Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Post Mortem: A single whitespace character

eatabit.com

Post reply on HN
Print view View original

51–60 of 209 posts

Re: Post Mortem: A single whitespace character

#51

Post by jdmichal »

antirez wrote: post #27
ajanuary wrote: post #15

Earlier quoted context omitted.

Doesn't it just demonstrate that you shouldn't switch from being liberal to being strict? For it to hold up, you need to provide the further argument that you frequently need to switch from liberal to strict.

Or... here the problem is that the "be liberal in what you accept" design principle failed to be captured by the HTTP specification writer, that forced a single SP character. It looks like a specification issue to me to use a syntax which is very prone to errors, and is even not much visible (you can't easily inspect double spaces in protocol traces when checking just with your eyes), and then be strict about it. Eve…

Especially when you have display technologies like HTML that will actively compress whitespace... As happened in your last example.

Re: Post Mortem: A single whitespace character

#52

Post by Someone1234 »

goleksiak wrote: post #25
DanBC wrote: post #20

Earlier quoted context omitted.

Pizza has been used as a tool of harassment in the past. People order lots of pizza from different places for the victim, who then has to deal with a bunch of angry pizza drivers and being black-listed from those pizza places. Pizza drivers are often the victims of crime. Not only for the small amounts of cash that they carry, but sometimes just for the pizzas. edit: I should say that my comment here was a kneejerk r…

We use Twilio so we know our customer's phone numbers. If there were ever an issue like this, we could easily assist with a request by law enforcement.

Something something $1 SIM card from eBay.

Re: Post Mortem: A single whitespace character

#53

Post by userbinator »

zimpenfish wrote: post #49
michaelmior wrote: post #46

Earlier quoted context omitted.

That's an interesting idea. It would be useful to have a Web server where the output is just a conformance check of the request. That might be a fun project for a rainy day :)

Sounds like something that could be added to http://httpbin.org

That runs on Python/Flask, which is already a layer of abstraction above where HTTP conformance testing would be; what you need is something that listens on a TCP socket and parses the requests itself.

Re: Post Mortem: A single whitespace character

#54

Post by michaelmior »

zimpenfish wrote: post #49
michaelmior wrote: post #46

Earlier quoted context omitted.

That's an interesting idea. It would be useful to have a Web server where the output is just a conformance check of the request. That might be a fun project for a rainy day :)

Sounds like something that could be added to http://httpbin.org

True. The only problem is that you would have to test requests only to a particular endpoint. It would be nice if you could test all incoming requests. Then you could do things like modify your DNS so any requests go to the testing server and you could see the output.

Re: Post Mortem: A single whitespace character

#55

Post by ajanuary »

zimpenfish wrote: post #45
stevekemp wrote: post #43

Earlier quoted context omitted.

The thttpd webserver doesn't handle requests with too many slashes either, which I only found out recently This is treated as an invalid request: http://example.com//robots.txt

Unless I'm reading RFC 3986 incorrectly, that's valid because you can't have an empty segment in the path part of a URI.

I think you're reading it incorrectly.

You can have an empty segment in the path. The BNF for a segment is:

    segment       = *pchar
Which according to RFC2234 section 3.6 means zero or more repetitions.

Re: Post Mortem: A single whitespace character

#56

Post by KMag »

When learning OCaml, I decided to write a little web client that would bruit force the password on my own home router. I wrote a client, and my router wasn't responding, so I tried having my client fetch pages from Yahoo, and it worked fine.

I fired up wireshark and saw that everything looked fine... except that all of my line terminators were shift-in-formfeed instead of carriage-return-newline. It turns out that OCaml uses decimal character escapes instead of octal. (This was back when I was under the impression that portable code avoided use of \n in string literals because someone who misunderstood text mode file handles had told me that Microsoft compilers expanded \n to \015\012.)

Apparently someone at Yahoo had experienced enough terribly terribly written web clients that they wrote their HTTP server to accept any two non-space whitespace characters as a line ending.

Re: Post Mortem: A single whitespace character

#58

Post by ctz »

pilif wrote: post #50

Likely "Cowboy" is a transparent proxy added by your mobile service provider. I had a similar thing happening a year ago when the mobile provider used by most of our barcode scanners decided to add a transparent proxy into the loop (without telling anybody). The solution for this problem: Use SSL. I mean: There are already many good reasons to use SSL, but whenever you need to send any kind of mission critical data o…

This would require a vast, vast upgrade of client power to achieve the same communications performance. If you could achieve it all, SSL would also likely decrease reliability over a spotty GSM link.

Re: Post Mortem: A single whitespace character

#59

Post by userbinator »

Danieru wrote: post #28

That series of strcat's caught my eye as bad practice. Fine in this case since the destination string is short but horrible in general. Every single one of those calls needs to iterate over the entire existing string to find the string size. The code could be much cleaner with a small macro hiding the incrementation and the casts.

Basically it's an O(n^2) algorithm... well-known story about that here:

http://www.joelonsoftware.com/articles/fog0000000319.html

The design of strcat() itself is partially to blame for this - the return value could've been more useful, like the number of characters in the resulting string or a pointer to the end of the appended string so it could be used to chain concatenations, but instead they chose to return the exact same pointer that was passed in as the source.

Post reply on HN