Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We spent $20 to achieve RCE and accidentally became the admins of .mobi

labs.watchtowr.com

Post reply on HN
Print view View original

221–230 of 391 posts

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#221

Post by detourdog »

GTP wrote: post #133
detourdog wrote: post #27

Earlier quoted context omitted.

That is my point. We need to put value on the face to face relationships and extend trust outward from our personal relationships. This sort of trust is only as strong as it's weakest link but each individual can choose how far to extend their own trust.

This is what the Web of Trust does but, > This sort of trust is only as strong as it's weakest link but each individual can choose how far to extend their own trust. is exactly why I prefer PKI to the WoT. If you try to extend the WoT to the whole Internet, you will eventually end up having to trust multiple people you never met with them properly managing their keys and correctly verifying the identity of other peop…

I’m fine with PKIs presumably in America the department of education could act as a CA.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#222

Post by radicality »

SSLy wrote: post #216
lovasoa wrote: post #206

> $ sqlite3 whois-log-copy.db "select source from queries"|sort|uniq|wc -l Oh cool they saved the logs in a database ! Wait... |sort|uniq|wc -l ?? But why ?

beats up re-re-remembering how to do it in sql

And probably because for quick things like that you’re already working in a “pipeline”, where you first want to see some of the results so you output with SQLite, and then add more to the pipeline. Similarly, I often do ‘cat file | grep abc’ instead of just grep, might be probably out of habit.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#223

Post by syncsynchalt »

joelanman wrote: post #190
craftkiller wrote: post #162

Earlier quoted context omitted.

Not true. If you are hosting user content, you want their content on a completely separate domain, not a subdomain. This is why github uses githubusercontent.com. https://github.blog/engineering/githubs-csp-journey/

interesting, why is this?

CDNs can be easier to configure, you can more easily put your CDNs colocated into POPs if it's simpler to segregate them, and you have more options for geo-aware routing and name resolution.

Also in the case of HTTP/1 browsers will limit the number of simultaneous connections by host or domain name, and this was a technique for doubling those parallel connections. With the rise of HTTP/2 this is becoming moot, and I'm not sure of the exact rules of modern browsers to know if this is still true anyway.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#224

Post by coldpie »

callalex wrote: post #202
coldpie wrote: post #57

Earlier quoted context omitted.

As has been demonstrated many, many (many, many (many many many many many...)) times: there is no such thing as computer security. If you have data on a computer that is connected to the Internet, you should consider that data semi-public. If you put data on someone else's computer, you should consider that data fully public. Our computer security analogies are modeled around securing a home from burglars, but the ac…

Do you use a bank account? Or do you still trade using only the shells you can carry in your arms? Perhaps networked computers are secure enough to be useful after all.

I never claimed the Internet isn't useful. I just think people don't recognize how vulnerable computers are to attack. Search this very incomplete list for "bank": https://en.wikipedia.org/wiki/List_of_data_breaches

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#225

Post by dboreham »

joelanman wrote: post #190
craftkiller wrote: post #162

Earlier quoted context omitted.

Not true. If you are hosting user content, you want their content on a completely separate domain, not a subdomain. This is why github uses githubusercontent.com. https://github.blog/engineering/githubs-csp-journey/

interesting, why is this?

Because there's stuff out there (software, entities such as Google) that assume the same level of trust in a subdomain vs its parent and siblings. Therefore if something bad ends up being served on one subdomain they can distrust the whole tree. That can be very bad. So you isolate user provided content on its own SLD to reduce the blast radius.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#226

Post by david422 »

joelanman wrote: post #190
craftkiller wrote: post #162

Earlier quoted context omitted.

Not true. If you are hosting user content, you want their content on a completely separate domain, not a subdomain. This is why github uses githubusercontent.com. https://github.blog/engineering/githubs-csp-journey/

interesting, why is this?

I've read - because if a user uploads content that gets you on a list that blocks your domain - you could technically switch user content domains for your hosting after purging the bad content. If it's hosted under your primary domain, your primary domain is still going to be on that blocked list.

