Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Writing "/etc/hosts" breaks the Substack editor

scalewithlee.substack.com

Post reply on HN
Print view View original

191–200 of 370 posts

Re: Writing "/etc/hosts" breaks the Substack editor

#191

Post by Wowfunhappy »

foobarchu wrote: post #153
Wowfunhappy wrote: post #72

Earlier quoted context omitted.

Maybe it wouldn't make a difference, but if I was the IT person telling users they have to change their passwords every 90 days, I would 100% include a line in the email blaming the insurance company.

I'm not in an IT dept (developer instead), but I'd bet money that would get you a thorough dressing down by an executive involved with the insurance. That sort of blaming goes over well with those at the bottom of the hierarchy, and poorly with those at the top.

The insurance people are not a part of the company, so I'm not sure who would be offended.

I wouldn't be mean about it. I'm imagining adding a line to the email such as:

> (Yes, I know this is annoying, but it's required by our insurance company.)

What is the insurance company going to do, jack up our rates because we accurately stated what their policy was?

Re: Writing "/etc/hosts" breaks the Substack editor

#192

Post by wat10000 »

gfiorav wrote: post #170
wat10000 wrote: post #133

Earlier quoted context omitted.

Sorry, we have to reject your comment due to security. The text "Cloudflare s" is a potential SQL injection.

You know, I get the spirit of this criticism. But, specially in the age of AI, we're going to get thousands of barely reviewed websites on Cloudflare. If you know what you're doing, turn these protections off. If you don't, there's one less hole out there.

In all seriousness, I don't see the justification for blocking "/etc/hosts" but allowing "'". The latter is probably a million times more likely to trigger a vulnerability.

Re: Writing "/etc/hosts" breaks the Substack editor

#193

Post by PhilipRoman »

dusanz wrote: post #189
owebmaster wrote: post #157

Earlier quoted context omitted.

An OutOfMemoryException log should not be the same as a search log Error: OutOfMemoryException And Search: OutOfMemoryException Should not be related in any way

Until someone searches for "Error: OutOfMemoryException"

If structured logging is too much, unique prefixes solve this issue. Basically you need some token that user provided data is unable to output to the log. If you rigorously escape all newlines, you can then use start-of-line and end-of-line as unforgeable tokens. The possibilities are endless and it all comes down to understanding whether the intersection of two grammars is empty.

Re: Writing "/etc/hosts" breaks the Substack editor

#194

Post by rmccue »

swyx wrote: post #182

substack also does wonderful things like preserve weird bullet points, lack code block displays, and make it impossible to customize the landing page of your site beyond the 2 formats they give you. generally think that Substack has done a good thing for its core audience of longform newsletter writer creators who want to be Ben Thompson. however its experience for technical people, for podcasters, for people who wan…

Ben Thompson is working on Passport, which seems to be a self-hosted (WordPress-based) Substack: https://stratechery.com/2021/passport/

He gave a talk on it at WordCamp Asia at the start of last year, although I haven’t heard of any progress recently on it.

Re: Writing "/etc/hosts" breaks the Substack editor

#195

Post by tryauuum »

godelski wrote: post #162

I don't get it. Why aren't those files just protected so they have no read or write permissions? Isn't this like the standard way to do things? Put the blog in a private user space with minimal permissions. Why would random text be parsed? I read the article but this doesn't make sense to me. They suggested directory transversal but your text shouldn't have anything to do with that and transversal is solved by permis…

this is the usual approach with web application firewalls, block all the 100500 known attacks. Doesn't matter if they are not applicable to your website. Some of them are obviously OS-depended (having .exe in the URLs) but it doesn't matter, it's blocked just in case

I do understand this appoach. From the defence point of view it makes sense, if you have to create a solution to protect millions of websites it doesn't make sense to tailor it to specifics of a single one

Re: Writing "/etc/hosts" breaks the Substack editor

#196

Post by PhilipRoman »

swyx wrote: post #183
teraflop wrote: post #161

Earlier quoted context omitted.

The point is not to sanitize known strings like "OutOfMemoryException". The point is to sanitize or (preferably) escape any untrusted data that gets logged, so that it won't be confused for something else.

i think GP's point is how would you even sanitize the string "OutOfMemoryException" which presumably comes from a trusted system i guess demanding "Structured logs for everything or bust" is the answer? (i'm not a big o11y guy so pardon me if this is obvious)

Low tech example: escape all newlines in user supplied strings, then add a known prefix to all user supplied data (let's say a double hashtag ##, but anything else works too). When you want to search logs for strings coming from your system, remove/ignore everything after the marker.

