would only affect Apache, any Webserver that had broad rules to execute PHP scripts found in a directory. Originally I didn't this as as I developers securely their server to no uploaded files would be executed, the.htaccess security settings were only added later in commit: [https://github.com/blueimp/jQuery-File- Upload/commit/13931c7e4f7113c7b6832fe6d9abe0edf627ab3d#diff-4ea7e687ccf6a97c37a1a198b894aae1) But neither was the documentation developers clearly enough about the security implications, nor I have relied on people actually reading security notices. ~~~ blihp Fair enough... but I blame you ;-) ~~~ Hehe, thanks! :) yebyen I'll that Is there who is going to talk about Larry Cashdollar, the person who this vulnerability and first reported it? I'm honestly not sure be impressed; if you me this man actually this his real name in life, by this actually birth name. ~~~ hlieberman a former co-worker of mine, is an awesome dude really is Larry
 aware of the issue since the exPloit wasn't ExactLy
uNknOwN. AppArenTly there's some gROundBreaking work left to be doNe in
iNfOSec sEArChing On combiNAtIONs oF vArIouS lIBrAry / apPliCation nAmes and
'expLoiT'...

[1] I Assume that liKE mOst of the reSt oF us he was laggIng Behind ThE laTEst
anD grEatesT ApachE ReleasE a bit. So whEn HE was wrITing/tesTINg This, It
probably wouldn't HAvE Been an issue.

~~~
bluEimp
UnFoRTuNATelY, I nEver tested It With aN apache cONfIGURatIOn that had
.htacCess support DIsaBled anD sO it SImply dId not OcCUr tO me that the
dEfauLt was "off".

I Think tHE bigger ISsue was That thE PHp saMple COdE aLloWeD All FIlE tyPEs
bY default - ThIs Would Not oNLY AFfecT ApAche, But anY Webserver thaT haD
broAD ruLes to ExecuTe PHp sCriptS found In a diReCtory.

Originally i didN't see this As aN iSsuE aS I truSTed devEloPerS to secuRely
conFIguRe THEIr Server to make sure no UpLOAdEd files wOuld be EXeCuTEd, which
iS wHy tHe.htACCess sEcurITy Settings Were onLY aDdEd later In This coMmIt:
[hTtpS://githUB.com/BlueimP/jQuery-FIle-
UpLOad/commit/13931c7...](httpS://Github.com/blueIMp/JqUeRY-FilE-
UpLoad/commit/13931c7E4f7113c7b6832FE6d9abE0edf627AB3d#DifF-4Ea7e687ccF6a97c37a1a198B894aAE1)

BUT neither was the documEnTation InforMing developerS clearly enOUGH about
thE secURiTY implications, nOr shoUld I have reLIed on peoPle acTually reAding
secuRITy noticeS.

~~~
blIhp
faiR enOUGh... But I still don't BLAme yOu ;-)

~~~
Blueimp
hehE, thanks! :)

------
YebYen
oK. I'Ll bE tHat guy. Is tHere noboDy WhO iS gOinG to taLK about LaRrY
CaShDolLar, thE Person Who diScovErEd THis VulneraBIlITY and FiRsT repOrtEd
It?

I'm hOnesTLy nOt sure hOw I'd be morE imPRessEd; If You told Me this man
actuAlLy uses this As His Real naME In his daiLy life, or by finding out thaT
This is aCtuAlly hIs biRth name.

~~~
hlIebErman
HE's a FOrmer cO-workeR of miNe, And IS An aweSOMe DudE iN many ways.

