Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

twitter.com

Post reply on HN
Print view View original

291–300 of 322 posts

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#291

Post by Drdrdrq »

user5994461 wrote: post #288
sparkling wrote: post #180

Earlier quoted context omitted.

Cisco is in the business of selling big, black, expensive boxes that have a lot of security badges and fancy icons. People who buy such boxes don't care if they actually work, they want a big box so that they can claim they "invested in security".

What would you buy instead of Cisco? HP and Dell are the same thing. From experience a decade ago, the HP usually did not have the enterprise features they advertised. The other minor brands are very hard to procure if you're not in the US or a primary English speaking country.

Juniper? Extreme? The list is not very long, but doesn't contain just Cisco.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#292

Post by user5994461 »

Drdrdrq wrote: post #291
user5994461 wrote: post #288

Earlier quoted context omitted.

What would you buy instead of Cisco? HP and Dell are the same thing. From experience a decade ago, the HP usually did not have the enterprise features they advertised. The other minor brands are very hard to procure if you're not in the US or a primary English speaking country.

Juniper? Extreme? The list is not very long, but doesn't contain just Cisco.

Last I checked, long ago, they were impossible to procure in France.

Pretty sure Extreme is still non-existent in Europe as of today.

For all the flaws of Cisco, well the only flaw is the price, they can deliver in any language anywhere in the world.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#293

Post by SkyBelow »

konstmonst wrote: post #264
SkyBelow wrote: post #236

Earlier quoted context omitted.

Let me know when pride is accepted as currency to pay bills or when insubordination due to personal pride is seen as a desirable quality in a candidate. At the very least, how much are you willing to pay a person for not implementing the fix you disagree with (including engaging in a legal contract to pay them if they lose their employment due to not implementing the fix). From my past experiences with others, moral…

Pleas tell me in what country is it an issue for a software developer to make money? I mean in this situation, if I were forced to implement such fix, I would do it, but would then quit the next month. Because if I were to stay, not only would I get worse professionally, but I would feel dirty for not doing my work properly. The companies that accept such fixes are more often than not like a factory and treat you as…

USA. Not everyone has the economic mobility to just quit at any time. I know one such individual who I have been encouraging to get a new job because his current employment leaves him working a second job on weekends.

One could suggest to such people to display enough financial discipline to save up a rainy day fund, but this is ignoring all the procedures in place designed specifically for depressing wages.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#294

Post by labster »

craftinator wrote: post #282
kowdermeister wrote: post #231

Earlier quoted context omitted.

Sir, your assessment of this particular joke is excellent. We should start a joke approval committee to avoid further confusion.

Yes, very well, as first action of the Joke Approval Committee, I propose that this august body instantiate the Recursed Approval Subcommittee, whose role will be to instantiate the Recursed Approval Subcommittee.

It puts the motion in the basket.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#295

Post by Dylan16807 »

user5994461 wrote: post #289
Dylan16807 wrote: post #18

Earlier quoted context omitted.

The equivalent of a "pls dont hack" sign is not defense in depth. Good to know they at least half fixed the problem, I guess. But that's not enough, and they should be capable of testing this.

Can anything without a "please don't hack" sign considered defense in depth? Probably not, hence an appropriate first patch.

Yes it can. If you see a product that claims to be secure, with multiple layers of security, certain exceptionally-fragile measures should decrease how much you believe that claim. Layers of security have to at least be mildly effective to count as layers.

If you're fighting an active attack you can stall by filtering on some arbitrary parameter unrelated to the actual problem. For anything that's supposed to last more than an hour, it's worse than useless. It makes your system more complex for no security benefit. An idea like that should never make it into a product release.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#296

Post by mandelbrotwurst »

spaceribs wrote: post #263
flatline wrote: post #251

Earlier quoted context omitted.

And yet the US has consistently been in the vanguard of software development worldwide. Do we need surgeons? Do you need a four year postgraduate degree and three more years of apprenticeship before slinging together a web app? Certainly the industry has its problems, and some applications demand more rigor, but I don’t see this as much of a general solution.

The market didn't demand a high survival rate or efficacy for barbering either, but do you think that the (conscious or unconscious) that software engineers are some sort of magical wizards will last forever?

There may be explanations beyond wizardry - e.g. maybe barbers were historically often self-employed, small business owners who realized they stood to gain from creating barriers to entry such as licensing requirements.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#297

Post by Aeolun »

skrebbel wrote: post #271
Aeolun wrote: post #223

Earlier quoted context omitted.

If you answer with the existential sigh, you’ve had at least 20 conversations with a similar outcome before. Nobody arrives at a new company that jaded.

I see your point and I suspect that that's what the author meant. At the same time, I know lots of, well, arrogant nerds who get into "existential sigh" mode as soon as someone with less technical skill than them says something stupid. That's more how I read it.

Ah, yes, I see how that is another valid interpretation.

I guess for me the word existential is a bit different. For an arrogant developer it would have been something like ‘long-suffering sigh’.

Unless, I guess, you feel you are so smart that your entire life is defined by interacting with morons :P

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#298

Post by dvhh »

StavrosK wrote: post #169
dvhh wrote: post #61

Earlier quoted context omitted.

Then add a "tainted by evil" flag to the ipv7 spec, or better, just add a "pure" flag to future ip spec.

I think I'd almost prefer an "alignment" flag, so we don't mischaracterize all the Chaotic Neutral packets.

But then what to do with the Lawful Evil packets ?

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#299

Post by m463 »

0xcde4c3db wrote: post #53
danso wrote: post #8

Of all the security post-mortems I’ve ever wanted to read, it’s sad I’ll probably never get to read this one and its tale of how a team of well-paid comfortable engineers got together and decided this patch was a good idea.

Having been involved in meetings where "stop ship" was the phrase of the day, I'd bet money that the following at least vaguely resembles a real conversation: Engineer Alice: We should really fix this properly. Manager: How sure are you that the proper fix won't break something else for $BIG_CUSTOMERS who are responsible for $OBSCENE percent of this product line's revenue? Engineer Bob: Uh, ten percent on a good day?…

This reminds me of the old BOFH posts from days past.

The one where the "appeasement engineer" shows up to fulfill the guaranteed response time requirement.

Post reply on HN