Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Writing "/etc/hosts" breaks the Substack editor

scalewithlee.substack.com

Post reply on HN
Print view View original

361–370 of 370 posts

Re: Writing "/etc/hosts" breaks the Substack editor

#361

Post by eli »

da_chicken wrote: post #48
eli wrote: post #28

Earlier quoted context omitted.

Is a security solution worthless if it can't stop a dedicated attacker? A lot of WAF rules are blocking probes from off-the-shelf vulnerability scanners.

"It's technically better than nothing," is kind of a bizarre metric. It's like not allowing the filesystem to use the word "virus" in a file name. Yes, it technically protects against some viruses, but it's really not very difficult to avoid while being a significant problem to a fair number of users with a legitimate use case. It's not that it's useless. It's that it's stupid.

Do you lock your front door?

Re: Writing "/etc/hosts" breaks the Substack editor

#362

Post by eli »

ndsipa_pomu wrote: post #74
eli wrote: post #28

Earlier quoted context omitted.

Is a security solution worthless if it can't stop a dedicated attacker? A lot of WAF rules are blocking probes from off-the-shelf vulnerability scanners.

It's merely security theater. It reminds me of when airports started scanning people's shoes because an attacker had used a shoe bomb. Yes, that'll stop an attacker trying a shoe bomb again, but it disadvantages every traveller and attackers know to put explosives elsewhere.

Most ransomware attacks are opportunistic. They scan basically the whole internet for vulnerabilities and attack from there. It's usually not a skilled attacker targeting a specific company.

Ransomware is a huge and growing problem. Very different than airline security, where attacks are extremely uncommon. If planes were constantly getting blown up, and if a majority of those attacks started with a shoe bomb, then checking everyone's shoes would seem a lot more reasonable, no?

Re: Writing "/etc/hosts" breaks the Substack editor

#363

Post by da_chicken »

eli wrote: post #361
da_chicken wrote: post #48

Earlier quoted context omitted.

"It's technically better than nothing," is kind of a bizarre metric. It's like not allowing the filesystem to use the word "virus" in a file name. Yes, it technically protects against some viruses, but it's really not very difficult to avoid while being a significant problem to a fair number of users with a legitimate use case. It's not that it's useless. It's that it's stupid.

Do you lock your front door?

Do you brace yours with a bar?

Re: Writing "/etc/hosts" breaks the Substack editor

#364

Post by rpigab »

Between around 2005 and 2011 in France, if a child was born and parents Mr Bar and Mrs Baz wanted to transmit both of their last names, he or she had to be named "Foo Bar--Baz". No, that's not a typo, that's two hyphens. Check out "Circulaire du 6 décembre 2004 relative au nom de famille" if you don't believe me.

Yes, the people in charge probably didn't think or know of SQL comments. However, it worked well as long as input is sanitized and not concatenated, which is often the case using modern frameworks or common sense.

However, nowadays, we just put a WAF in front of everything, it's cheaper that way because common sense is hard to come by. People like Foo Bar--Baz still exist, and unless they've had their name changed, they're sometimes running into extremely wierd issues in the web software they're using.

Re: Writing "/etc/hosts" breaks the Substack editor

#365

Post by rpigab »

ramon156 wrote: post #241
noisem4ker wrote: post #199

Earlier quoted context omitted.

"o11y" stands for "observability". Numeronyms are evil and we should stop using them.

You're right, avoiding them gives better a11y

Yes, that's affirmatively aesthetically the best way to ensure artificiality automatically, or alternatively applicability and acceptability, there's appropriately a whole chapter about it in my autobiography, had to adventurously include it authentically (obviouslyyyyy).

Re: Writing "/etc/hosts" breaks the Substack editor

#366

Post by smeg_it »

kbolino wrote: post #139
vlovich123 wrote: post #119

Earlier quoted context omitted.

While the password recommendation stuff is changing (the US government updating it guidelines last year), it’s generally best practice to not share passwords which itself implies using a password manager anyway which makes the whole “long passphrase” vs “complex” password moot - just generate 32 lowercase random characters to make it easier to type or use the autogenerated password your password manager recommends. T…

There's also login passwords, and depending on how many systems you have to log into, these can be quite numerous. There are some attempts to address this with smartcards and FIDO tokens and so on, but it's not nearly universal yet. At least SSH keys are common for remote login nowadays, but you still need to log into some computer directly first.

Yeah, I've thought about a yubi key or something, but haven't pulled the trigger.

Re: Writing "/etc/hosts" breaks the Substack editor

#367

Post by smeg_it »

vlovich123 wrote: post #119
smeg_it wrote: post #106

Earlier quoted context omitted.

I'm no expert, but I did take a CISSP course a while ago. One thing I actually remember ;P, is that it recommended long passwords in in lieu of the number, special character, upper, lower ... I don't remember the exact wording of course and maybe it did recommend some of that, but it talked about having a sentence rather than all that mess in 6-8 characters, but many sites still want the short mess that I never will…

While the password recommendation stuff is changing (the US government updating it guidelines last year), it’s generally best practice to not share passwords which itself implies using a password manager anyway which makes the whole “long passphrase” vs “complex” password moot - just generate 32 lowercase random characters to make it easier to type or use the autogenerated password your password manager recommends. T…

I guess I'm weird, I use my browser, yet I haven't wanted to store that in the cloud, so it doesn't sync to my phone. Let me know if that's paranoia isn't justified. For me, if it becomes more universal, something like a yubi key that I can keep on my key-chain might work.

Re: Writing "/etc/hosts" breaks the Substack editor

#368

Post by hnlmorg »

immibis wrote: post #310
zelphirkalt wrote: post #287

Earlier quoted context omitted.

If they want to do their job well, how about adding some thinking into the mix, for good measure? Good would also be,if they actually knew what they are talking about, before trying to tell the engineers what to do.

They don't want to do their job well. They want to look like they're doing their job well, to people who don't know how to do the job and whose metrics are completely divorced from actual merit.

That’s a common misconception taken from an engineers perspective but you have to understand their job isn’t about engineering, it’s about risk mitigation. And when viewed from that perspective, they are doing their job.

The real problem is that the domain has gotten so complicated that a traditional risk mitigation approach to is an outdated role and is now better fulfilled by technical staff who specialise in security. But that’s an organisation problem caused by senior management (C-suite and above) rather than a particular individual in that specific role not doing their job well.

Re: Writing "/etc/hosts" breaks the Substack editor

#369

Post by kiitos »

afiori wrote: post #354
kiitos wrote: post #349

Earlier quoted context omitted.

Look, any WAF that blocks a document like /etc/hosts is a file on Unix hosts is pretty clearly broken. And you can't meaningfully measure product metrics like impact for fundamentally broken products.

> is pretty clearly broken agree > And you can't meaningfully measure product metrics like impact for fundamentally broken products disagree

I have a WAF that blocks everything. It's obviously fundamentally broken, but in terms of product metrics like impact, it's incredible! It stops 100% of attacks!
Post reply on HN