http://simonwillison.net/2009-11-26T12:52:16+00:00Simon Willison2009-11-26T12:52:16+00:002009-11-26T12:52:16+00:00https://simonwillison.net/2009/Nov/26/flxhr/

<p><strong><a href="http://flxhr.flensed.com/">flXHR</a></strong></p> I was looking for something like this recently, glad to see it exists. flXHR is a drop-in replacement for regular XMLHttpRequest which uses an invisible Flash shim to allow cross-domain calls to be made, taking advantage of the Flash crossdomain.xml security model. <p>Tags: <a href="https://simonwillison.net/tags/ajax">ajax</a>, <a href="https://simonwillison.net/tags/crossdomain">crossdomain</a>, <a href="https://simonwillison.net/tags/flash">flash</a>, <a href="https://simonwillison.net/tags/flxhr">flxhr</a>, <a href="https://simonwillison.net/tags/javascript">javascript</a>, <a href="https://simonwillison.net/tags/swf">swf</a>, <a href="https://simonwillison.net/tags/xhr">xhr</a>, <a href="https://simonwillison.net/tags/xmlhttprequest">xmlhttprequest</a></p>

2009-11-05T09:47:49+00:002009-11-05T09:47:49+00:00https://simonwillison.net/2009/Nov/5/crossdomain/

<p><strong><a href="http://www.yvoschaap.com/index.php/weblog/facebook_myspace_accounts_hijacked/">Facebook and MySpace security: backdoor wide open, millions of accounts exploitable</a></strong></p> Amazingly, both services had wide open holes in their crossdomain.xml files. Facebook were serving allow-access-from-domain=“*” in the crossdomain.xml file on one of their subdomains (a subdomain that still had access to the user’s profile information) while MySpace were opting in farm.sproutbuilder.com, a service which allowed anyone to upload arbitrary SWF files. <p><small></small>Via <a href="http://www.techcrunch.com/2009/11/05/massive-facebook-and-myspace-flash-vulnerability-exposes-user-data/">TechCrunch</a></small></p> <p>Tags: <a href="https://simonwillison.net/tags/crossdomainxml">crossdomainxml</a>, <a href="https://simonwillison.net/tags/facebook">facebook</a>, <a href="https://simonwillison.net/tags/flash">flash</a>, <a href="https://simonwillison.net/tags/myspace">myspace</a>, <a href="https://simonwillison.net/tags/security">security</a>, <a href="https://simonwillison.net/tags/swf">swf</a></p>

2008-05-01T09:43:04+00:002008-05-01T09:43:04+00:00https://simonwillison.net/2008/May/1/adobe/

<p><strong><a href="http://www.adobe.com/aboutadobe/pressroom/pressreleases/200804/050108AdobeOSP.html">Adobe and Industry Leaders Establish Open Screen Project</a></strong></p> Talk about burying the lede... the real story is that Adobe are going to drop the license restriction that prevents other people from implementing SWF players. They’re also publishing the AMF and Flash Cast protocols and removing licensing fees for Flash Player on devices. <p><small></small>Via <a href="http://reddit.com/r/programming/info/6hrb0/comments/">programming.reddit.com</a></small></p> <p>Tags: <a href="https://simonwillison.net/tags/adobe">adobe</a>, <a href="https://simonwillison.net/tags/amf">amf</a>, <a href="https://simonwillison.net/tags/flash">flash</a>, <a href="https://simonwillison.net/tags/flashcast">flashcast</a>, <a href="https://simonwillison.net/tags/swf">swf</a></p>

2006-07-17T18:04:53+00:002006-07-17T18:04:53+00:00https://simonwillison.net/2006/Jul/17/myspace/

<p><strong><a href="http://kinematictheory.phpnet.us/">How the myspace SWF hack worked</a></strong></p> If Flash is a vector for XSS, is this the end of Flash badges? <p>Tags: <a href="https://simonwillison.net/tags/flash">flash</a>, <a href="https://simonwillison.net/tags/myspace">myspace</a>, <a href="https://simonwillison.net/tags/swf">swf</a>, <a href="https://simonwillison.net/tags/xss">xss</a></p>