Can anyone post the word 'description' without the system adding a dash into it?

no matter what I do, LG adds a '-' into the word description...

I need a better description of the problem.

Apparently I don't.

asdfdescriptionjkl

sc

escr

escriptio

escript

escrip

script

scrip

script it is

Something about that word in the auto page generation scripting?

'script'

So what's so special about the thread title?

This has to do with a problem from people writing scripts here, causing all sorts of trouble. Richard made a quick-fix to this problem, by simply making it impossible to write the word "script". This is done, as you all can see, by adding a dash between the "s" and "c" in the word "script".

SCRlPT?

scrıpt ?

description :-)

Rats - it worked in my profile :-)

Hey Aganju, you managed to enter that non-ascii i in there!

script works as well !

Whoever is interested, should be able to find out how I did it ;)

isometry , your works for me, even with its parameter

" allowS-criptAccess=always " in it ;)

This probably won't work, but let's try:

script

Emphasize the d e s c r i p t i o n

script?

:) I would filter all html. Filtering "script" doesn't help much.

Just a hint:

< i m g s r c = "...." o n l o a d = "alert(document.cookie) " >

I get the idea that JavaScript can't be made secure. That is, there's nothing the user can do, other than turning off JavaScript altogether that would limit JavaScript to a safe subset of what it's capable of.

By contrast, Java (a different language with a completely different implementation) was designed so that people could run applets in their browsers without danger. Unless the user grants permissions (and social engineering attacks may get them to do that), Java applets, no matter how malicious their authors' intent, can't do anything harmful. (Well, an infinite loop might suck up CPU cycles, but no stealing your bank passwords.)

In z's message using Chrome, I get a broken-link picture and a pop-up message saying there's a Javascritp vulnerability on www.littlegolem.net. Was that message written by z, or is it Chrome protecting me? (Or is it Richard protecting me? I don't think so, because I've never seen this site pop up a box like that.)

The "xss vulnerability" message is from z. z has implemented Arty Sandler's suggestion. Firefox's View Page Source shows that z posted

Of course with that src=, you're never going to get an image, and the onerror= gets activated.

script

Hey I think I can do it ;-)

description

The dirty solution:

descr	iption

description

if it works it is even more elegant description

MarleysGhost, java can be way more dangerous than javascript. In 99% javascript-based attacks will steal your account on some particular site. Java-based exploits can take over your machine and steal everything you have there.

@Arty: Well, that doesn't address what I want to know, which is what can I do, short of disabling JavaScript completely, to be safe from malicious JavaScripts?

I already refrain from granting any permissions to Java running in a browser.

well, you can use NoScript for FF for example or similar add-ons.

The problem with that is that a site itself may _require_ javascript. So you won't be able to use that site with blocked JS. And once you allow it, you are vulnerable to different kinds of JS attacks within that site. But, so you know, those JS attacks will be limited to that site. I.e. they can steal your account on that site but can't get your private info from your bank's site.

Anyhow, to conclude. JS attacks made via some site may steal your private info on that site only (unless someone exploits browser's vulnerabilities but that's another story). This is the least evil. Believe me, there are zillions of way worse kind attacks :)

P.S. grr, that "z" with his alert

I don't see anything in z's post, using Chrome on Mac. Tho' it does seem to be perpetually loading in the tab, there's no indication of anything in the status bar.