Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Post Mortem: A single whitespace character

eatabit.com

Post reply on HN
Print view View original

81–90 of 209 posts

Re: Post Mortem: A single whitespace character

#81

Post by robomartin »

jrochkind1 wrote: post #7

This very example -- requests were technically illegal all the time without devs realizing, but something in the stack changed to start rejecting them -- demonstrates the fallacy of the "be liberal in what you accept, strict in what you issue" principal. If all the web servers involved had been strict in rejecting the illegal request from the start, they would have noticed the bug in development before deploying to f…

Not "principal", "principle".

Not being critical, just pointing out a common mistake.

http://blog.oxforddictionaries.com/2011/08/principle-or-prin...

Principal: Main, most important

Principle: A rule, a system of belief

Re: Post Mortem: A single whitespace character

#82

Post by pjc50 »

ctz wrote: post #58
pilif wrote: post #50

Likely "Cowboy" is a transparent proxy added by your mobile service provider. I had a similar thing happening a year ago when the mobile provider used by most of our barcode scanners decided to add a transparent proxy into the loop (without telling anybody). The solution for this problem: Use SSL. I mean: There are already many good reasons to use SSL, but whenever you need to send any kind of mission critical data o…

This would require a vast, vast upgrade of client power to achieve the same communications performance. If you could achieve it all, SSL would also likely decrease reliability over a spotty GSM link.

Is client CPU actually a limiting factor? How does this affect reliability?

Re: Post Mortem: A single whitespace character

#83

Post by pilif »

pavel_lishin wrote: post #66
pilif wrote: post #50

Likely "Cowboy" is a transparent proxy added by your mobile service provider. I had a similar thing happening a year ago when the mobile provider used by most of our barcode scanners decided to add a transparent proxy into the loop (without telling anybody). The solution for this problem: Use SSL. I mean: There are already many good reasons to use SSL, but whenever you need to send any kind of mission critical data o…

Who was replacing numbers with asterisks, and for what purpose?

That was a "privacy" mode of some personal firewall that was protecting the user's phone number from leaking out.

Incidentally, this has leaked the users phone number because only that specific numer was being replaced with asterisks.

Welcome to the world of very crappy "security" (-theater) end-user products.

Re: Post Mortem: A single whitespace character

#84

Post by mikeash »

srtjstjsj wrote: post #78
mikeash wrote: post #65

Earlier quoted context omitted.

A sufficiently smart compiler could optimize a string of strcat calls to remove the redundant length finding. I have no idea if real compilers actually would....

Java does, for the "+" operator.

Oh yes, nice example! So there's precedent for C compilers doing something similar.

Re: Post Mortem: A single whitespace character

#85

Post by pilif »

rubiquity wrote: post #73
pilif wrote: post #50

Likely "Cowboy" is a transparent proxy added by your mobile service provider. I had a similar thing happening a year ago when the mobile provider used by most of our barcode scanners decided to add a transparent proxy into the loop (without telling anybody). The solution for this problem: Use SSL. I mean: There are already many good reasons to use SSL, but whenever you need to send any kind of mission critical data o…

Cowboy is the name of an Erlang web server and Heroku uses Erlang for their routing. I imagine the reason Cowboy is showing up is due to Heroku's routing layer.

I would agree, but the fact that it suddenly stopped working points to carrier interference rather than Heroku (because as a developer focussed company, they would have informed OPs company of the change)

Re: Post Mortem: A single whitespace character

#86

Post by pjc50 »

pliny wrote: post #21
DanBC wrote: post #20

Earlier quoted context omitted.

Pizza has been used as a tool of harassment in the past. People order lots of pizza from different places for the victim, who then has to deal with a bunch of angry pizza drivers and being black-listed from those pizza places. Pizza drivers are often the victims of crime. Not only for the small amounts of cash that they carry, but sometimes just for the pizzas. edit: I should say that my comment here was a kneejerk r…

How are you going to exploit the fact that these pizza orders aren't encrypted to achieve either of those things?

Encrypt the pizzas.

Re: Post Mortem: A single whitespace character

#87

Post by goleksiak »

angersock wrote: post #80
goleksiak wrote: post #69

Earlier quoted context omitted.

We would really like to use HTTPS but it's not supported by the Arduino chipset as I understand it. Though I'm not the hardware guy here at eatabit...

Why don't you guys just use a Beaglebone Black ($50), M2M cape ( http://www.yantrr.com/products/m2m-cape-for-beaglebone ), and a thermal printer ( https://www.sparkfun.com/products/10438 ). BOM for that, plus project enclosure, is like $200. That's also just after a bit of quick googling...there's bound to be a much cheaper solution. What's your price point for hardware?

We are at about $200 now for hardware. We have a custom PCB and 3d printed case. We also have an LCD and some control knobs in the mix. Checking out the Beaglebone stuff now...very interesting since there is basically no 3G/4G modems for Arduino right now...

Re: Post Mortem: A single whitespace character

#88

Post by shawabawa3 »

pilif wrote: post #85
rubiquity wrote: post #73

Earlier quoted context omitted.

Cowboy is the name of an Erlang web server and Heroku uses Erlang for their routing. I imagine the reason Cowboy is showing up is due to Heroku's routing layer.

I would agree, but the fact that it suddenly stopped working points to carrier interference rather than Heroku (because as a developer focussed company, they would have informed OPs company of the change)

It seems it is on Heroku's end. https://news.ycombinator.com/item?id=8515164

Re: Post Mortem: A single whitespace character

#89

Post by goleksiak »

pilif wrote: post #83
pavel_lishin wrote: post #66

Earlier quoted context omitted.

Who was replacing numbers with asterisks, and for what purpose?

That was a "privacy" mode of some personal firewall that was protecting the user's phone number from leaking out. Incidentally, this has leaked the users phone number because only that specific numer was being replaced with asterisks. Welcome to the world of very crappy "security" (-theater) end-user products.

The asterisks hide this request's BasicAuth credentials between the cellular printer and our app servers...we don't transmit customer phone numbers between the printer and our app servers. Twilio transmits them to our app servers but that is HTTPS

Re: Post Mortem: A single whitespace character

#90

Post by lclarkmichalek »

goleksiak wrote: post #70
pavel_lishin wrote: post #66

Earlier quoted context omitted.

Who was replacing numbers with asterisks, and for what purpose?

I didn't want to hang our BasicAuth creds out to dry

You were sending them over http, so aren't they already kinda fucked?
Post reply on HN