IBGerm

IDG News Service – Social networking sites MySpace and Facebook have apparently fixed coding errors that could have allowed an attacker access to all of their users’ data and photos.

The simple coding errors are alarming considering the extent to which social networks have gone to reassure their users that their data will be safe. The problem involved the way the sites handle requests for data from other domains, known as the "cross-domain policy."

Sites such as MySpace and Facebook typically block other domains from requesting and receiving data for privacy reasons, except for their own vetted  subdomains.

Facebook disallowed access from other applications on its main domain, but a developer in the Netherlands, Yvo Schaap, found that Facebook would allow data to be given out from one of its subdomains. 

Since the subdomain also hosted all of Facebook’s data, it would be possible to steal data by luring a victim to a URL with a Flash application rigged to grab the data if the victim had their auto-login enabled, which most people do, according to Schaap’s blog.

A "more invasive and hidden exploit could harvest all the user’s personal photos, data and messages to a central server without any trace, and there is no reason why this wouldn’t be happening already with both Facebook and MySpace data," Schaap wrote on his blog.

He also found the problem on MySpace, which allowed a domain called "farm.sproutbuilder.com" to access data. A Flash application could be uploaded to that site, which would then be allowed access to the data if a victim visited a malicious URL.

MySpace disagreed with the severity of the error, saying it would have only exposed information that was already public. The problem was with the sproutbuilder domain, and it has since been fixed, a spokeswoman said in an e-mailed statement.

"No public MySpace data was exposed and the vulnerability was never exploited," the statement read.

A look at Facebook’s latest crossdomain.xml file shows that the bug appears to have been fixed. MySpace also appears to have taken "farm.sproutbuilder.com" out of its cross-domain list.

In an e-mailed statement, Facebook said it "worked with the researcher who identified this issue to fix it. We have not received any reports that it was ever exploited."

TAMPA, Florida —  A Florida man born without arms says a Tampa bank would not let him cash a check because he couldn’t provide a thumbprint.

It was supposed to be a quick stop at the Bank of America.

"I said, ‘I’m going to run over downtown on my break, cash the check and bring the cash back.’ No big deal," Steve Valdez said. "It turned out to be a very big deal."

Valdez said he was cashing a check from his wife, who has an account at Bank of America. But the teller told Valdez she needed a thumbprint in order to cash it — it was company policy.

It’s not that Valdez didn’t want to provide it. He couldn’t provide it, and  the teller even acknowledged it.

"’It’s obvious that you can’t give us a thumbprint.’ She goes, ‘Let me go check with my supervisor,’" Valdez recalled the teller told him.

Valdez was born without arms and wears prosthetic devices. While at the bank, Valdez said he provided two photo IDs. And still that wasn’t enough. The bank supervisor offered him two options.

"One is, you can bring your wife with you. And the other one, you can open up an account with us. And I said, no, I don’t think so," Valdez added.

Valdez said he reminded bank officials the American for Disabilities Act would have a problem with their unfair treatment, but that didn’t seem to bother them.

"You do realize this is in violation of federal law and really you haven’t heard the end of it," Valdez said. "And she goes, ‘Whatever.’"

They never let Valdez cash his check, but he said days later he received a phone call from a bank regional manager with an apology.

Bank of America spokeswoman Nicole Nastacie says the bank should have "offered alternative requirements if an individual is not able to give a thumbprint."

Valdez had a message for them too:

"They need to alter their policies and procedures, or have alternate plans should something conflict with that."

 

You would think with all the money that the government gave out, they might be a little nicer.

source: Fox news

I cant believe what I just learned. A New York City teen, more specifically a Staten Island teen fell down a uncovered manhole to a sewer line while texting. She and her family are planning on sueing? What the heck.

The teen fell down and only suffered some minor scrapes on her arms back after she dropped into the man-hole on Victory Boulevard. "It was four or five feet, it  was very painful. I kind of crawled out and the DEP guys came running and helped me," Longueria told the Staten Island Advance.. "They were just, like, ‘I’m sorry! I’m sorry!" "Oh my God, it was putrid," she said. "One of her sneakers is still down there"

"We regret that this happened and wish the young woman a speedy recovery," DEP spokeswoman Mercedes Padilla said in a statement. She added that crews were flushing a high-pressure sewer line at the time. Sewer line workers are supposed to cut off pedestrian access to work sites or at least mark them with warning signs.

The family said they will file a lawsuit — for what, though, is not immediately clear. Her mother, Kim Longueira, said it doesn’t matter that her daughter was walking and texting, and also, the ‘gross’ factor that can’t be ignored.

Honestly, do we need to just go ahead and Nerf pad the entire world now. Nobody takes any responsibly for themselves now. I know it sucks that she fell into a hole, but she wasn’t paying any attention to where she was. If she had been texting and walked out into oncoming traffic and got hit, what are they going to sue the driver of the car, because they didn’t see her, or didn’t avoid her. What is next, sue the car company because they didn’t equipe the car with stupid person avoidance system? Sorry, I was ranting.