Example I have is - I have a domain that allows users to upload images. Some people abuse that. If google delists that domain, I haven't lost SEO if the user content domain gets delisted.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#227

Post by jonhohle »

dr_kretyn wrote: post #201
jonhohle wrote: post #147

Earlier quoted context omitted.

There is no PHP at Amazon (at least not 2009-2016). It was evaluated before my time there and Perl Mason was chosen instead to replace C++. A bunch if that’s still appears to exist (many paths that start with gp/) but a lot was being rebuilt in various internal Java frameworks. I know AWS had some rails apps that were being migrated to Java a decade ago, but I don’t think I ever encountered PHP (and I came in as a pr…

Ok, my "pretty sure" turns out to be "not sure at all". Thank you for the refresher! I was thinking about Mason and somehow conflated Perl with PHP. I left Amazon 2020. Had various collaborations with ecommerce (mainly around fulfillment) and there was plenty of Mason around.

I was probably one of the few who enjoyed Mason and still think the aggregator framework was great. We implemented a work-a-like in Java on Prime and it worked great there as well. It was effectively GraphQL before GraphQL, but local and remote, async, polymorphic, and extremely flexible. Not being in that world anymore I’m not sure if there is anything else quite like it, but there really should be.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#228

Post by ruthmarx »

coldpie wrote: post #173
ruthmarx wrote: post #154

Earlier quoted context omitted.

> As has been demonstrated many, many (many, many (many many many many many...)) times: there is no such thing as computer security. Of course there is, and things are only getting more secure. Just because a lot of insecurity exists doesn't mean computer security isn't possible.

It's a matter of opinion, but no, I disagree. People are building new software all the time. It all has bugs. It will always have bugs. The only way to build secure software is to increase its cost by a factor of 100 or more (think medical and aviation software). No one is going to accept that. Computer security is impossible at the prices we can afford. That doesn't mean we can't use computers, but it does mean we n…

It's not a matter of opinion at all. You can disagree but you can disagree with the earth being a sphere also.

> People are building new software all the time. It all has bugs. It will always have bugs.

No. Most bugs these days are due to legacy decisions where security was not an issue. We are making advances in both chip and software security. Things are already vastly more secure than they were 20 years ago.

20 years from now, security will be a lot closer to being a solved problem.

> The only way to build secure software is to increase its cost by a factor of 100 or more (think medical and aviation software). No one is going to accept that.

What are you basing that cost on?

> Computer security is impossible at the prices we can afford.

No, it really isn't. There's a reason some organizations have never been hacked and likely never will be. Largely because they have competent people implementing security that very much exists.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#229

Post by duskwuff »

giancarlostoro wrote: post #31

I still remember when websites would redirect you on your phone to their .mobi website, completely screwing up the original intent. They didn't show you the mobile version of whatever Google let you towards, they just lazily redirected you to the .mobi homepage. I bet they asked a non-dev to do those redirects, that one IT neckbeard who shoved a redirect into an Apache2 config file and moved on with life. :) But seri…

> Is this TLD even worth a damn in 2024?

IMO: No. Table stakes nowadays are for all web sites to support mobile devices; the notion of having a separate web site for mobile users, let alone an entire TLD for those web sites, is obsolete.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#230

Post by _cenw »

wiradikusuma wrote: post #212
varun_ch wrote: post #199

Earlier quoted context omitted.

I can think of two reasons: 1. it's immediately clear to users that they're seeing content that doesn't belong to your business but instead belongs to your business's users. maybe less relevant for github, but imagine if someone uploaded something phishing-y and it was visible on a page with a url like google.com/uploads/asdf. 2. if a user uploaded something like an html file, you wouldn't want it to be able to run j…

I'm wondering, many SaaS offer companyname.mysaas.com. Is that totally secure?

If it's on the PSL it gets treated similarly to second level "TLDs" like co.uk.
Post reply on HN