Live data from Hacker News

Falsehoods programmers believe about networks

blog.erratasec.com

1–10 of 32 posts

Re: Falsehoods programmers believe about networks

#6
post #4

It'd be great if someone wrote three lines explaining why one would believe each of those, why it's wrong, and why that's important.

And by "it'd be great", what you really mean is "the article is completely useless without them". Half of the items are "no shit"; another 20% is "huh?", and the remaining are "that might be interesting to learn more about - but with no additional information, I don't even have enough keywords to Google to find out more".

Re: Falsehoods programmers believe about networks

#7
post #4

It'd be great if someone wrote three lines explaining why one would believe each of those, why it's wrong, and why that's important.

I tried to write up a little about the ones that I know something about, here it is:

  Data on the network cannot be altered.
False, if something goes through another device, it can be altered. Important because, well, man in the middle.

  Encrypted data on the network cannot be altered.
Same as the above. Harder, but still doable

  Data cannot be accidentally corrupted, because TCP has checksums and Ethernet has CRCs
This is about like saying "only 1 bit can be flipped at once, so parity checking will always catch it"

  If it's inside my perimeter firewall, that means I have total control over it (@armorguy)
Similar to the top ones, still harder, but it's a weak point if someone gets into your perimeter at all.

  Packets arrive in the order in which they were sent.
Completely false, though TCP will reorder them back to the original order for you.

  If you can't ping the target, then it doesn't exist. (@jjarmoc)
  
Trivial to make a host not respond to pings

  If you can ping the target, then it does exist.
  
Again, trivial to make a router or any device respond to pings for a lot of IPs

  TCP RSTs come from end-nodes.
Devices in the middle sending RSTs is really common, google "comcast rst packets"

  Bytes must be "swapped" from the network byte-order to the host CPU byte-order.
IP/TCP and such protocol bytes must be swapped. The only thing that cares at the application layer is the application code, it can just say "everything is little endian" and be done with it.

  It's an internal web app -- outsiders won't be able to discover where it is (@biosshadow)
  
if this is about a "exposed under an obscure name", the tools like fierce can probe for it. If it's exposed to the internet at all, consider it under attack at all times.

  The DHCP address will be the same after a reboot (@shewfig)
Not necessarily true, depends on the DHCP server and such.

  The DHCP address will remain the same until the next reboot.
You get a lease time, OBSERVE IT. Don't just keep using it cause you say "this is mine still!"

  Well, it'll last a long time between changes
One culprit is coffeeshops, there have been reports of coffeeshops with 30 minute lease times. I've seen cable modems hand out 30 second leases, but that was when it was still trying to connect to the cable side, so it wanted the computer to keep checking back

  The DHCP server and local router are the same (@schrotthaufen)
  
Not at all a requirement, and would cause your packets to go off into nowhere if you tried to rely on it.

Re: Falsehoods programmers believe about networks

#8

The IP address returned from each hop on a traceroute is from the actual device that the ICMP packet was originally sent to.

> The IP address returned from each hop on a traceroute is from the actual device that the ICMP packet was originally sent to.

Actually - the return packets are ICMP (TTL expired in transit), but the packets you send, _by default_, are UDP.

Traceroute can indeed be instructed to use ICMP though, but it's not the default on an any OS I know.

Re: Falsehoods programmers believe about networks

#9
post #4

It'd be great if someone wrote three lines explaining why one would believe each of those, why it's wrong, and why that's important.

This is effectively the problem with all of these "things programmers assume" articles: they give no solutions and effectively just moan about possible problems.

Re: Falsehoods programmers believe about networks

#10
post #8

The IP address returned from each hop on a traceroute is from the actual device that the ICMP packet was originally sent to.

> The IP address returned from each hop on a traceroute is from the actual device that the ICMP packet was originally sent to. Actually - the return packets are ICMP (TTL expired in transit), but the packets you send, _by default_, are UDP. Traceroute can indeed be instructed to use ICMP though, but it's not the default on an any OS I know.

I knew someone would say this.

Windows not uses ICMP by default, but there is no switch to use UDP packets instead of ICMP packets.[1]

Yes, I'm well aware that UDP is the default on most Unix-based systems.

1. https://technet.microsoft.com/en-us/library/cc940128.aspx

Post reply on HN