J
Josh Simmons
joshcsimmons.com · Personal blog · on HN since 2019
Josh Simmons writes about quitting Shopify, meditation, social media breaks, and blockchain, and runs a blog where each post is stored in its URL.
What HN saysHN discusses the stateless blog design, where posts live in the URL, and a commenter reports it is vulnerable to XSS.
18HN people shared it
14linked it in comments
11stories submitted
1.2Kstory points
3 years agolast shared
2019people per year2026
Most-shared posts
- 1
- 2I Quit Shopify After Five Months2 people · 297 points · first shared 2022 · 325 comments on HN
- 3What I Learned from 1000 Days of Meditation2 people · 6 points · first shared 2019 · discussion on HN
- 4I Quit Social Media for a Year1 people · 509 points · first shared 2019 · 360 comments on HN
- 5Not everyone should meditate1 people · 231 points · first shared 2022 · 325 comments on HN
- 6Using Goatse to Stop App Theft1 people · 132 points · first shared 2023 · 80 comments on HN
- 7I Went to a “Dangerous Alt-Right Rally”1 people · 35 points · first shared 2022 · 40 comments on HN
- 8On the Absurdity of Blockchain Development1 people · 5 points · first shared 2022 · discussion on HN
- 9I hope Web3 doesn't become Web 2.11 people · 4 points · first shared 2021 · discussion on HN
- 10Optimizing Slack1 people · 2 points · first shared 2022 · discussion on HN
- 11Node People vs. Edge People1 people · 2 points · first shared 2024 · discussion on HN
- 12Some Thoughts on Apple/Google's Contact Tracing Technology1 people · 1 points · first shared 2020 · discussion on HN
- 13F4xqTUOUXjWX32eVcyeAAAA1 people · first shared 2023
- 14Xytbdgek4So8AG3c2TaKevI6zaJrL9 w9VP IhB4rpmgynIN4bacCjlz8AAAA=1 people · first shared 2023
- 15
What HN people wrote when they linked it
pwdisswordfishc · 2023-10-19
> 1) compromise some site to serve arbitrary JS 2) have it serve simple JS that requests other JS that contains the real malicious payload.
So… https://joshcsimmons.com?
3guk · 2023-10-18
It's explained on this page about how his blogging system works -…
generalizations · 2023-10-17
> Anything can be generated here. You could even host your own blog that uses my website as a renderer if you really wanted to. It supports markdown.
> Every post that I want to publicly claim authorship of lives at the root of this site. If you are reading a post that I have claimed it will look like this page. Posts of unknown authorship have a disclaimer at the top of the…
gregsadetsky · 2023-10-17
hundchenkatze · 2023-10-17
NGRhodes · 2023-10-17
> This blog is now STATELESS. The entire post is contained in the URL that you are visiting now. All my "blog" is now is a hard-coded main page that contains links to posts I claim authorship of. Of course the entire post is contained in each of these…
hiatus · 2023-10-17
The author is aware.
> Every post that I want to publicly claim authorship of lives at the root of this site. If you are reading a post that I have claimed it will look like this page. Posts of unknown authorship have a disclaimer at the top of the…
iso8859-1 · 2023-10-17
This site allows anyone to inject content, you don't need an iframe.
https://joshcsimmons.com/post/eJyVlD2PgzAMhvf8Cm8HlcD76dSlf8OSYUCMnA4G…
Created using
wget "https://gist.githubusercontent.com/snipe/5512408/raw/db9f4051eeb1079de…
python3
>>> base64.b64encode(zlib.compress(b"<pre>" + open('gistfile1.txt', 'rb').read())).replace(b'/',b'%2F')
mortallywounded · 2023-10-17
https://joshcsimmons.com/post/H4sIAAAAAAAAAyXMQQrCMBCF4b2neOBCBWn3nkAX…
Doesn't need to release tools... gzip, base64 and uri encode uh huh.
Qub3d · 2022-02-08
+1 to this. I will grit my teeth and go through a leetcode/coderpad step (I get it, FizzBuzz and all that) but jumping straight to the technical stuff and not giving me the decency of talking to a human leaves the impression that I'm really just a code-producing machine for the org (Which for Amazon, I no doubt expect I would be).
As a recently posted article here said[0]: "My hunch with those companies was that it wouldn't have been a major issue if I was video-ing in from the State Penitentiary (due to murder charges) as long as I solved the algorithms correctly"
[0]:https://www.joshcsimmons.com/posts/why-i-quit-shopify
artur_makly · 2019-09-11
I'm sure the 1000 days of meditation he experimented with, had a lot more impact on his mind/body/soul than his Social fasting. But a blend of both for most I think would be ideal.
https://joshcsimmons.com/2019/05/21/meditaton-practice/
moviuro · 2023-10-17
See the explanation on the blog itself [0]
[0]…
jbarrs · 2023-10-17
>Posts of unknown authorship have a disclaimer at the top of the page.
Problem is, the posts can contain <script> elements. So it's easy to just write a little JavaScript that removes the disclaimer at the top. See this hastily-made, immature example of mine:
https://joshcsimmons.com/post/H4sIABO8LmUC/3VT0W7aQBB85yu2QVUSiZik6QMi…
As it stands, this really isn't the most secure system. Something much more malicious could be injected into this!