Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why does the US Visa application website do a port-scan of my network?

news.ycombinator.com

Post reply on HN
Print view View original

251–260 of 269 posts

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#251

Post by crote »

throw10920 wrote: post #152
rwmj wrote: post #68

Earlier quoted context omitted.

You might be making the assumption that the US wants to make the process easier.

Not to defend the US immigration system, but my experience is that this user-hostile behavior (modulo the port scanning lol) is endemic across US government websites - including those that nominally want to serve you, those that are at the state level instead of the federal level (such as the DMV sites), and those that are even internal for use by government employees only. It's bad enough that in some cases I believ…

It starts to make a lot more sense when you realise there is a huge group in the US actively trying to make the government fail. It's pretty hard to make a good and user-friendly website when every few years some high-level people try to kneecap you.

These aren't unsolvable problems. The UK, for example, had invested a lot of time and effort into making their websites user-friendly. In most countries filing taxes online is something you can do during your lunch break - without paying the Turbotax maffia. Driver's license? You can order that online, and make an appointment for a 15-minute window to pick it up.

If interacting with the government is painful, it is almost always because someone benefits from it being painful.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#252

Post by shazbotter »

ThrowMeAway1618 wrote: post #233
shazbotter wrote: post #149

Earlier quoted context omitted.

People really really dislike when you point out that the democrats are also broadly anti immigration in practice. They forget Biden deported 4.6 million people vs Trump's 2 million.

[flagged]

I hadn't even considered that some right wing folks would be bothered by that statistic, as if deportations were good, actually. But no, I'm sure it does bother some folks in the right.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#253

Post by zzzeek »

monkeyelite wrote: post #239
zzzeek wrote: post #220

Earlier quoted context omitted.

no, this is an entirely bad faith representation of my words as written he most certainly did not understand that the vast majority of what he perceived as "dead people getting benefits" were completely legitimate cases where beneficiaries were receiving those benefits and/or the data was encoded without a real birth/death date since you appear to be of the opinion that Musk was somehow indicating a useful fact of so…

> since you appear to be of the opinion that Musk was somehow indicating a useful fact of some kind, No but I am glad he took action to fix it. The Cobol 150 year thing is also incorrect and was widely criticized in tech circles: https://retrocomputing.stackexchange.com/questions/31288/did...

Musk wasn't criticizing COBOL he was criticizing a specific thing he misunderstood in social security code which people in that thread said as much. I think you're trying to see something you want to see there.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#254

Post by adastra22 »

johncolanduoni wrote: post #242
adastra22 wrote: post #195

Earlier quoted context omitted.

Why though? What is the use case that demands this? It'd better be a real pressing need because the security risks are immense and obvious. This is a backdoor to every network firewall.

It’s more that it wasn’t prevented back when the web was first coming together, because security wasn’t on almost anyone’s minds at all. There wasn’t a hole added at some point; it’s just that browsers didn’t specifically block domains that resolve to public IPs from accessing domains that resolve to private IPs. Realistically, it’s a backdoor to every network firewall that has existed for the entire era in which bro…

i thought it was prevented by standard browser cross-domain security checks. Thats why I'm so surprised.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#255

Post by adastra22 »

psd1 wrote: post #227
adastra22 wrote: post #195

Earlier quoted context omitted.

Why though? What is the use case that demands this? It'd better be a real pressing need because the security risks are immense and obvious. This is a backdoor to every network firewall.

I'm hazy on the details, but: Home Assistant has a well-known public name that opens your local instance. On first access, you need to give it the name or ip of your instance, which is saved in browser storage. This supports deep links into your config from forum posts. My mum also had a shitty D-Link wifi mesh device, which was packaged as an appliance. I cannot speak lowly enough about that garbage device, but then…

How is that the same thing? That is a DNS entry that resolves to an internal IP. That lets a user explicitly type a domain and get something internal. That wouldn’t allow cnn.com to ports scan my fridge.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#256

Post by karel-3d »

jpeggtulsa wrote: post #243
karel-3d wrote: post #63

It's coming from a F5 script, which is a company that sells anti-bot protection amid other things. (It's coming from obfuscated script at /TSPD, which is a F5 thing.) https://www.f5.com/

Isn't F5 the company that makes nginx?

I didn't know that! But apparently yes

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#258

Post by qingcharles »

Dylan16807 wrote: post #244
qingcharles wrote: post #209

Earlier quoted context omitted.

One thing a developer sat in DC or SV with a 5G iPhone 16 doesn't realize too, is that if you are visiting these web sites with a phone plan that has a tiny monthly data allowance then this bloat can blow out an entire month in one sitting. I worked with people on parole that were given free phones to use for job applications, finding their way around etc, and they would only get 3GB data a month. Some of the sites t…

> You'd get some plans that would drop down to 2G, but try using that for Google Maps when you're trying to find a bus to get you across the city. Sure, I'll do my best to try it. I'll approximate the throttle by limiting chrome to 128kbps, 500ms delay, and 5% packet loss for fun. With a fresh incognito session, google responds to "here to 4th street" in 10 seconds, and when I click to open maps it needs just under t…

The paper stats on 2G would make it seem like it should work in theory, especially if it's using EDGE or something, but it just consistently fails in the field. You'll get partial renders and then it will jam up. It's super, super frustrating to use. Because it is slow to render people start trying to swipe around the map to make it do something and that just cancels all the async downloads and restarts them.

There are probably a host of other telemetry things going on in your standard $20 Android handset in the background too, eating up all that bandwidth and causing all sorts of bottlenecks.

Agree it would be really nice to have some sane minimum speed.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#259

Post by Dylan16807 »

qingcharles wrote: post #258
Dylan16807 wrote: post #244

Earlier quoted context omitted.

> You'd get some plans that would drop down to 2G, but try using that for Google Maps when you're trying to find a bus to get you across the city. Sure, I'll do my best to try it. I'll approximate the throttle by limiting chrome to 128kbps, 500ms delay, and 5% packet loss for fun. With a fresh incognito session, google responds to "here to 4th street" in 10 seconds, and when I click to open maps it needs just under t…

The paper stats on 2G would make it seem like it should work in theory, especially if it's using EDGE or something, but it just consistently fails in the field. You'll get partial renders and then it will jam up. It's super, super frustrating to use. Because it is slow to render people start trying to swipe around the map to make it do something and that just cancels all the async downloads and restarts them. There a…

Well it's not ever going to be actual 2G. It's a throttle. I'm not sure how much worse it could get when you have a reasonably solid signal, but I guess nothing stops network engineers from doing something awful.

> Because it is slow to render people start trying to swipe around the map to make it do something

At a certain point it's the user's fault. And once it gets to the point where you can swipe around, the tile loading should be pretty visible.

And to add more emphasis to the app being usable, I can get driving directions fully offline, then click bus and now it needs one tiny server request to tell me.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#260

Post by b3lvedere »

psd1 wrote: post #227
adastra22 wrote: post #195

Earlier quoted context omitted.

Why though? What is the use case that demands this? It'd better be a real pressing need because the security risks are immense and obvious. This is a backdoor to every network firewall.

I'm hazy on the details, but: Home Assistant has a well-known public name that opens your local instance. On first access, you need to give it the name or ip of your instance, which is saved in browser storage. This supports deep links into your config from forum posts. My mum also had a shitty D-Link wifi mesh device, which was packaged as an appliance. I cannot speak lowly enough about that garbage device, but then…

I remember Fritzbox devices doing the same. Wasn’t a real problem until someone actually hijacked the fritz.box domain.
Post reply on HN