81–90 of 322 posts
Earlier quoted context omitted.
I think you should have added a /s tag... some people don't get jokes unless you hit them over the head with it.
I will never stoop so low as to telegraph my own joke.
User agents shouldn't exist any more. They serve only to help unsuspecting users be fingerprinted.
Rubbish. They are incredibly useful for debugging.
Just give me "Chrome 68" instead of "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36"
I don't see what the fuss is about. This is an effective mitigation, given that software can't just arbitrarily lie about its user agent.
I guess the biggest problem is that the mitigation isn't future-proof. Someday, there might be other command-line tools besides cURL that can be used for this kind of attack. A better fix would be to just drop all incoming IPv4 packets that have the "evil" bit set. ( https://www.ietf.org/rfc/rfc3514.txt ) Extending this protection to IPv6 is left as an exercise for the reader.
Earlier quoted context omitted.
Having been involved in meetings where "stop ship" was the phrase of the day, I'd bet money that the following at least vaguely resembles a real conversation: Engineer Alice: We should really fix this properly. Manager: How sure are you that the proper fix won't break something else for $BIG_CUSTOMERS who are responsible for $OBSCENE percent of this product line's revenue? Engineer Bob: Uh, ten percent on a good day?…
I've been Engineer Alice before (not with a security issue, but a pretty bad systems issue). In case anyone is ever in that situation, here are some more productive replacements for that existential sigh (in that they sometimes work). Choose the one most suited to manager's biases. The cliches are important: think of it as giving manager an easy way to explain it to their manager. > Yes, but that would only help with…
Answering „yes“ is a lie here. This is different from a fix that fixes the problem in an ugly way, where „yes, but...“ is applicable.
Source says they also did some input sanitizing along with blocking curl, and they had to make a new PoC to get around that. If I'm reading that right then this isn't really an issue, nothing wrong with defense in depth. Edit: >The update adds several filters to handle single quotes in user input. However, these filters can be evaded by specially crafted inputs. By providing the following string for the certificate's…
Of all the security post-mortems I’ve ever wanted to read, it’s sad I’ll probably never get to read this one and its tale of how a team of well-paid comfortable engineers got together and decided this patch was a good idea.
Having been involved in meetings where "stop ship" was the phrase of the day, I'd bet money that the following at least vaguely resembles a real conversation: Engineer Alice: We should really fix this properly. Manager: How sure are you that the proper fix won't break something else for $BIG_CUSTOMERS who are responsible for $OBSCENE percent of this product line's revenue? Engineer Bob: Uh, ten percent on a good day?…
I'm curious how pen testers reverse the .bin firmware download into source code, anyone have any insight there?
Earlier quoted context omitted.
I think you should have added a /s tag... some people don't get jokes unless you hit them over the head with it.
I will never stoop so low as to telegraph my own joke.