Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

twitter.com

Post reply on HN
Print view View original

251–260 of 322 posts

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#251

Post by flatline »

spaceribs wrote: post #220
TeMPOraL wrote: post #190

Earlier quoted context omitted.

Yup. The reality of this industry is that most programmers are closer to the handymen you call to fix your faucet or lay floor tiles than to actual engineers. And we all have first-hand or second-hand horror stories related to handymen.

I've come to the conclusion recently that we're all just barbers, bloodletting and burring holes. Until we have proper certifiable and reproducible competency, we'll never become surgeons.

And yet the US has consistently been in the vanguard of software development worldwide. Do we need surgeons? Do you need a four year postgraduate degree and three more years of apprenticeship before slinging together a web app? Certainly the industry has its problems, and some applications demand more rigor, but I don’t see this as much of a general solution.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#252

Post by mceldeen »

nabla9 wrote: post #163
admax88q wrote: post #112

Earlier quoted context omitted.

On HN its always big bad management who is the cause of every security problem or shoddy piece of engineering. If only that pesky management would screw off then we could do things "properly". You'd be suprieed at how many incompetent engineers there are out there. If "engineer" Alice in your story was actually competent they would never agree to implement the proposed "fix". Its not a fix. To pass it off as one woul…

"Engineer" conveys image of middle class white-collar job with relatively high status, good education and responsibilities. That word now used for everyone doing programming related jobs inside office space for no good reason. I think the word "tehnician" should be used to describe most grey-collar ICT jobs, including most programmers. Their responsibility and scope of their work is limited. Many programming jobs are…

I think this talk is relevant https://youtu.be/lLnsi522LS8

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#253

Post by derpherpsson »

Asooka wrote: post #225
derpherpsson wrote: post #159

Earlier quoted context omitted.

Some time ago I went through the list of all the major router manufacturers and rated them on 1) security, and 2) long term usability, and 3) culture. My conclusion was that I would buy my infrastructure from Allied Telesis. It's pretty much a Japanese version of Cisco, but it's still healthy. Ubiquity was number 2. I refrain from buying from them only because of their glossy UI. Mikrotik was on that list. Until I sa…

Can you elaborate on Mikrotik? I've only heard good things about them and am very satisfied with the one hAP I bought from them.

They have had several remote code execution vulnerabilities lately (summer 2018). While they were very quick to patch them they did not notify their customers in any way. There was nothing on their website that said anything about the urgency.

Instead of reusing functionality that exists in the router already (ssh?), the authentication for winbox is something they built themselves. It was in the winbox auth that the main security flaw was. It just looked really bad to me.

The winbox client also downloads and runs any DLL that is sent by the winbox server. The winbox client has a windows certificate so all it's code is trusted. So own the router and you get the admins workstation too.

It just feels like maybe they hired some random guy without much appreciation for security for doing winbox.

The SMB server also had a rce a while ago.

That said, I guess that if you disable winbox and stuff that should not face the internet, you are probably safe?

Too much for me though. I would not feel safe.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#254

Post by Anarch157a »

stavros wrote: post #3

I don't see what the fuss is about. This is an effective mitigation, given that software can't just arbitrarily lie about its user agent.

Curl can, easily. Curl is not just a client to get a file and pipe it to other programs, it's a diagnostic tool, and it has all sorts of parameters to help it simmulate all kinds of interaction with a webserver, including the -A parameter to change the user-agent, this is why this 'fix' is so stupid.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#255

Post by PaulHoule »

spaceribs wrote: post #220
TeMPOraL wrote: post #190

Earlier quoted context omitted.

Yup. The reality of this industry is that most programmers are closer to the handymen you call to fix your faucet or lay floor tiles than to actual engineers. And we all have first-hand or second-hand horror stories related to handymen.

I've come to the conclusion recently that we're all just barbers, bloodletting and burring holes. Until we have proper certifiable and reproducible competency, we'll never become surgeons.

Don't you need a license to be a barber?

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#256

Post by konstmonst »

pjmlp wrote: post #186
admax88q wrote: post #124

Earlier quoted context omitted.

You can always quit. Or force them to fire you for refusing to implement a non fix. In reality though I doubt this narrative even occurred. Some incompetent engineer likely proposed this fix thinking that it was actually a fix. Edit: I see I've been downvoted for this comment. If we were real engineers working on things like cars and bridges we'd actually be held accountable. Take some pride in your work people, this…

Quitting assumes the possibility of finding a job around the corner and not having people that depend on you.

You might be surprised, but if you move to Europe, it is actually so! Move to Berlin of Frankfurt. There is always work for Software Developer here, it is hard not to get one and you get spammed by recruiters all the time. You don't have to take shit from management, you can just go elsewhere. Everything is also very near.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#257

Post by StavrosK »

Anarch157a wrote: post #254
stavros wrote: post #3

I don't see what the fuss is about. This is an effective mitigation, given that software can't just arbitrarily lie about its user agent.

Curl can, easily. Curl is not just a client to get a file and pipe it to other programs, it's a diagnostic tool, and it has all sorts of parameters to help it simmulate all kinds of interaction with a webserver, including the -A parameter to change the user-agent, this is why this 'fix' is so stupid.

I see, thank you for the explanation!

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#258

Post by StavrosK »

wyldfire wrote: post #70
StavrosK wrote: post #27

Earlier quoted context omitted.

I will never stoop so low as to telegraph my own joke.

Then you must encounter Poe's Law frequently....?

All the time. After having seen the kinds of things some people will say in earnest, I will never begrudge someone missing my sarcasm.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#259

Post by icedchai »

smt88 wrote: post #242
icedchai wrote: post #240

Okay, so the fix is bad. Now, you have to wonder how this "fix" made it through code review, QA, release... You can blame the engineer. Perhaps they were rushed, inexperienced, or both, but this is a failure on all levels.

Many people would've seen and signed off on this fix, not just one engineer.

Yes, exactly my point. How can this happen? Maybe nobody cares.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#260

Post by r_smart »

FearNotDaniel wrote: post #189
pjmlp wrote: post #185

Earlier quoted context omitted.

Thankfully there are countries where Engineer is still a proper word, not something that you are allowed to call yourself after a 6 month bootcamp.

Yup, in the UK it bugs me when I keep meeting people who introduce themselves as an 'engineer'. When I ask them if they do mechanical or civil engineering, then I usually get to say "ah, so you're a programmer, just like me". One thing I did sometimes like about being in Austria is the obsession with academic titles they have there... if somebody is a qualified engineer, they invariably use "Ing" as a title in place…

How dare you leave out electrical engineering!
Post reply on HN