Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web Security is Too Hard

textslashplain.com

Post reply on HN
Print view View original

41–50 of 127 posts

Re: Web Security is Too Hard

#41

Post by epochbtc »

OkayPhysicist wrote: post #34
epochbtc wrote: post #20

Ironically, this might be at least partially because the internal security controls at Cloudflare for using or provisioning new domains/subdomains is so difficult and arduous that the team decided the fastest way to go to market is to get an entirely new domain. Possible bonus that the official bug bounty program won't apply either, since it's on a new domain so any vulnerabilities found won't have to be paid out (as…

Why is this so, so common? They're subdomains. They're free. It's not hitting anybody's budget to publish a new DNS entry. If someone has permission to publish anything in your name, they probably should be able to go make themselves a subdomain.

Counter-argument is: do you really want some team of 90% marketers and PMs throwing up a MVP/WIP codebase for some ancillary product not related to your core business on your core domain? At a minimum you'd want a thorough security review and risk assessment, and that goes against the ethos of "ship fast and pivot as needed".

Re: Web Security is Too Hard

#42

Post by applfanboysbgon »

LocalH wrote: post #21

Web security wasn't hard before we started trying to make the web a platform for full executable software. I never got hacked through the web before JavaScript (never got hacked after either, yet, but it wasn't really possible in the same way to hack someone through the web without some way to execute program logic , which in the old days would have required a much more specific browser exploit to gain RCE). JavaScri…

> "The web" was never designed to be an application platform. It was only designed to be a document platform.

And then it expanded to serve the needs of billions of people instead of the needs of a few researchers. Womp, womp. Get over it, use a JS-free browser to browse your documents, and accept that the world has moved on. Or don't, and rant at clouds, I guess.

Re: Web Security is Too Hard

#43

Post by edent »

OkayPhysicist wrote: post #34
epochbtc wrote: post #20

Ironically, this might be at least partially because the internal security controls at Cloudflare for using or provisioning new domains/subdomains is so difficult and arduous that the team decided the fastest way to go to market is to get an entirely new domain. Possible bonus that the official bug bounty program won't apply either, since it's on a new domain so any vulnerabilities found won't have to be paid out (as…

Why is this so, so common? They're subdomains. They're free. It's not hitting anybody's budget to publish a new DNS entry. If someone has permission to publish anything in your name, they probably should be able to go make themselves a subdomain.

Because they point foo.example.com to AWS. They then let whatever the CNAME is pointing to lapse. Then an attacker registers the lapsed AWS and can now put their content on your trusted domain.

https://aws.amazon.com/blogs/security/threat-tactic-spotligh...

(AWS have since fixed this problem, but it exists on other services.)

Re: Web Security is Too Hard

#44

Post by ozim »

Web Developers, please follow every best practice, I’m begging you

Marketing people just make bunch of marketing domains. Business people push all kind of BS ideas.

No one is asking Web Developers about their opinion man.

STOP making everything developers fault.

Re: Web Security is Too Hard

#46

Post by ryandrake »

epochbtc wrote: post #41
OkayPhysicist wrote: post #34

Earlier quoted context omitted.

Why is this so, so common? They're subdomains. They're free. It's not hitting anybody's budget to publish a new DNS entry. If someone has permission to publish anything in your name, they probably should be able to go make themselves a subdomain.

Counter-argument is: do you really want some team of 90% marketers and PMs throwing up a MVP/WIP codebase for some ancillary product not related to your core business on your core domain? At a minimum you'd want a thorough security review and risk assessment, and that goes against the ethos of "ship fast and pivot as needed".

Why does the TLD matter in this case? How does your security/risk posture change if you launch on myexperiment.mycompany.com vs. www.mycompanyexperiment.website that you had to go out and newly purchase? Asking because I legit don't know.

Re: Web Security is Too Hard

#47

Post by saghm »

wslh wrote: post #14
mirashii wrote: post #12

Earlier quoted context omitted.

What’s the point? To save money paying a human to man a support email. That human would have also been hopelessly uninformed for all the same reasons.

And as a dark pattern it adds "positive friction" for the company reducing the number of people that will have the motivation of obtaining the real people support.

Several weeks ago I had an issue not being able to login to Verizon's website, so I tried to chat with someone. The chatbot that was gatekeeping was predictably useless said it would redirect me to a human except...it kept prompting me to log in first. It was literally impossible to differentiate from if they literally had no humans online to talk to at all.

Re: Web Security is Too Hard

#48

Post by saghm »

Groxx wrote: post #28
mirashii wrote: post #12

Earlier quoted context omitted.

What’s the point? To save money paying a human to man a support email. That human would have also been hopelessly uninformed for all the same reasons.

If you have no training or knowledge-base to search, sure. But then you'd be an awful support-team employer.

I mean, yes? That sounds pretty accurate for most companies before chatbots became the new hot thing

Re: Web Security is Too Hard

#49

Post by sandeepkd »

vntok wrote: post #40
sholladay wrote: post #25

Earlier quoted context omitted.

> That human would have also been hopelessly uninformed for all the same reasons. Not really. At minimum, a half-way decent support person would ask a few people internally or search Slack before answering. In fact, they would have likely already heard about the new product at lunch or something.

> At minimum, a half-way decent support person would ask a few people internally or search Slack before answering. Of course not. The extremely vast majority of support staff aren't connected to "internal people" and certainly don't have any access to the main company's Slack. Most of all, those people are paid very little on very tight length-per-interaction targets. They can't spend any time at all looking for stuf…

Its an organic cycle, as the company grows big the number of relevant areas grow too and inter team communication becomes way too costly/impractical. The big company becomes a group of informal small companies, each running in their own direction and at times competing with each other. Areas like customer support are not really good candidate for career growth so they get least resources and manpower.

Re: Web Security is Too Hard

#50

Post by joemi »

It looks like they've updated the cloudflare.pay site to link to the blog post on cloudflare.com that introduces wallets. So they fixed it on the same day they launched. That's not too bad, in my book.
Post reply on HN