Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Writing "/etc/hosts" breaks the Substack editor

scalewithlee.substack.com

Post reply on HN
Print view View original

271–280 of 370 posts

Re: Writing "/etc/hosts" breaks the Substack editor

#271

Post by jimmaswell »

connicpu wrote: post #178
manwe150 wrote: post #143

Earlier quoted context omitted.

I think I like this idea that the rotation interval could be made proportional to length, for example doubling the interval with each additional character. Security standards already now acknowledge that forced yearly rotation is a net decrease in security, so this would incentivize users to pick the longest password for which they would tolerate the rotation interval. Is yearly rotation too annoying for you? For mer…

Can confirm when I found out I'd be required to regularly change my password the security of it went down significantly. At my current job when I was a new employee I generated a secure random password and spent a week memorizing it. 6 months later when I found out I was required to change it, I reverted to a variation of the password I used to use for everything years ago with some extra characters at the end that I…

I do the same but write the number at the end of the password on the laptop in sharpie. I work from home so I've been thinking about making a usb stick that simulates a keyboard with a button to enter the password.

Re: Writing "/etc/hosts" breaks the Substack editor

#273

Post by jimmaswell »

lucianbr wrote: post #84
mjr00 wrote: post #65

Earlier quoted context omitted.

> I disagree with other posts here, it is partially a balance between security and usability. And economics. Many people here are blaming incompetent security teams and app developers, but a lot of seemingly dumb security policies are due to insurers. If an insurer says "we're going to jack up premiums by 20% unless you force employees to change their password once every 90 days", you can argue till you're blue in th…

There should be some limits and some consequences to the insurer as well. I don't think the insurer is god and should be able to request anything no matter if it makes sense or not and have people and companies comply. If anything, I think this attitude is part of the problem. Management, IT security, insurers, governing bodies, they all just impose rules with (sometimes, too often) zero regard for consequences to an…

This is why everyone should have a union, including highly paid professionals. Imagine what it would be like. "No, fuck you, we're going on strike until you stop inconveniencing us to death with your braindead security theater. No more code until you give us admin on our own machines, stop wasting our time with useless Checkmarx scans, and bring the firewall down about ten notches."

Re: Writing "/etc/hosts" breaks the Substack editor

#274

Post by connicpu »

byproxy wrote: post #262
connicpu wrote: post #178

Earlier quoted context omitted.

Can confirm when I found out I'd be required to regularly change my password the security of it went down significantly. At my current job when I was a new employee I generated a secure random password and spent a week memorizing it. 6 months later when I found out I was required to change it, I reverted to a variation of the password I used to use for everything years ago with some extra characters at the end that I…

Why not make use of a password manager?

I'm not pulling my phone out every time I have to unlock my computer at work. If IT wants my work account to be secure they should change their policies.

Re: Writing "/etc/hosts" breaks the Substack editor

#275

Post by blangk »

stefan_ wrote: post #263
pjmlp wrote: post #233

Earlier quoted context omitted.

Insurance and liability concerns drive the security folks. Just wait when more countries keep adopting cybersecurity laws for companies liabilities when software doesn't behave, like in any other engineering industry.

Hello, the security folks in those companies made those up. "cyber insurance" is hogwash. That entire branch has been taken over by useless middle manager types who know to type up checklists in Word but have no understanding of anything.

Are you arguing non technical people should have root access to company owned and managed PCs? Because I can tell you from experience, that will result in a very bad time at some point. Even if it is just for the single end user and not the wider org.

Re: Writing "/etc/hosts" breaks the Substack editor

#276

Post by vultour »

jrockway wrote: post #14
Y_Y wrote: post #7

Does it block `/etc//hosts` or `/etc/./hosts`? This is a ridiculous kind of whack-a-mole that's doomed to failure. The people who wrote these should realize that hackers are smarter and more determined than they are and you should only rely on proven security, like not executing untrusted input.

Yeah, and this seems like a common Fortune 500 mandatory checkbox. Gotta have a Web Application Firewall! Doesn't matter what the rules are, as long as there are a few. Once I was told I needed one to prevent SQL injection attacks... against an application that didn't use an SQL database. If you push back you'll always get a lecture on "defense in depth", and then they really look at you like you're crazy when you su…

A large investment bank I worked for blocked every URL that ended in `.go`. Considering I mostly wrote Golang code it was somewhat frustrating.

Re: Writing "/etc/hosts" breaks the Substack editor

#277

Post by denkmoon »

isomorphic- wrote: post #272
Aeolun wrote: post #264

Earlier quoted context omitted.

You can’t open the password manager until your computer is unlocked.

You can put the password manager on your phone or another device.

and now you’re violating a different policy.

Re: Writing "/etc/hosts" breaks the Substack editor

#278

Post by Macha »

godelski wrote: post #225
tryauuum wrote: post #195

Earlier quoted context omitted.

this is the usual approach with web application firewalls, block all the 100500 known attacks. Doesn't matter if they are not applicable to your website. Some of them are obviously OS-depended (having .exe in the URLs) but it doesn't matter, it's blocked just in case I do understand this appoach. From the defence point of view it makes sense, if you have to create a solution to protect millions of websites it doesn't…

Can you help me understand the exploit here? I'd really like to understand. (What's below is written not as "this is how it should be done" but instead "what I understand should be done". To provide context to what I do and do not understand so that my misunderstandings can be more directly addressed) I understand being over zealous, an abundance of caution. But what I'm confused about is why normal text could lead t…

Misconfiguring your web server such that example.com/../../etc/passwd returned the actual file was a common vulnerability in the early 00s. Or cgi scripts that worked with real file paths but accepted any path

WAFs blocking the string with the filename then is the "to make sure nobody ever accidentally leaves your gate open, we've replaced it with a concrete wall" solution to this problem. You might never have this problem, and might need to actually use the gate but the vendor/security team has successfully solved their problem of checking off a blocked attack, and the consequences are now your problem

Re: Writing "/etc/hosts" breaks the Substack editor

#279

Post by patrakov »

mjr00 wrote: post #65
matt_heimer wrote: post #36

The people configuring WAF rules at CDNs tend to do a poor job understanding sites and services that discuss technical content. It's not just Cloudflare, Akamai has the same problem. If your site discusses databases then turning on the default SQL injection attack prevention rules will break your site. And there is another ruleset for file inclusion where things like /etc/hosts and /etc/passwd get blocked. I disagree…

> I disagree with other posts here, it is partially a balance between security and usability. And economics. Many people here are blaming incompetent security teams and app developers, but a lot of seemingly dumb security policies are due to insurers. If an insurer says "we're going to jack up premiums by 20% unless you force employees to change their password once every 90 days", you can argue till you're blue in th…

Worse. If you are not in the USA, i.e., if NIST is not the correct authority, that insurer might actually be enforcing what the "correct" authority believes to be right, i.e., password expiration.

Re: Writing "/etc/hosts" breaks the Substack editor

#280

Post by edoceo »

connicpu wrote: post #274
byproxy wrote: post #262

Earlier quoted context omitted.

Why not make use of a password manager?

I'm not pulling my phone out every time I have to unlock my computer at work. If IT wants my work account to be secure they should change their policies.

As discussed here, the policy is from outside the org.
Post reply on HN