Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply? • Hacker News Board

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#161

Post by Dylan16807 » Tue, Jan 16, 2024, 7:49 AM UTC

anonym29 wrote: post #160

Dylan16807 wrote: post #158

Earlier quoted context omitted.

An extension that tries to to block cloudflare is getting closer to making your original statement true, but it's still not true. There aren't obvious signs up front that a site is using cloudflare. Failure to spend time investigating is not "freely choosing it".

>There aren't obvious signs up front that a site is using cloudflare. You're joking, right? It takes 2 seconds to click the padlock in your browser, click through once more, and see "Verified by: Cloudflare, Inc". You don't even need to view the certificate. If 2 seconds and 2 clicks is too much time and effort, it's obviously not actually that important to the user in question.

https://www.cloudflare.com/ssl/keyless-ssl/

https://developers.cloudflare.com/ssl/edge-certificates/cust...

It's not always that simple.

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#162

Post by jiggawatts » Tue, Jan 16, 2024, 10:26 AM UTC

Dylan16807 wrote: post #157

jiggawatts wrote: post #79

Earlier quoted context omitted.

Even if they got the link, read it, they probably didn't fully understand the concepts. I wish this was a joke, but just last month I spent literally hours arguing with multiple people -- on shore -- that that kind of query rewrite/rejection approach was never going to work properly, and only properly parameterised queries were correct. Nope. Fix after fix, then fixes for the fixes, then workarounds for the glitches,…

> query rewrite/rejection approach was never going to work properly, and only properly parameterised queries were correct ...what do you mean by "rewrite/rejection"? If rewrite means "escaping strings using the database function designed for that purpose", then that approach works just fine . It's not comparable to rejection at all. If they were making their own version, then the underlying problem is that they were…

I mean that they were doing simple things like replacing a single quote (dangerous!) with a double single quote. E.g.: ' -> ''

That means that when a user called Bob O'Neill enters their name, instead of returning a HTTP/500 error, the database stores Bob O''Neill.[1]

Then when the user goes to edit their form, they will see O''Neill. Okay, oops, that's a mistake, let's just replace all double single quotes with a single quote when outputting HTML! Now it'll say O'Neil correctly!

Of course, if you enter some bad text with double single quotes via some other mechanism such as a CSV upload, there's a decent chance that'll it'll be incorrectly stripped. Perhaps in some mid-tier API, which will then interpret it as a single quote, resulting in an injection vulnerability (or data corruption) again.

That can be fixed with "mere" man months of effort instead of the minutes it would have taken to just use the parameterised queries like God intended.

Now that that nightmare is over once and for all... what to do about % symbols screwing up LIKE searches? I dunno, that's complicated, so let's just replace all...

... rinse, repeat, ad infinitum.

[1] Oh, oh, you assumed that the query engine would replace '' with ' and the database would store the correct text? Hah-haaa.... you assumed that this "fix" was applied only once! What's fun about band-aids is that they're so easy to accidentally layer three or four deep without even realising. More band-aids == more safe, am I right?

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#163

Post by whodev » Tue, Jan 16, 2024, 4:14 PM UTC

mac-chaffee wrote: post #104

jrockway wrote: post #71

This line works: nc -l -p 1234 -q 1 > testfile.txt The other one doesn't. alias foobar=nc cat testfile.txt | foobar 192.168.2.100 1234 I was hoping that it was a "useless use of cat" filter, but nope. It just doesn't like the bytes nc next to an IPv4 address. This is also fine, but blocked if you change the slash to a dot: nc 192/168.2.100 1234 This works too: nc \ 192.168.2.100 1234 OK, that's all for now. Can you b…

WAFs are 2000s-era software that have long overstayed their welcome: https://www.macchaffee.com/blog/2023/wafs/

I was kinda with you until you made this statement: > No, "defense in depth" is not a valid excuse to use a WAF anyway, because it provides no real defense!

I have to disagree here. You are making assumptions that every developer in an org will always do the correct thing and deploy code that won't be exploitable to SQL injections, XSS, file inclusion, etc... That's just not the case. I'm all for doing the correct thing, and not just performing security theater, but WAFs do offer some protection. You need multiple layers of security covering the holes that may left in other layers. And a WAF can be one of those layers of protection.

Re: Ask HN: Does Cloudflare block HN comments if you have code blocks in a reply?

#164

Post by Aachen » Thu, Jan 18, 2024, 8:36 AM UTC

fragmede wrote: post #151

Aachen wrote: post #137

Earlier quoted context omitted.

None of my sites have been in over a decade of hosting from a residential connection When it's needed, it's needed, but it amazes me how many people feel they need big brother protection for their personal blog and nextcloud

how many people do you piss off with the opinions you post on your blog? enough to warrant being DDoS'd by an emotionally stunted highschooler with their parents/stolen credit card and the ability to Google for a botnet?

Almost nobody who uses big brother as an individual ever does. What would anyone care about a nextcloud login panel? Or a reasonably civil personal blog? And yet they enable cloudflare for yet another small corner of the internet :(