I think you meant "registered" instead of "registering". I clicked it after I al...

cfinke · on Aug 26, 2011

> I clicked it after I already had registered, and it showed

> me notification about being part of hacker news group.

So adding someone to an affiliation is as simple as getting them to ping a URL with a GET request? That doesn't seem especially secure.

scq · on Aug 26, 2011

Not secure at all. It's vulnerable to CSRF.

Embedding an iframe with the url in a html page will cause all visitors to the page to get the affiliation.

Proof of concept: http://s.dpth.tk/files/jigcsrf.html

Simply visiting the above page while logged in is sufficient to get the affiliation.

irahul · on Aug 26, 2011

> Embedding an iframe with the url in a html page will cause all visitors to the page to get the affiliation.

Won't a simple <img src=...> work? Why go the iframe route?

I don't think this is going to be the final affiliation implementation they are going to use. It's more like adding special touches for a community where he is showcasing, and they will turn it off in a day or two.

joshu · on Aug 26, 2011

we'll fix this later. we have big plans for affiliations, but for now they are mostly just about the little badges :)

scq · on Aug 27, 2011

Yes, that would work. Including it as a script or css stylesheet would work also.