21–30 of 322 posts
I don't see what the fuss is about. This is an effective mitigation, given that software can't just arbitrarily lie about its user agent.
Earlier quoted context omitted.
How? Do you think developers would be so crazy as to add some sort of "--user-agent" option to software like curl that would cause arbitrary strings to be presented as the user agent? Why would somebody write software to do this, just go on the internet and tell lies?
Your downvoters are terrible at detecting satire.
User agents shouldn't exist any more. They serve only to help unsuspecting users be fingerprinted.
Source says they also did some input sanitizing along with blocking curl, and they had to make a new PoC to get around that. If I'm reading that right then this isn't really an issue, nothing wrong with defense in depth. Edit: >The update adds several filters to handle single quotes in user input. However, these filters can be evaded by specially crafted inputs. By providing the following string for the certificate's…
The equivalent of a "pls dont hack" sign is not defense in depth. Good to know they at least half fixed the problem, I guess. But that's not enough, and they should be capable of testing this.
I don't see what the fuss is about. This is an effective mitigation, given that software can't just arbitrarily lie about its user agent.
I think you should have added a /s tag... some people don't get jokes unless you hit them over the head with it.
I think this is called "Test Driven Development". /s
User agents shouldn't exist any more. They serve only to help unsuspecting users be fingerprinted.
Rubbish. They are incredibly useful for debugging.
User agents shouldn't exist any more. They serve only to help unsuspecting users be fingerprinted.