Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Writing "/etc/hosts" breaks the Substack editor

scalewithlee.substack.com

Post reply on HN
Print view View original

181–190 of 370 posts

Re: Writing "/etc/hosts" breaks the Substack editor

#181

Post by rhdunn »

Bluecobra wrote: post #171
coldpie wrote: post #66

Earlier quoted context omitted.

> There is a temptation to just turn the rules off Definitely, though I have seen other solutions, like inserting non-printable characters in the problematic strings (e.g. "/etc/ho sts" or whatever, you get the idea). And honestly that seems like a reasonable, if somewhat annoying, workaround to me that still retains the protections.

Another silly workaround would be to take a screenshot of “/etc/hosts” and use images instead. Would break text browsers/reading mode though.

And accessibility.

Re: Writing "/etc/hosts" breaks the Substack editor

#182

Post by swyx »

substack also does wonderful things like preserve weird bullet points, lack code block displays, and make it impossible to customize the landing page of your site beyond the 2 formats they give you.

generally think that Substack has done a good thing for its core audience of longform newsletter writer creators who want to be Ben Thompson. however its experience for technical people, for podcasters, for people who want to start multi-channel media brands, and for people who write for reach over revenue (but with optional revenue) has been really poor. (all 4 of these are us with Latent.Space). I've aired all these complaints with them and theyve done nothing, which is their prerogative.

i'd love for "new Substack" to emerge. or "Substack for developers".

Re: Writing "/etc/hosts" breaks the Substack editor

#183

Post by swyx »

teraflop wrote: post #161
ycombinatrix wrote: post #150

Earlier quoted context omitted.

Why would someone "sanitize" OutOfMemoryException out of their logs? That is a silly point to make.

The point is not to sanitize known strings like "OutOfMemoryException". The point is to sanitize or (preferably) escape any untrusted data that gets logged, so that it won't be confused for something else.

i think GP's point is how would you even sanitize the string "OutOfMemoryException" which presumably comes from a trusted system

i guess demanding "Structured logs for everything or bust" is the answer? (i'm not a big o11y guy so pardon me if this is obvious)

Re: Writing "/etc/hosts" breaks the Substack editor

#184

Post by swyx »

elevation wrote: post #62
CoffeeOnWrite wrote: post #49

Earlier quoted context omitted.

(I’m in the anti-WAF camp) That does stand to improve your posture by giving you the ability to quickly apply duct tape to mitigate an active mild denial of service attack. It’s not utterly useless.

Doesn't it also add latency to every request?

sure but how much? 3-10ms is fine for the fast protection when shit hits the fan.

Re: Writing "/etc/hosts" breaks the Substack editor

#185

Post by kevincox »

eli wrote: post #28
Y_Y wrote: post #7

Does it block `/etc//hosts` or `/etc/./hosts`? This is a ridiculous kind of whack-a-mole that's doomed to failure. The people who wrote these should realize that hackers are smarter and more determined than they are and you should only rely on proven security, like not executing untrusted input.

Is a security solution worthless if it can't stop a dedicated attacker? A lot of WAF rules are blocking probes from off-the-shelf vulnerability scanners.

IMHO the primary value for WAFs is for quickly blocking known vulnerabilities with specific rules to mitigate vulnerabilities while they are being properly patched. Ideally the WAF knows what software is behind it (example WordPress, Java app, ...) and can apply filters that may be relevant.

Anything else is just a fuzzy bug injector that will only stop the simplest scanners and script kiddies if you are lucky.

Re: Writing "/etc/hosts" breaks the Substack editor

#186

Post by spydum »

stingraycharles wrote: post #87
matt_heimer wrote: post #36

The people configuring WAF rules at CDNs tend to do a poor job understanding sites and services that discuss technical content. It's not just Cloudflare, Akamai has the same problem. If your site discusses databases then turning on the default SQL injection attack prevention rules will break your site. And there is another ruleset for file inclusion where things like /etc/hosts and /etc/passwd get blocked. I disagree…

Yup. Were a database company that needs to be compliant with SOC2, and I’ve had extremely long and tiring arguments with our auditor why we couldn’t adhere to some of these standard WAF rulesets because it broke our site (we allow people to spin up a demo env and trigger queries). We changed auditors after that.

sounds like your security policy is wrong (or doesnt have a provision for exceptions managed by someone with authority to grant them), or your auditor was swerving out of his lane. As far as I've seen: SOC2 doesn't describe any hard security controls - it just asks to evaluate your policy versus your implemented controls.

Re: Writing "/etc/hosts" breaks the Substack editor

#188

Post by 9x39 »

kiitos wrote: post #173
simonw wrote: post #148

Earlier quoted context omitted.

I found an example! https://retail.direct.zurich.ch/resources/definition/product... Questionnaire Zurich Cyber Insurance Question 4.2: "Do you have a technically enforced password policy that ensures use of strong passwords and that passwords are changed at least quarterly?" Since this is an insurance questionnaire, presumably your answers to that question affect the rates you get charged? (Found that with the help o…

Directly following is question 4.3: "Are users always prevented from installing programs on end-user devices?" Totally bonkers stuff.

A trend for corporate workstations is moving closer to a phone with a locked-down app store, with all programs from a company software repo.

Eliminating everything but a business's industry specific apps, MS Office, and some well-known productivity tools slashes support calls (no customization!) and frustrates cyberattacks to some degree when you can't deploy custom executables.

Re: Writing "/etc/hosts" breaks the Substack editor

#189

Post by dusanz »

owebmaster wrote: post #157
ycombinatrix wrote: post #150

Earlier quoted context omitted.

Why would someone "sanitize" OutOfMemoryException out of their logs? That is a silly point to make.

An OutOfMemoryException log should not be the same as a search log Error: OutOfMemoryException And Search: OutOfMemoryException Should not be related in any way

Until someone searches for "Error: OutOfMemoryException"

Re: Writing "/etc/hosts" breaks the Substack editor

#190

Post by 9x39 »

tmpz22 wrote: post #156
betaby wrote: post #100

Earlier quoted context omitted.

> but a lot of seemingly dumb security policies are due to insurers. I keep hearing that often on HN, however I've personally never seen seen such demands from insurers. I would greatly appreciate if one share such insurance policy. Insurance policies are not trade secrets and OK to be public. I can google plenty of commercial cars insurance policies for example.

This is such an important comment. Fear of a prospective expectation , compliance, requirement, etc., even when that requirement does not actually exist is so prevalent in the personality types of software developers.

It cuts both ways. I've struggled to get things like backups or multifactor authentication approved without being able to point to some force like regulation or insurance providers that can dislodge executives' inertia.

My mental model at this point says that if there's a cost to some important improvement, the politics and incentives today are such that a typical executive will only do the bare minimum required by law or some equivalent force, and not a dollar more.

Post reply on HN