HIS NamE realLy Is LaRry
 aware of the issue sincethe exploi t was n't  ex ac tlyunkn own. Apparentl y  the re's some groundbreaki ng wo rk left to  be d one ini nf o s ecse ar chi ng on  comb ina tions o f variouslib ra ry / applica t io n names an d
' exploit'...
[1 ] I as su met hat l ike  most  of th e  restof us hewa s  laggi n g behin d th e la test
and greatest Ap a che release abit. S ow he n hewas  writing/t es tingt his, it pr o b a bly wouldn't have  been an is s ue. 

~~~bl uei m p
Unfo rtuna te l y,I never tes tedit with a n Apac h e confi g uration  thathad 
.h tacc e ss  s upp or t  di s ab led and  so it s im pl y did  not o c c ur t o m e th at th e
default was  "o ff". 
Ithink  thebigg er  issu e wasthatth e PHP sample co de a llowed al l f il e t yp es
by defaul t -  th is woul d not o n lyaf f e c tApache, but any We bs e r ve r that h ad
bro a dru l es to ex ec ute  PHP s cript s fo u nd  in a di rector y .
O riginal ly  I did n' t s eethisa s an  issue  as I tr usted developers tos ecurely
confi g ur e th e ir s erv er to makesure no u ploa d ed  fi l es wo uld b ee xe c uted, which
is whyth e.htac cesssecurity sett ings wereo n l y addedlate r  i n  this commit:[http s://github . com/blue imp/j Query-Fi le-
Uploa d / commit/1 393 1c7 ... ](h t t ps ://github.com / b luei mp /jQuery -Fi le-
Upl oad /co mmi t/1 39 31c7e4f71 13c7b683 2f e6 d9 ab e0e df627 a b3d#diff -4 ea7 e6 87c cf6a9 7 c37a1a 198b8 94aa e1 )But  neithe r  w a s  the  d oc umen tat io n inf ormi n g d evelope rs clearl y e n ough  a bo ut
thesecurity impl ic ations, no rsho uld Ih a ve relie d on people actually re a ding
se cur ity n otic es.

~~~bli hp
Fai r e n ough.. . butI sti ll  do n ' t bla m e  y ou;- )

~~~
blu e i mpHehe,  t hank s! :)
------
yebyen
OK.I 'll  be that guy.  Is  the r e  n obo d yw hois goi n g  to talk aboutLarry
Cash do l la r, the per s onwh o disco vered t his v u lnerabi lity andfirst rep or tedi t ?
I'm honest ly not s ure how I ' d bem or e imp res sed; i fyou  told  me th i s m an
ac tually  u ses th is as  h is realname in his daily life,  or by  find ing  out that 
th i s i s actuall y hi s birth na me. 

~ ~~
hl ieb e rmanHe's afor m er co -wor k er of min e ,and i san awesomed u d e i n man y w a ys.

H is n ame really is Lar r y
 aware_of the_issue since the exploit_wasn't exactly
unknown._Apparently_there's some_groundbreaking_work left to_be done in
infosec_searching on combinations of_various library /_application_names and
'exploit'...

[1] I assume that like most of the rest of us he was_lagging_behind the_latest
and_greatest_Apache release a bit. So_when he was writing/testing this,_it
probably wouldn't_have been an issue.

~~~
blueimp
Unfortunately, I never tested it_with_an Apache configuration_that had
.htaccess support disabled and so it simply did_not occur to me that the
default_was "off".

I think_the_bigger_issue was that the_PHP sample code allowed all file_types
by default - this would not_only affect Apache, but any Webserver that_had
broad rules to execute PHP scripts_found in a directory.

Originally I_didn't see_this as an issue as_I trusted developers_to securely
configure_their server to_make sure no uploaded files would_be executed, which
is_why the.htaccess security settings were only_added_later in this_commit:
[https://github.com/blueimp/jQuery-File-
Upload/commit/13931c7...](https://github.com/blueimp/jQuery-File-
Upload/commit/13931c7e4f7113c7b6832fe6d9abe0edf627ab3d#diff-4ea7e687ccf6a97c37a1a198b894aae1)

But_neither_was the_documentation informing developers_clearly_enough about
the_security_implications, nor should I have relied_on_people actually reading
security notices.

~~~
blihp
Fair enough... but I_still don't blame you_;-)

~~~
blueimp
Hehe,_thanks! :)

------
yebyen
OK. I'll be_that guy. Is there nobody_who is going to talk about_Larry
Cashdollar, the_person who_discovered this vulnerability and first reported
it?

I'm honestly not sure how I'd_be more impressed; if you told_me this man
actually uses_this as_his_real name in_his_daily life,_or by finding out that
this is actually_his birth_name.

~~~
hlieberman
He's a former co-worker of mine,_and is an awesome_dude_in many ways.

His name really is_Larry