Earlier quoted context omitted.
Tests must not be robust enough, then.
yes, they need to add a test for wget (and a comparable fix) - that will teach them how to do tdd right.
They'll just add another user agent check.
Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent
201–210 of 322 posts
Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent
#202This "fix" seriously hurts Cisco's credibility. How can you trust their products? Perhaps they are thinking that noone gives a damn anyway after no less than five backdoors² were found in their products in 2018 alone? Just incredible. ² https://www.tomshardware.com/news/cisco-backdoor-hardcoded-a...
Cisco have a loong history of things like the. I mean go back to 2005 when they actually sent people to a security conference to rip pages out of the handouts that mentioned a security vulnerability in their products (https://www.computerworld.com/article/2482483/cisco-s-blunde...)
That (and other bad security responses) have not really hurt them, so at this stage, this won't make a lot of difference, I'd expect.
Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent
#203Earlier quoted context omitted.
Having been involved in meetings where "stop ship" was the phrase of the day, I'd bet money that the following at least vaguely resembles a real conversation: Engineer Alice: We should really fix this properly. Manager: How sure are you that the proper fix won't break something else for $BIG_CUSTOMERS who are responsible for $OBSCENE percent of this product line's revenue? Engineer Bob: Uh, ten percent on a good day?…
> Manager: And we can just prevent it with an extra regex rule in the front end code? > Engineer Alice: ... Yes. irrepressibly existential sigh The answer is "no", though. This exchange sounds like the decision was between "fixing it cleanly" and "fixing it with a hack", which is roughly equivalent with fixing the problem at the expense of technical debt. But this change does not fix the problem at all.
I have to agree that the answer is no.
curl -A "anything but Curl" x.x.x.x
the problem has not been fixed by a user agent string.
Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent
#204Here is the original vulnerability report: https://www.redteam-pentesting.de/en/advisories/rt-sa-2019-0...
Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent
#205Earlier quoted context omitted.
You live in a nice world, because usually the actual power (and duty) of a dev team member is to advise, not to agree or refuse.
Absolutely: Cisco made this happen, not Engineer Alice. If your boss asks you to do something within my ethical boundaries and you have 5 tired co-workers in favour of shipping it, eventually you'll break and say "fine". It doesn't make you responsible or the one that pulled the trigger.
The fact that this fix made it to prod tells you that something is deeply deeply broken with cisco’s processes that goes well beyond any individual’s responsibility.
Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent
#206Earlier quoted context omitted.
Yup, in the UK it bugs me when I keep meeting people who introduce themselves as an 'engineer'. When I ask them if they do mechanical or civil engineering, then I usually get to say "ah, so you're a programmer, just like me". One thing I did sometimes like about being in Austria is the obsession with academic titles they have there... if somebody is a qualified engineer, they invariably use "Ing" as a title in place…
What is qualified in Austria? In the USA, in most states, you must be licensed to have engineering in your business name. Your name is usually suffixed with PE.
But in the USA you can refer to yourself generically as a Software Engineer without any formal education.
Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent
#207Earlier quoted context omitted.
You live in a nice world, because usually the actual power (and duty) of a dev team member is to advise, not to agree or refuse.
You can always quit. Or force them to fire you for refusing to implement a non fix. In reality though I doubt this narrative even occurred. Some incompetent engineer likely proposed this fix thinking that it was actually a fix. Edit: I see I've been downvoted for this comment. If we were real engineers working on things like cars and bridges we'd actually be held accountable. Take some pride in your work people, this…
At a large organisation I worked at years ago we used to call it Coder Shopping - when a manager would do the rounds trying to find someone who would say "yes" in a situation like this.
Invariably there would be someone who would, and if you were the person who had initially refused you probably wouldn't even be aware that it had happened until the bug reports came in...
Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent
#208Don't blame the manager, the PO, the CEO. This is ABSURD engineering incompetence. The fellow that did that _fix_ probably had no idea how to properly solve the issue.
So having an absurdly incompetent engineer implementing this fix isn't a management problem?
Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent
#209Earlier quoted context omitted.
No! The answer is an unequivocal “No“, without any „but“s or anything like that. The fix does not fix the problem, it is not even a fix, just a wrong code change that sets out to do something but does not achieve it. Answering „yes“ is a lie here. This is different from a fix that fixes the problem in an ugly way, where „yes, but...“ is applicable.
You must live in a very nice, ideal world, where simply saying "no, that's not the right way to do it" will convince managers to ignore the pressures placed on them to, at times, value speed over correctness.
What they are saying is that this isn't just "the wrong way to do it". It doesn't actually fix the problem it's supposed to fix, therefore it's actually wrong to say it's a functioning patch.
Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent
#210Earlier quoted context omitted.
Having been involved in meetings where "stop ship" was the phrase of the day, I'd bet money that the following at least vaguely resembles a real conversation: Engineer Alice: We should really fix this properly. Manager: How sure are you that the proper fix won't break something else for $BIG_CUSTOMERS who are responsible for $OBSCENE percent of this product line's revenue? Engineer Bob: Uh, ten percent on a good day?…
On HN its always big bad management who is the cause of every security problem or shoddy piece of engineering. If only that pesky management would screw off then we could do things "properly". You'd be suprieed at how many incompetent engineers there are out there. If "engineer" Alice in your story was actually competent they would never agree to implement the proposed "fix". Its not a fix. To pass it off as one woul…
The question here, is if it would stop 90% of the attacks, would it be a worthwile way to spend 5 minutes.
And the answer to that question is almost invariably yes.