All Node.js servers are vulnerable to DoS
groups.google.com
All Node.js servers are vulnerable to DoS
1–10 of 37 posts
Re: All Node.js servers are vulnerable to DoS
#2So are all string based dictionaries?
Re: All Node.js servers are vulnerable to DoS
#3Didn't I see this same thing about PHP the other day?
http://news.ycombinator.com/item?id=3403360
http://nikic.github.com/2011/12/28/Supercolliding-a-PHP-arra...
Re: All Node.js servers are vulnerable to DoS
#4So are all string based dictionaries?
Yes, if they are implemented via hash tables and do not randomize their hash generation somehow.
The talk at 28c3 specifically mentions PHP, Java, ASP.net, Python. Ruby is fine, but other variants of Ruby are apparently also vulnerable.
Re: All Node.js servers are vulnerable to DoS
#5This is a particular case of http://news.ycombinator.com/item?id=3401900. Basically, weak hash functions allow you to create lots of hash table collisions, degrading performance to that of a linked list. It is common to put POST'ed data into a hash table (the equivalent of ?foo=bar&baz=qux becomes {"foo": bar, "baz": qux}).
Re: All Node.js servers are vulnerable to DoS
#6Looks like it's getting fixed:
>> Yep. Hang tight. v0.6.7 is coming up soon.
Re: All Node.js servers are vulnerable to DoS
#7Looks like it's getting fixed: >> Yep. Hang tight. v0.6.7 is coming up soon.
Putting the kibosh on the paranoia parade, huh?
Re: All Node.js servers are vulnerable to DoS
#8So are all string based dictionaries?
Yes, if they are implemented via hash tables and do not randomize their hash generation somehow. The talk at 28c3 specifically mentions PHP, Java, ASP.net, Python. Ruby is fine, but other variants of Ruby are apparently also vulnerable.
Ruby 1.9 is fine, 1.8 has problems.
Re: All Node.js servers are vulnerable to DoS
#9Ryan Dahl commented on the thread, and it's being fixed in node. Nice to see assessment and responsiveness at the core of the project.
I'm evaluating node.js as an application platform choice for a large public infrastructure project. One thing that concerns me is (my perception here) a lack of public hardening of the server that's yet to come. I've been around long enough to see that effect on PHP, Django, Rails, etc.
We'll continue our evaluation but it's encouraging to know that issues like these are being discovered and addressed.
Re: All Node.js servers are vulnerable to DoS
#10Anything measured can be improved.