August 18th, 2006

Oops. I broke wiki.com’s registration…

I read an article a few days ago about a site that’s been getting a fair amount of buzz lately, particularly due to its $2.8 million purchase agreement: wiki.com

I thought to myself, “What the heck, might as well go grab a couple of subdomains while they’re still available.” So, I went to http://www.wiki.com, and clicked ‘Start a Wiki’, which took me to http://reg.wiki.com.

The registration process was simple — maybe even a little bit *too* simple:
1. choose a wiki name (subdomain: something.wiki.com)
2. enter your name, email address, zip code, and captcha text
3. submit

Well, for some reason I got the bright idea to enter ‘reg’ as my wiki name, just to see if it would let me, and if so, what would happen. I didn’t expect to actually WORK, and certainly meant no harm to the site. I expected some form of confirmation prompt after submitting that registration form, but it immediately broke reg.wiki.com.

For at least an hour or two (I didn’t notice when they fixed it), you could not register on wiki.com. I thought, for sure, they would delete the wiki that I’d created, but instead, they created http://registration.wiki.com, and changed the ‘Start a Wiki’ link to point to the new URL.

I’ve posted a message on http://reg.wiki.com, explaining what happened, and linking to the new registration page. I still can’t believe that actually worked! I do think it’s pretty cool that they left my wiki alone, even though it broke their site for a while. I’m assuming that they’ve got a sense of humor and weren’t too pissed off, since I didn’t even receive a Cease and Desist letter. :)

Can anybody think of any legitimate use for ‘reg.wiki.com’, or should I just leave it as-is, with a note directing people to the new registration page?

July 17th, 2006

Name your own price on dental products

  1. go to http://www.dentist.net
  2. find the product you want
  3. enter in address bar:
    javascript:void(document.onmousedown=ra)
  4. firefox web developer toolbar:
    Forms | Display Form Details
    Forms | Make Form Fields Writable
  5. edit text input named ‘price‘.
    click ‘add to cart’ button
  6. laugh



Of course, I would not really proceed through checkout with any cart created inappropriately, but it was fun to play with a little bit.

Ordinarily, I’d contact a company to let them know about a gaping security hole like this, but…

  1. I’m still bitter about them crippling my browser
  2. My blogs don’t have very many readers
  3. I’m confident that they would catch even the slightest modified order parameters, because, “We are Fraud Smart and pursue fraudulent orders to the full extent of the law.” (from checkout page)