Live data from Hacker News

Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

twitter.com

41–50 of 322 posts

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#41

Earlier quoted context omitted.

This is quite funny

I am not laughing one bit let me tell you. Honesty in user agents is one of the last few defenses we have against hackers running rampant on the internet and turning it into some lawless wasteland where people don't even answer truthfully about their A/S/L.

> "A/S/L"

I have not seen that in a long time.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#42
post #33

Earlier quoted context omitted.

We don't need user agents for that. There's an easy way to tell whether a visitor wants a cleaner view of a page, without Javascript: Yes.

I said "mobile", not "cleaner". Sizes and aspect ratios are different on phones than PCs.

the could be accomplished just by having User-Agent: mobile, all the other data in the user-agent are useless for this purpose.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#43
post #41

Earlier quoted context omitted.

I am not laughing one bit let me tell you. Honesty in user agents is one of the last few defenses we have against hackers running rampant on the internet and turning it into some lawless wasteland where people don't even answer truthfully about their A/S/L.

> "A/S/L" I have not seen that in a long time.

I guess American Sign Language isn't as widespread as it used to be, now that everyone just texts all day anyway.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#44
post #8

Of all the security post-mortems I’ve ever wanted to read, it’s sad I’ll probably never get to read this one and its tale of how a team of well-paid comfortable engineers got together and decided this patch was a good idea.

> how a team of well-paid comfortable engineers got together and decided this patch was a good idea.

That's assuming that the well-paid and comfortable engineers decided on and implemented the patch.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#45

Earlier quoted context omitted.

I said "mobile", not "cleaner". Sizes and aspect ratios are different on phones than PCs.

the could be accomplished just by having User-Agent: mobile, all the other data in the user-agent are useless for this purpose.

Well at least we acknowledged there's some utility.

Now consider that mobile devices are different as well..

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#46
post #33

Earlier quoted context omitted.

We don't need user agents for that. There's an easy way to tell whether a visitor wants a cleaner view of a page, without Javascript: Yes.

I said "mobile", not "cleaner". Sizes and aspect ratios are different on phones than PCs.

Not necessarily. Websites should use CSS media queries to work at all aspect ratios and sizes without needing server-side code or JavaScript.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#47
post #8

Of all the security post-mortems I’ve ever wanted to read, it’s sad I’ll probably never get to read this one and its tale of how a team of well-paid comfortable engineers got together and decided this patch was a good idea.

It looks like this is a low end Cisco device, released over 5 years ago. Patches are probably handled by underpaid interns, not well-paid engineers.

Re: Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

#50

Earlier quoted context omitted.

I said "mobile", not "cleaner". Sizes and aspect ratios are different on phones than PCs.

the could be accomplished just by having User-Agent: mobile, all the other data in the user-agent are useless for this purpose.

There is presumably some way, at least hypothetically, to fix the mess that User-Agent has become. (Everybody is 'Mozilla' now! And yet somehow a unique snowflake 'Mozilla' that lets you be tracked...)

But it's not quite that. It's not that a device is "mobile" instead of "stationary" that matters. It's maybe that it's a touch screen. It's maybe that it's a small screen. (With an especially uneven aspect ratio?) Maybe that it's handheld. It's maybe the combination of all of those things. But it's not really that it's "mobile" exactly. And there are, and possibly will be increasing proportions of, devices that have some but not all of these qualities we package together in our brains as 'typical mobile'

Post reply on HN