121–130 of 164 posts
This line works: nc -l -p 1234 -q 1 > testfile.txt The other one doesn't. alias foobar=nc cat testfile.txt | foobar 192.168.2.100 1234 I was hoping that it was a "useless use of cat" filter, but nope. It just doesn't like the bytes nc next to an IPv4 address. This is also fine, but blocked if you change the slash to a dot: nc 192/168.2.100 1234 This works too: nc \ 192.168.2.100 1234 OK, that's all for now. Can you b…
Earlier quoted context omitted.
https is important for preventing spying by anyone else in between you and the server. ISPs, coffee shop owners, schools, etc used to spy on http traffic to see what people were doing/searching for, and ISPs like xFinity injected code into non-https pages to show "important messages" to users, e.g. going over your bandwidth limit[0]. The only weak link now is Cloudflare, which is still "less secure than a direct conn…
Is there a way to know when the encrypted content i send to a site is also being provided to Cloudflare?
https://news.ycombinator.com/cdn-cgi/trace
Every Cloudflare site will respond to this URI.
This line works: nc -l -p 1234 -q 1 > testfile.txt The other one doesn't. alias foobar=nc cat testfile.txt | foobar 192.168.2.100 1234 I was hoping that it was a "useless use of cat" filter, but nope. It just doesn't like the bytes nc next to an IPv4 address. This is also fine, but blocked if you change the slash to a dot: nc 192/168.2.100 1234 This works too: nc \ 192.168.2.100 1234 OK, that's all for now. Can you b…
WAFs are 2000s-era software that have long overstayed their welcome: https://www.macchaffee.com/blog/2023/wafs/
Cloudflare has access to everyone's cleartext? I was unaware of this. NSA must love that
And every big company can decrypt your tls web traffic with their special CA keys.
This line works: nc -l -p 1234 -q 1 > testfile.txt The other one doesn't. alias foobar=nc cat testfile.txt | foobar 192.168.2.100 1234 I was hoping that it was a "useless use of cat" filter, but nope. It just doesn't like the bytes nc next to an IPv4 address. This is also fine, but blocked if you change the slash to a dot: nc 192/168.2.100 1234 This works too: nc \ 192.168.2.100 1234 OK, that's all for now. Can you b…
Good that there are open source alternatives: socat - TCP4:192.168.2.100:1234 socat TCP4-LISTEN:1234,fork,reuseaddr - https://www.redhat.com/sysadmin/getting-started-socat
Earlier quoted context omitted.
> Can you believe people pay money for "web application firewalls"? I think it's like a lot of things in computer security, in that system owners just don't want to be the slowest gazelle in the herd. If an attacker is mass-exploiting some new remote vulnerability, then maybe the WAF means that you're one of the lucky ones who doesn't get hit. And yes, that's a very big maybe there. WAFs don't do much to prevent targ…
They also have an organizational purpose. Once an attack happens you can shift the blame onto the WAF. And the WAF provider can, if needed, claim this to be a novel attack against which they have prepared for the future. Even issue an emergency patch that detects and blocks the novel backslash-newline line break technique. (I'm exaggerating here, but only a bit)
This line works: nc -l -p 1234 -q 1 > testfile.txt The other one doesn't. alias foobar=nc cat testfile.txt | foobar 192.168.2.100 1234 I was hoping that it was a "useless use of cat" filter, but nope. It just doesn't like the bytes nc next to an IPv4 address. This is also fine, but blocked if you change the slash to a dot: nc 192/168.2.100 1234 This works too: nc \ 192.168.2.100 1234 OK, that's all for now. Can you b…
Yes, they can be trivial to bypass. And yes, they don't block everything. But also, yes, they can be very useful in some situations.
My employer's security team maintains a WAF, and while it may be frustrating at times (like when anti-directory-traversal rules broke page names with '...' in them) I mostly prefer that they continue to do so for two big reasons: script kiddies and botnets.
It doesn't matter that a bypass is trivial when in practice your attacker won't mutate their attack -- if the attacker was more sophisticated, the defence could be too, but if the attack is dumb then there's no point in a sophisticated defence.
Botnets mean that purely reputation-based defence is insufficient. The best defence to a distributed attack is one that's really cheap to evaluate. If all an attacker ever tries is to hit our homepage with a fixed user agent string, then all we need to do is block that UA from hitting our home page. A simple WAF entry is sufficient to block that particular attacker.
This precise example is indeed poorly-applied, as the system is intended to receive arbitrary text of arbitrary technical complexity. But I wouldn't mind the rule being applied to my team's endpoints, as we can be confident that anyone sending shell has malicious intent regardless of whether there's any chance that my services would try to execute the code (they won't).
So long as it is possible to bring down services without any effort, skiddies will keep trying to do that. And so long as we've people trying dumb attacks in infrastructure, dumb defences can have a worthwhile effect. And if the dumb defences start catching stuff they're not supposed to catch, like the example with '...', they're dumb enough that we can understand why they're doing that and if we can safely turn them off.
So HN uses Cloudflare? That surprises me because typically I notice sites using Cloudflare because my mobile running GNU Linux cannot pass their dreaded Turnstyle. Luckily that does not happen for HN.
bummer. i used to like the legend that it was all on one commodity linux pc implemented in some nice concise lisp running on sbcl. edit: my memory is crap. it was a single machine, but the codebase was written in a custom experimental language that i think was a lisp derivative. (which would make sense!). the source was online at some time, can't find it now.
[0] https://news.ycombinator.com/item?id=38310213
Earlier quoted context omitted.
That makes using https instead of http a lot less relevant.
Hardly! Nobody is forcing you to consent to MITM, you freely choose it every time you voluntarily use a website that utilizes one.
That said, the choice is yours whether or not to use sites that utilize such untrustworthy MITM providers, like Cloudflare. There are even browser plugins that can automatically block connections to such untrustworthy entities.
This isn't an endorsement, and you should always review the source code of any browser extensions you're utilizing due to the risks extensions themselves can pose, but I personally use one called Cloud Firewall and it works great. (https://addons.mozilla.org/en-US/firefox/addon/cloud-firewal...)