This GitHub CSS Exploit Is WILD 

Trash RU-vidr, disliked can't unsubscribe since never was subscribed

And with further ado, ...

yeah, he can be a mumbler sometimes... 😅😂

​Yappatron 🥱cool exploit but I'd rather watch skibidi toilet and jork my pingasss

Heck of a comment! 😂👍

at that point visitor counters through loading images through the markdown image syntax would work the same, after that, css injecting has been introduced as an official feature on codepen for years and it's not been even used for exploiting, cors can secure this enough

GitHub has an image proxy though, so your image would only be requested once (by the proxy)

Emm if you can inject css you can inject url in background and these urls could have javascript executing. it's crazy.

​@@justafreak15able No, you can't because of CORS.

No.

​@@justafreak15able Just block all non-GitHub links and limit the GitHub links to images or something.

@@Kane0123yes*

the github markdown is pretty strict but you can still make some cool stuff with it

@@hidoryy You can always load svgs, but styling the whole page is so cool :D

based yacine

like rolling up to the police, reporting a crime with solid evidence and being put into jail for it 🤣

That breakdown is terrible too. It starts explaining the basics of basics like we are 5 instead of github users, and then when it comes to the meat, it takes escaping and context for granted.

@@someman7 this isn't an educational video, they wouldn't go so far as to explain what escaping means and even if they did, it'd serve little purpose as it isn't necessary to understand what happened here (maybe not _why_ it happened but that's different). Also, posting in on twitter gives it very fast exposure leading to relevant people taking notice of it. Sure, there are better ways to achieve that if you have the means but generally big companies like these rarely take reports from your average joe seriously so the only way to get them to understand the severity is to see people playing around with it, it wasn't something hazardously exploitable anyway so it wouldn't have snowballed into something terrible

@@javierflores09 Why start with the utmost basics then? But I'm pretty sure this whole channel is edutainment. Posting on twitter is irresponsible. Anything that doesn't afford enough time for the fix to be develop before the exploit is. This one was a miss from Theo, if you ask me.

You're setting styles on the page. You're not changing the whole site, but the server is sending the the bad code to the client.

This was explained pretty well in the vod but... you know what CSS is, right? Usually, when you inspect a page, it'll have somewhere at the top. That's what changes how things look. People found an exploit to basically insert those things through GitHub profile READMEs. Through a specific LaTeX (language for writing math stuff, think of typing "x^2" and it gives you an image of x with a small 2 at the top) command that utilized CSS styles, people were able to exploit it to use their own custom CSS instead.

GitHub sends you a bunch of code. Inside the code, there is a section of your custom text, and a section of their styles. Your computer reads the styles section, put the custom text in, and renders it. Someone found a way to write a custom text to jump out of that section and change the style which the client computer promptly reads and renders

great, YT apparently just auto-deleted my comment once again. quick definitions: CSS changes how elements on the page look. LaTeX is a way to write math ("x^2" becomes an image of x squared). People found an exploit through a specific LaTeX command that utilizes CSS, and exploited it to use user-created CSS instead.

Simply put, the difference between inspect element (or any other client side CSS changes) and this, is that the server sends the page to the client (browser) to render, so anyone visiting an affected page will see it, unlike client side CSS changes which only you would see.

This is so it can be chopped up into short which are cross-posted to insta and tiktok.

@@borstenpinsel how many links are in his bio?

still don't understand why people put video specific links in bio

No cringe allowed. Especially not weeb cringe.

spacehey

Agreed

smartest or too much free time, who's to say 🤷‍♂

is bro seriously getting mad at gigabrain teenagers for having fun?

You should have your account terminated. As you basically said "Stop being an asshole"

If all it takes for someones account to be terminated is being "assholes" then it should apply to you. How dare they visually show a harmless use of an exploit they found as a way to get github to do something about it. How dare they care about github security smh.

Found the snowflake

ahahahha wait you serious?

No,

Then it would be regulated by decision board not users

No.

But most of all, Samy is my hero.

Github-MySpace edition.

Yeah sounds like they asked chatgpt 3.5 to make it 'simpler to understand'

it was clearly ai generated

what was that LOL

They must have been trolling lol. That metaphor made it more confusing

Yeah it's incredible what lengths corpos go to to prevent user customization these days

​@@doyouwantsli9680 yes and no cause XSS attacks were also possible

Gotta prevent weeb degeneracy.

As he said it could be used to make scam pages so it wouldn't be good

....i had the same reaction. why was i called a tool for using latex T_T And its the easiest way to format pages and pages of matrices so far in my books. I don't know any alternate way that would look that good. T_T I wrote my Masters thesis for finite element method with it. I feel so personally attacked for all the wrong reasons lol

I’m always happy to blame Prime for things

Its been a while, but so far no other solution comes close to fomatting insane lines of matrices and equation as nicely as LaTeX does.

LaTeX is fantastic, I'm in Grade 12 and I don't know how any of my notes would make sense without it.

Speak for yourself. My github has a ton of stuff @Ober3550

They will monetize it.

People *want* custom profiles, but that doesn't mean they *need* custom profiles.