Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Post Mortem: A single whitespace character

eatabit.com

Post reply on HN
Print view View original

21–30 of 209 posts

Re: Post Mortem: A single whitespace character

#21

Post by pliny »

DanBC wrote: post #20
davidrusu wrote: post #16

Earlier quoted context omitted.

Why? it's just pizza

Pizza has been used as a tool of harassment in the past. People order lots of pizza from different places for the victim, who then has to deal with a bunch of angry pizza drivers and being black-listed from those pizza places. Pizza drivers are often the victims of crime. Not only for the small amounts of cash that they carry, but sometimes just for the pizzas. edit: I should say that my comment here was a kneejerk r…

How are you going to exploit the fact that these pizza orders aren't encrypted to achieve either of those things?

Re: Post Mortem: A single whitespace character

#22

Post by davidw »

mischanix wrote: post #13
spydum wrote: post #6

The Server: cowboy tag is from an Erlang web server: https://github.com/ninenines/cowboy/blob/master/src/cowboy_p... I'm guessing around here would be interesting to add a test case to handle. As far as whose server this is? I'd guess Heroku or AWS, though it's plenty possible T-Mobile could have devised some proxy to inspect traffic, but seems unlikely they would do so with Cowboy?

It's simple enough to single out Heroku: $ cat

Heroku use Erlang:

http://www.erlang-in-anger.com/

Re: Post Mortem: A single whitespace character

#23

Post by jlouis »

This proves a very important pet peeve of mine: Your modern application has a highly dynamic operating point. There is no way you can deploy a system and expect it to be static for eternity. Back in the day with low interconnectivity you could. But today it is impossible.

When you build stacks on top of system for which you have no direct control, you must be able to adapt your system. This means you can't statically deploy code without an upgrade path in one way or the other.

Re: Post Mortem: A single whitespace character

#24

Post by goleksiak »

davidrusu wrote: post #16
colinbartlett wrote: post #10

It scares me to think all of these requests run over unencrypted HTTP.

Why? it's just pizza

Yes, it's just pizza - no ccards or personal information is transmitted - except your choice of toppings. Could that be used to profile you? "...paging Dr. Freud"

Re: Post Mortem: A single whitespace character

#25

Post by goleksiak »

DanBC wrote: post #20
davidrusu wrote: post #16

Earlier quoted context omitted.

Why? it's just pizza

Pizza has been used as a tool of harassment in the past. People order lots of pizza from different places for the victim, who then has to deal with a bunch of angry pizza drivers and being black-listed from those pizza places. Pizza drivers are often the victims of crime. Not only for the small amounts of cash that they carry, but sometimes just for the pizzas. edit: I should say that my comment here was a kneejerk r…

We use Twilio so we know our customer's phone numbers. If there were ever an issue like this, we could easily assist with a request by law enforcement.

Re: Post Mortem: A single whitespace character

#27

Post by antirez »

ajanuary wrote: post #15
jrochkind1 wrote: post #7

This very example -- requests were technically illegal all the time without devs realizing, but something in the stack changed to start rejecting them -- demonstrates the fallacy of the "be liberal in what you accept, strict in what you issue" principal. If all the web servers involved had been strict in rejecting the illegal request from the start, they would have noticed the bug in development before deploying to f…

Doesn't it just demonstrate that you shouldn't switch from being liberal to being strict? For it to hold up, you need to provide the further argument that you frequently need to switch from liberal to strict.

Or... here the problem is that the "be liberal in what you accept" design principle failed to be captured by the HTTP specification writer, that forced a single SP character. It looks like a specification issue to me to use a syntax which is very prone to errors, and is even not much visible (you can't easily inspect double spaces in protocol traces when checking just with your eyes), and then be strict about it. Even changing separator, if you want to be strict, already helps, like in "foo|bar|zap" compared to "foo bar zap".

Humans are strage: many will spot "foo||bar|zap" as an error, but not "foo bar zap" as an error as serious as the previous one.

Re: Post Mortem: A single whitespace character

#28

Post by Danieru »

That series of strcat's caught my eye as bad practice. Fine in this case since the destination string is short but horrible in general. Every single one of those calls needs to iterate over the entire existing string to find the string size. The code could be much cleaner with a small macro hiding the incrementation and the casts.

Re: Post Mortem: A single whitespace character

#29

Post by DanBC »

pliny wrote: post #21
DanBC wrote: post #20

Earlier quoted context omitted.

Pizza has been used as a tool of harassment in the past. People order lots of pizza from different places for the victim, who then has to deal with a bunch of angry pizza drivers and being black-listed from those pizza places. Pizza drivers are often the victims of crime. Not only for the small amounts of cash that they carry, but sometimes just for the pizzas. edit: I should say that my comment here was a kneejerk r…

How are you going to exploit the fact that these pizza orders aren't encrypted to achieve either of those things?

PIZZA IS SRS BSNS

Re: Post Mortem: A single whitespace character

#30

Post by goleksiak »

jlouis wrote: post #23

This proves a very important pet peeve of mine: Your modern application has a highly dynamic operating point. There is no way you can deploy a system and expect it to be static for eternity. Back in the day with low interconnectivity you could. But today it is impossible. When you build stacks on top of system for which you have no direct control, you must be able to adapt your system. This means you can't statically…

True but that doesn't bother me. Nothing is static on the web these days and everyone plays under the same rule set. Keeps things interesting...
Post reply on HN