It all comes down to understanding whether the intersection of two grammars is empty.

Re: Writing "/etc/hosts" breaks the Substack editor

#197

Post by MatthiasPortzel »

latexr wrote: post #53
mystifyingpoi wrote: post #26

Earlier quoted context omitted.

Maybe? I don't know nor care. Assuming that HN has a vuln with path traversal, a sanely configured WAF would block the traversal attempt.

I propose someone who doesn’t know or care how a system works shouldn’t be prescribing what to do to make it secure. Otherwise this is like suggesting every gate must have a lock to be secure, even those which aren’t connected to any walls. https://i.imgur.com/ntYUQB1.jpeg

> someone who doesn’t know or care how a system works shouldn’t be prescribing what to do to make it secure

The part that’s not said outloud is that a lot of “computer security” people aren’t concerned with understanding the system. If they were, they’d be engineers. They’re trying to secure it without understanding it.

Re: Writing "/etc/hosts" breaks the Substack editor

#198

Post by 9x39 »

wat10000 wrote: post #137
p_ing wrote: post #99

Earlier quoted context omitted.

Locks are a speedbump for a lockpick. Doors are a speedbump for a car. Well yeah, sure, doesn't mean I'm going to have an open doorframe or a door without a lock.

The difference is that a door tends to be the only thing between you and an attacker. A speedbump is better than nothing. This isn't like having a lock on your door, this is like having a cheap, easily pickable padlock on your bank vault. If the vault has a proper lock then the padlock serves no purpose, and if it doesn't then you're screwed regardless.

I think a WAF is closer to a component of an entry control point, like on a military base. It's a tool for manned security to interact with and inspect traffic. Unmanned, they're just an obstacle to route around, but manned, they're an effective way to provide asymmetries to the defender.

WAFs can have thousands of rules ranging from basic to the sophisticated, not unlike mechanisms you can deploy at a checkpoint.

Security devices like IDSes or WAFs allow deploying filtering logic without touching an app directly, which can be hard/slow across team boundaries. They can allow retroactive analysis and flagging to a central log analysis team. Being able to investigate whether an adversary came through your door after the fact is powerful, you might even be able to detect a breach if you can filter through enough alerts.

People are more likely to get dismissed for not installing an IDS or WAF than having one. Its effectiveness is orthogonal to the politics of its existence, most of the time.

Re: Writing "/etc/hosts" breaks the Substack editor

#199

Post by noisem4ker »

swyx wrote: post #183
teraflop wrote: post #161

Earlier quoted context omitted.

The point is not to sanitize known strings like "OutOfMemoryException". The point is to sanitize or (preferably) escape any untrusted data that gets logged, so that it won't be confused for something else.

i think GP's point is how would you even sanitize the string "OutOfMemoryException" which presumably comes from a trusted system i guess demanding "Structured logs for everything or bust" is the answer? (i'm not a big o11y guy so pardon me if this is obvious)

"o11y" stands for "observability".

Numeronyms are evil and we should stop using them.

Re: Writing "/etc/hosts" breaks the Substack editor

#200

Post by pxc »

alabastervlog wrote: post #122
reaperducer wrote: post #77

Earlier quoted context omitted.

the CIO is securing his job. Every CIO I have worked for (where n=3) has gotten where they are because they're a good manager, even though they have near-zero current technical knowledge. The fetishizing of "business," in part through MBAs, has been detrimental to actually getting things done. A century ago, if someone asked you what you do and you replied, "I'm a businessman. I have a degree in business," you'd get…

It's a relatively recent change, too. Transition from "the executives and managers mostly came up through 10-25 years of doing 'lower' jobs in the company, and very much know how the business actually works" to "we hire MBAs to those roles directly" was throughout the '70s-'90s. Finance and business grads have really taken over the economy, not just through technocratic "here's how to do stuff" advice but by personal…

> Lawyers seem safe, so far.

Nope, lawyers are fucked too. It's just not as advanced yet: https://www.abajournal.com/web/article/arizona-approves-alte...

Post reply on HN