Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

twitter.com

Post reply on HN
Print view View original

131–140 of 322 posts

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#131

Post by na85 »

astrobe_ wrote: post #123
admax88q wrote: post #112

Earlier quoted context omitted.

On HN its always big bad management who is the cause of every security problem or shoddy piece of engineering. If only that pesky management would screw off then we could do things "properly". You'd be suprieed at how many incompetent engineers there are out there. If "engineer" Alice in your story was actually competent they would never agree to implement the proposed "fix". Its not a fix. To pass it off as one woul…

You live in a nice world, because usually the actual power (and duty) of a dev team member is to advise, not to agree or refuse.

So whose fault is the cancerous heap of flaming dogshit that is nodejs, then? Some manager managed it into existence?

No, it's the brainchild of an engineer. Somebody actually thought nodejs was a good idea. Face it, there are lots of really bad engineers out there.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#133

Post by floatingatoll »

StavrosK wrote: post #35
MiddleEndian wrote: post #20

User agents shouldn't exist any more. They serve only to help unsuspecting users be fingerprinted.

I vote we change all user agents to just "curl".

“Apache” would be ironic.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#135

Post by onion2k »

na85 wrote: post #131
astrobe_ wrote: post #123

Earlier quoted context omitted.

You live in a nice world, because usually the actual power (and duty) of a dev team member is to advise, not to agree or refuse.

So whose fault is the cancerous heap of flaming dogshit that is nodejs, then? Some manager managed it into existence? No, it's the brainchild of an engineer. Somebody actually thought nodejs was a good idea. Face it, there are lots of really bad engineers out there.

I honestly envy the sort of person who can post something like this. Not liking nodejs is fine, but to extrapolate from "I don't like nodejs" to "Thousands of engineers at companies like Google are wrong and I am right" must require such a level of myopic, ignorant self-belief that is completely alien to me. I just find myself respecting other people's work too much, even if I don't like it.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#136

Post by dragonwriter »

mehrdadn wrote: post #39
stavros wrote: post #33

Earlier quoted context omitted.

We don't need user agents for that. There's an easy way to tell whether a visitor wants a cleaner view of a page, without Javascript: Yes.

I said "mobile", not "cleaner". Sizes and aspect ratios are different on phones than PCs.

> I said "mobile", not "cleaner". Sizes and aspect ratios are different on phones than PCs.

User agent doesn't tell you size or aspect ratio.

Even if you know I'm running Chrome on Android on a Galaxy Note 8, you don't know the size (physical or pixel) or aspect ratio of the viewport, because: (1) I may or may not be viewing in side by side windows, (2) the screen can be in any of three resolutions, (3) the screen can be portrait or landscape, (4) the browser may or may not be set to use the full space on the long dimension of the screen.

OTOH, CSS Media Queries answer these questions.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#137

Post by derpherpsson »

Cisco is crumbling under its own weight.

This is a symptom of the rot in their management, and probably also a sign that they have hired too many incompetents.

It probably also is a sign of the current age. After the recovery from the IT-bubble programming got really hot. Thus: Too many of the new programmers wants to be programmers because it pays well - not because they love their craft. So therefore we have a bunch of well-paid but uninterested people seeking jobs at prestigious companies.

Culture matters. I want my socially maladapt terminal junkies back plz.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#138

Post by na85 »

onion2k wrote: post #135
na85 wrote: post #131

Earlier quoted context omitted.

So whose fault is the cancerous heap of flaming dogshit that is nodejs, then? Some manager managed it into existence? No, it's the brainchild of an engineer. Somebody actually thought nodejs was a good idea. Face it, there are lots of really bad engineers out there.

I honestly envy the sort of person who can post something like this. Not liking nodejs is fine, but to extrapolate from "I don't like nodejs" to "Thousands of engineers at companies like Google are wrong and I am right" must require such a level of myopic, ignorant self-belief that is completely alien to me. I just find myself respecting other people's work too much, even if I don't like it.

Invoking "thousands of engineers at companies like Google" is a logical fallacy. There are tons of incompetent people out there writing code, and lots of them work for FAANG.

>I just find myself respecting other people's work too much, even if I don't like it.

Maybe that's the difference between us, then. I don't feel that we should hand out Participant ribbons. I'm sure the nodejs people work very hard, but the fact is their product is just objectively awful.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#139

Post by namibj »

0x0000000 wrote: post #89

I have one of these routers :\ So far I'm unable to get the PoCs to work but that doesn't make me confident. I'm curious how pen testers reverse the .bin firmware download into source code, anyone have any insight there?

Ida64/Binary analysis tooling, I presume.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#140

Post by jodrellblank »

admax88q wrote: post #124
astrobe_ wrote: post #123

Earlier quoted context omitted.

You live in a nice world, because usually the actual power (and duty) of a dev team member is to advise, not to agree or refuse.

You can always quit. Or force them to fire you for refusing to implement a non fix. In reality though I doubt this narrative even occurred. Some incompetent engineer likely proposed this fix thinking that it was actually a fix. Edit: I see I've been downvoted for this comment. If we were real engineers working on things like cars and bridges we'd actually be held accountable. Take some pride in your work people, this…

You suggest it was just one lone engineer being incompetent. Then you respond to downvotes with the non-sequitur "take some pride in your work" - are you suggesting pride is a fix for incompetence? What?
Post reply on HN