Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

twitter.com

Post reply on HN
Print view View original

191–200 of 322 posts

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#191

Post by zeckalpha »

admax88q wrote: post #112
0xcde4c3db wrote: post #53

Earlier quoted context omitted.

Having been involved in meetings where "stop ship" was the phrase of the day, I'd bet money that the following at least vaguely resembles a real conversation: Engineer Alice: We should really fix this properly. Manager: How sure are you that the proper fix won't break something else for $BIG_CUSTOMERS who are responsible for $OBSCENE percent of this product line's revenue? Engineer Bob: Uh, ten percent on a good day?…

On HN its always big bad management who is the cause of every security problem or shoddy piece of engineering. If only that pesky management would screw off then we could do things "properly". You'd be suprieed at how many incompetent engineers there are out there. If "engineer" Alice in your story was actually competent they would never agree to implement the proposed "fix". Its not a fix. To pass it off as one woul…

Who hired the incompetent engineers?

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#192

Post by TeMPOraL »

amalcon wrote: post #77
0xcde4c3db wrote: post #53

Earlier quoted context omitted.

Having been involved in meetings where "stop ship" was the phrase of the day, I'd bet money that the following at least vaguely resembles a real conversation: Engineer Alice: We should really fix this properly. Manager: How sure are you that the proper fix won't break something else for $BIG_CUSTOMERS who are responsible for $OBSCENE percent of this product line's revenue? Engineer Bob: Uh, ten percent on a good day?…

I've been Engineer Alice before (not with a security issue, but a pretty bad systems issue). In case anyone is ever in that situation, here are some more productive replacements for that existential sigh (in that they sometimes work). Choose the one most suited to manager's biases. The cliches are important: think of it as giving manager an easy way to explain it to their manager. > Yes, but that would only help with…

How about:

No, it won't actually fix anything, it'll only look like it did for most trivial cases, and 6 hours after releasing it our company will be on the frontpage of Reddit.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#193

Post by da_chicken »

frjalex wrote: post #55
stavros wrote: post #3

I don't see what the fuss is about. This is an effective mitigation, given that software can't just arbitrarily lie about its user agent.

libcurl is open source, I would imagine it'd not be difficult to make it "lie."

(Hint: the curl command already has a --user-agent parameter which allows the user to set the user agent string.)

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#194

Post by robertcope »

gdfasfklshg4 wrote: post #156
0xcde4c3db wrote: post #53

Earlier quoted context omitted.

Having been involved in meetings where "stop ship" was the phrase of the day, I'd bet money that the following at least vaguely resembles a real conversation: Engineer Alice: We should really fix this properly. Manager: How sure are you that the proper fix won't break something else for $BIG_CUSTOMERS who are responsible for $OBSCENE percent of this product line's revenue? Engineer Bob: Uh, ten percent on a good day?…

In similar situations I 1. Explain that the 'hack' does not actually fix the problem. This is absolutely the engineers responsibility. In your example Alice does not say that. This has always been sufficient. 2. I make a habit of sending emails or keeping minutes confirming such meetings and the details of who said what.

This is about all you can do. But you're right. You have to explain it and document it: "It's trivial to change User-Agent, and any decent hacker would probably not be using 'curl' as their User-Agent. We can look at logs from past events to validate this assumption."

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#195

Post by lr4444lr »

admax88q wrote: post #124
astrobe_ wrote: post #123

Earlier quoted context omitted.

You live in a nice world, because usually the actual power (and duty) of a dev team member is to advise, not to agree or refuse.

You can always quit. Or force them to fire you for refusing to implement a non fix. In reality though I doubt this narrative even occurred. Some incompetent engineer likely proposed this fix thinking that it was actually a fix. Edit: I see I've been downvoted for this comment. If we were real engineers working on things like cars and bridges we'd actually be held accountable. Take some pride in your work people, this…

I like your spirit, but there's another conclusion we can draw: very few of us outside of a few special areas in embedded are "engineers". We tinker with bits and bytes to make business systems. Sometimes we bump up against some general engineering fundamentals. But we're just technicians meeting business goals.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#196

Post by lewisj489 »

baggy_trough wrote: post #25
MiddleEndian wrote: post #20

User agents shouldn't exist any more. They serve only to help unsuspecting users be fingerprinted.

Rubbish. They are incredibly useful for debugging.

You're writing your websites wrong.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#197

Post by madengr »

FearNotDaniel wrote: post #189
pjmlp wrote: post #185

Earlier quoted context omitted.

Thankfully there are countries where Engineer is still a proper word, not something that you are allowed to call yourself after a 6 month bootcamp.

Yup, in the UK it bugs me when I keep meeting people who introduce themselves as an 'engineer'. When I ask them if they do mechanical or civil engineering, then I usually get to say "ah, so you're a programmer, just like me". One thing I did sometimes like about being in Austria is the obsession with academic titles they have there... if somebody is a qualified engineer, they invariably use "Ing" as a title in place…

What is qualified in Austria? In the USA, in most states, you must be licensed to have engineering in your business name. Your name is usually suffixed with PE.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#198

Post by madengr »

philpem wrote: post #176
adrianN wrote: post #150

Earlier quoted context omitted.

If there were actual accountability, software engineers would have a much better lever against management. For some software this is case. If you write safety critical software you can be held personally responsible for accidents. In those industries engineer pushback is much more effective.

My background is safety-critical and -- speaking from first-hand experience -- it was truly incredible how much push-back we'd get when raising safety issues. System tick timer rolled over after 2^32 1ms clock ticks (a little over seven weeks) and the software mishandled it by rebooting and losing control of the process. It wasn't until QA got involved (it turned out they saw it on a long-term test) that we were clea…

Ha ha, a resistor on every pin is a signal integrity hack.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#199

Post by AnIdiotOnTheNet »

admax88q wrote: post #112
0xcde4c3db wrote: post #53

Earlier quoted context omitted.

Having been involved in meetings where "stop ship" was the phrase of the day, I'd bet money that the following at least vaguely resembles a real conversation: Engineer Alice: We should really fix this properly. Manager: How sure are you that the proper fix won't break something else for $BIG_CUSTOMERS who are responsible for $OBSCENE percent of this product line's revenue? Engineer Bob: Uh, ten percent on a good day?…

On HN its always big bad management who is the cause of every security problem or shoddy piece of engineering. If only that pesky management would screw off then we could do things "properly". You'd be suprieed at how many incompetent engineers there are out there. If "engineer" Alice in your story was actually competent they would never agree to implement the proposed "fix". Its not a fix. To pass it off as one woul…

It really is amazing the kind of mental gymnastics HN commenters will display in order to shift the blame to everybody else, isn't it?

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#200

Post by sbmassey »

StavrosK wrote: post #9
beachy wrote: post #4

Earlier quoted context omitted.

Eh? Software can do exactly that.

How? Do you think developers would be so crazy as to add some sort of "--user-agent" option to software like curl that would cause arbitrary strings to be presented as the user agent? Why would somebody write software to do this, just go on the internet and tell lies?

Only software developers with no honour would ever do that.
Post reply on HN