Post Mortem: A single whitespace character • Hacker News Board

Re: Post Mortem: A single whitespace character

#101

Post by serf » Mon, Oct 27, 2014, 3:59 PM UTC

angersock wrote: post #94

goleksiak wrote: post #87

Earlier quoted context omitted.

We are at about $200 now for hardware. We have a custom PCB and 3d printed case. We also have an LCD and some control knobs in the mix. Checking out the Beaglebone stuff now...very interesting since there is basically no 3G/4G modems for Arduino right now...

I'm just curious why the default response is still to reach for an Arduino--much more powerful SoC chips are cheap these days.

larger pool of cheap developers, and a hook onto an ongoing popular trend (arduino gizmodery), cheap prototyping.

Re: Post Mortem: A single whitespace character

#102

Post by 3ds » Mon, Oct 27, 2014, 4:00 PM UTC

mischanix wrote: post #13

spydum wrote: post #6

The Server: cowboy tag is from an Erlang web server: https://github.com/ninenines/cowboy/blob/master/src/cowboy_p... I'm guessing around here would be interesting to add a test case to handle. As far as whose server this is? I'd guess Heroku or AWS, though it's plenty possible T-Mobile could have devised some proxy to inspect traffic, but seems unlikely they would do so with Cowboy?

It's simple enough to single out Heroku: $ cat

Your example fails with or without the whitespace. These work though:

Request

  printf 'GET / HTTP/1.1\r\nHost: example.herokuapp.com\r\n\r\n' |  nc example.herokuapp.com 80

Response

  HTTP/1.1 200 OK
  Connection: keep-alive
  Server: SimpleHTTP/0.6 Python/2.7.6

Request

  printf 'GET /  HTTP/1.1\r\nHost: example.herokuapp.com\r\n\r\n' |  nc example.herokuapp.com 80

Response

  HTTP/1.1 505 HTTP Version Not Supported
  Connection: close
  Server: Cowboy

Re: Post Mortem: A single whitespace character

#103

Post by goleksiak » Mon, Oct 27, 2014, 4:00 PM UTC

lclarkmichalek wrote: post #90

goleksiak wrote: post #70

Earlier quoted context omitted.

I didn't want to hang our BasicAuth creds out to dry

You were sending them over http, so aren't they already kinda fucked?

y, true

Re: Post Mortem: A single whitespace character

#104

Post by serf » Mon, Oct 27, 2014, 4:02 PM UTC

pjc50 wrote: post #82

ctz wrote: post #58

Earlier quoted context omitted.

This would require a vast, vast upgrade of client power to achieve the same communications performance. If you could achieve it all, SSL would also likely decrease reliability over a spotty GSM link.

Is client CPU actually a limiting factor? How does this affect reliability?

as someone unfamiliar with their specific workload, but who has used such boards to do vpn/ssl stuff, no -- it's not a limiting factor unless trying to skim power requirements.

Re: Post Mortem: A single whitespace character

#105

Post by shortstuffsushi » Mon, Oct 27, 2014, 4:02 PM UTC

kstrauser wrote: post #79

If this were my team, I would be unsettled by the fact that we never caught it in testing. Did no one write tests to exercise this part of the app - the one where we're handcrafting HTTP requests? Objectively, you need to write more tests. At the minimum, this bug should have a regression test so that it can never accidentally happen again (say when a dev merges an old branch in for whatever reason).

What test would you have written to catch this? One that checks the exact contents of headers passed along? It's possibly they even had tests around this, but were expecting the same output that they were inputting (copy+pasta). Perhaps they had a more "integration"-ee test that actually hit the web with that bad header. At the point they wrote it, that test would have been passing. It wasn't until the parsing server changed (to Coyote, it seems) that the test would have started to fail.

Re: Post Mortem: A single whitespace character

#106

Post by lmm » Mon, Oct 27, 2014, 4:03 PM UTC

jrochkind1 wrote: post #7

This very example -- requests were technically illegal all the time without devs realizing, but something in the stack changed to start rejecting them -- demonstrates the fallacy of the "be liberal in what you accept, strict in what you issue" principal. If all the web servers involved had been strict in rejecting the illegal request from the start, they would have noticed the bug in development before deploying to f…

The right thing, I think, is to "accept but warn". Like those web browsers that used to show a yellow exclamation mark in the status bar when something was off; web devs could check for this and fix it, but normal users were unaffected. More protocols should include a way to indicate "nonfatal errors".

Re: Post Mortem: A single whitespace character

#107

Post by ams6110 » Mon, Oct 27, 2014, 4:04 PM UTC

spydum wrote: post #6

The Server: cowboy tag is from an Erlang web server: https://github.com/ninenines/cowboy/blob/master/src/cowboy_p... I'm guessing around here would be interesting to add a test case to handle. As far as whose server this is? I'd guess Heroku or AWS, though it's plenty possible T-Mobile could have devised some proxy to inspect traffic, but seems unlikely they would do so with Cowboy?

Erlang is from Ericson, a telecom company. T-Mobile is a telecom company. Doesn't seem a stretch that they would use erlang.

Re: Post Mortem: A single whitespace character

#108

Post by lmm » Mon, Oct 27, 2014, 4:07 PM UTC

cleanCodeAtWork wrote: post #63

Are there any languages out there that handle scale and many connections like Erlang does, but with an easier to swallow syntax?

I've been very happy writing these things in Scala using Spray. Honestly there are plenty of event-driven I/O frameworks in many languages, and almost as many green-threading systems. The Erlang supervision system and the ability to replace code on the fly, not so much.

Re: Post Mortem: A single whitespace character

#109

Post by serf » Mon, Oct 27, 2014, 4:08 PM UTC

pliny wrote: post #21

DanBC wrote: post #20

Earlier quoted context omitted.

Pizza has been used as a tool of harassment in the past. People order lots of pizza from different places for the victim, who then has to deal with a bunch of angry pizza drivers and being black-listed from those pizza places. Pizza drivers are often the victims of crime. Not only for the small amounts of cash that they carry, but sometimes just for the pizzas. edit: I should say that my comment here was a kneejerk r…

How are you going to exploit the fact that these pizza orders aren't encrypted to achieve either of those things?

that's the wrong question to ask.

We're not (all) in the "think-of-things-to-do-with-stolen-information" business like so many others are; but many of us are we're in the "encrypt-all-the-things-so-that-information-isn't-stolen" business.

Re: Post Mortem: A single whitespace character

#110

Post by lmm » Mon, Oct 27, 2014, 4:08 PM UTC

gpvos wrote: post #64

ajanuary wrote: post #55

Earlier quoted context omitted.

I think you're reading it incorrectly. You can have an empty segment in the path. The BNF for a segment is: segment = *pchar Which according to RFC2234 section 3.6 means zero or more repetitions.

But then the server may still decide that an empty segment is so meaningless that it will refuse it. In fact, it would not be a smart move to just treat double slashes the same as single ones, because of relative URLs: a ".." segment only removes one slash, so the hierarchy levels would get messed up. thttpd is doing the smart thing here. As one of my teachers at university would say: the empty segment is also a segm…

The server can of course interpret the path as it wants, but it should allow an application running under the server to give 'foo//bar' a meaning if that application wants to, IMO.