Earlier quoted context omitted.
So instead of sending a user agent, send only the page ratio!!
This is not too helpful -- you can resize the window in such a way that the ratio changes...
Send the screen resolution
Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent
121–130 of 322 posts
Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent
#122Of all the security post-mortems I’ve ever wanted to read, it’s sad I’ll probably never get to read this one and its tale of how a team of well-paid comfortable engineers got together and decided this patch was a good idea.
Having been involved in meetings where "stop ship" was the phrase of the day, I'd bet money that the following at least vaguely resembles a real conversation: Engineer Alice: We should really fix this properly. Manager: How sure are you that the proper fix won't break something else for $BIG_CUSTOMERS who are responsible for $OBSCENE percent of this product line's revenue? Engineer Bob: Uh, ten percent on a good day?…
Engineer Alice is the only person incompetent at their job in this conversation. If "irrepressibly existential sigh" is how you argue security with your bosses then maybe you're not senior enough to be in meetings like these.
The Manager and QA Engineers here depend on the expertise of the engineers. If the engineers fail to communicate key details of the situation, then that's on them. Sure, the boss is still at fault for depending on a shitty engineer for decision making, but that's all.
Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent
#123Earlier quoted context omitted.
Having been involved in meetings where "stop ship" was the phrase of the day, I'd bet money that the following at least vaguely resembles a real conversation: Engineer Alice: We should really fix this properly. Manager: How sure are you that the proper fix won't break something else for $BIG_CUSTOMERS who are responsible for $OBSCENE percent of this product line's revenue? Engineer Bob: Uh, ten percent on a good day?…
On HN its always big bad management who is the cause of every security problem or shoddy piece of engineering. If only that pesky management would screw off then we could do things "properly". You'd be suprieed at how many incompetent engineers there are out there. If "engineer" Alice in your story was actually competent they would never agree to implement the proposed "fix". Its not a fix. To pass it off as one woul…
You live in a nice world, because usually the actual power (and duty) of a dev team member is to advise, not to agree or refuse.
Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent
#124Earlier quoted context omitted.
On HN its always big bad management who is the cause of every security problem or shoddy piece of engineering. If only that pesky management would screw off then we could do things "properly". You'd be suprieed at how many incompetent engineers there are out there. If "engineer" Alice in your story was actually competent they would never agree to implement the proposed "fix". Its not a fix. To pass it off as one woul…
You live in a nice world, because usually the actual power (and duty) of a dev team member is to advise, not to agree or refuse.
You can always quit. Or force them to fire you for refusing to implement a non fix.
In reality though I doubt this narrative even occurred. Some incompetent engineer likely proposed this fix thinking that it was actually a fix.
Edit: I see I've been downvoted for this comment. If we were real engineers working on things like cars and bridges we'd actually be held accountable. Take some pride in your work people, this is one of the most in demand professions in today's economy.
Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent
#125Earlier quoted context omitted.
How? Do you think developers would be so crazy as to add some sort of "--user-agent" option to software like curl that would cause arbitrary strings to be presented as the user agent? Why would somebody write software to do this, just go on the internet and tell lies?
Even without --user-agent, you can still pipe 'echo -e "GET ...\rnHost: ... "' through nc, or even telnet. Therefore, we obviously need to patch echo (and all echo shell builtins) to refuse to output strings containing "GET", "POST", "HTTP", or "Host:".
> Therefore, we obviously need to patch echo (and all echo shell builtins) to refuse to output strings containing "GET", "POST", "HTTP", or "Host:".
Unfortunately it is also possible to do this using file redirection or to write a new program that will make a TCP connection and send arbitrary data through it, making it necessary to do the same for all editors, compilers and interpreters.
That sounds like a lot of work though (there are many such programs), so maybe we ought to just patch the kernel to prohibit any of those strings from being written to a file descriptor. There can't be that many false positives.
Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent
#126User agents shouldn't exist any more. They serve only to help unsuspecting users be fingerprinted.
They help you figure out if a user agent wants a mobile view of a page without Javascript... which is pretty useful.
I think CSS is probably good enough that we can live without UA sniffing for this.
Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent
#127Meanwhile the US goes around telling other countries not to use Huawei because they can't guarantee security. [1]
[1] https://www.forbes.com/sites/zakdoffman/2019/02/19/huawei-fo...
Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent
#128Meanwhile the US goes around telling other countries not to use Huawei because they can't guarantee security. [1] [1] https://www.forbes.com/sites/zakdoffman/2019/02/19/huawei-fo...
I doubt they are referring to their security bugs.
Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent
#129Don't blame the manager, the PO, the CEO. This is ABSURD engineering incompetence. The fellow that did that _fix_ probably had no idea how to properly solve the issue.
If it is then it's management's responsibility for allowing that incompetence to exist. These sort of issues all come from the culture which is driven from the top.
Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent
#130Earlier quoted context omitted.
I like the original more without your embellishment. The addition sounds like every attempt at follow up humor on reddit.
Yeah but it's not Reddit, it's HN. You have to know your audience, read the crowd. On Reddit it's 90% sarcasm so there's no fixing it. Here it's the reverse and people take things seriously without a tell. You just have to bury the tell in another joke or it will ruin the funny.
"given that software can't [ridiculous thing no one has ever claimed]" is plenty for a tell.