Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What Is Date:Italy?

aesthetikx.info

Post reply on HN
Print view View original

41–50 of 69 posts

Re: What Is Date:Italy?

#41

Post by themafia »

foobiekr wrote: post #33
voidfunc wrote: post #7

Earlier quoted context omitted.

MITM attack on a read-only text webpage... okay. More annoying is the slightly shiny/shaded text that is supposed to highlight something. Who chose this style palette?

It’s html. Which is code that your browser executes. Millions of routers are compromised. BGP attacks happen. Anything http stands out as an interesting target for injection. This position is foolish. It’s not a major ask to enable https.

The browser still has to execute code over HTTPS. You've just moved the injection perimeter from inside my own network into the providers website. I don't think you've fundamentally changed your level of risk unless you spend a huge amount of time browsing on shared password WPA protected wifi networks.

You cannot browse to sites under any regime and execute code while expecting security to exist.

Re: What Is Date:Italy?

#42

Post by himata4113 »

foobiekr wrote: post #34
himata4113 wrote: post #18

Earlier quoted context omitted.

It's still a weak argument since it's extremely rare in practice that's why I suggested blaming the ISP instead since ISP's are the ones that have historically tampered with http content.

Attacks in general are all rare in practice in the grand scheme of the internet. So?

Yes, that's why you present a better argument, that's the entire conversation.

Re: What Is Date:Italy?

#43

Post by Georgelemental »

jauco wrote: post #8

It’s actually worse than that. It wasn’t always whole coubtries who decided to adopt (or not) but cities and sometimes people within cities (i.e. the protestants in the city would be lagging, or maybe I’m misremembering and this was about people who where abroad) In any case, for awhile, the date you picked depended on who you were writing to. And then also the relative standing. If he was of much lower standing you…

We still have this sort of thing today. In the occupied West Bank, Israeli settlers change to daylight savings time on a different day than the Palestinians

Re: What Is Date:Italy?

#44

Post by pc86 »

rnhmjoj wrote: post #37
pc86 wrote: post #30

Earlier quoted context omitted.

Man I really hope this doesn't get autoflagged because people need to see that this is an opinion people actually have, and what the (justified) reaction to it is. HTTPS on a blog does nothing. It doesn't protect you from anything. I guarantee you're not getting "all kinds of MITM injections" on this block of text. The only reasonable desire I can think of for "HTTPS everywhere" is hiding the content from your ISP bu…

> they still see the URL so they can get the content if they want it That's incorrect, a MitM can only reveal the server hostname by inspecting the SNI during the TLS handshake, but the HTTP request, including the URL and headers, is encrypted.

Surely your ISP can see every URL you visit if they have a reason to? They're routing the traffic.

Re: What Is Date:Italy?

#45

Post by NoahZuniga »

Joker_vD wrote: post #35
pc86 wrote: post #31

Earlier quoted context omitted.

On the flip side, every company I've ever worked for has installed trusted company certs on their computers and do MITM everything.

Yep. You apparently need HTTPS for intranet resources too, or you can't develop/use web-apps in Chrome, and since no self-respecting CA would certify your localhost, internal homegrown CA it is, baby — and given the web runs on the lovely model "any CA can attest any website; okay, maybe CAA is not a bad idea"...

Even with CAA records, any CA can still create a cert for any website. So if you're worried about an untrustworthy CA, then this won't help you.

It could make it less likely for a CA with buggy code to accidentally issue a cert for your domain.

Re: What Is Date:Italy?

#46

Post by rnhmjoj »

pc86 wrote: post #44
rnhmjoj wrote: post #37

Earlier quoted context omitted.

> they still see the URL so they can get the content if they want it That's incorrect, a MitM can only reveal the server hostname by inspecting the SNI during the TLS handshake, but the HTTP request, including the URL and headers, is encrypted.

Surely your ISP can see every URL you visit if they have a reason to? They're routing the traffic.

No they can't. They obviously know the IP addresses, but that's not terribly useful since everything is behind a cloudflare proxy nowadays. The server hostname may provide some more information, if the server doesn't support ECH [1], but the full URL is encrypted.

https://en.wikipedia.org/wiki/Server_Name_Indication#Encrypt...

Re: What Is Date:Italy?

#47

Post by NetMageSCW »

pc86 wrote: post #44
rnhmjoj wrote: post #37

Earlier quoted context omitted.

> they still see the URL so they can get the content if they want it That's incorrect, a MitM can only reveal the server hostname by inspecting the SNI during the TLS handshake, but the HTTP request, including the URL and headers, is encrypted.

Surely your ISP can see every URL you visit if they have a reason to? They're routing the traffic.

Routing only shows the server IP address, which isn’t very useful if it is AWS or Azure or CloudFlare or some other CDN.

Re: What Is Date:Italy?

#48

Post by pavon »

foobiekr wrote: post #33
voidfunc wrote: post #7

Earlier quoted context omitted.

MITM attack on a read-only text webpage... okay. More annoying is the slightly shiny/shaded text that is supposed to highlight something. Who chose this style palette?

It’s html. Which is code that your browser executes. Millions of routers are compromised. BGP attacks happen. Anything http stands out as an interesting target for injection. This position is foolish. It’s not a major ask to enable https.

For a random blog you have never visited before and have no reason to trust. It could attempt to do all the malicious things that you are worried a man in the middle would do.

Re: What Is Date:Italy?

#49

Post by jaywcarman »

cdot2 wrote: post #17
Sharlin wrote: post #16

Earlier quoted context omitted.

> Astronomers used it And still use, in fact!

I deal with those radio systems occasionally and I've always wanted to find or modify a digital watch to display the Julian date. It feels like that would be such a simple firmware change to something like a g-shock.

Check out the Sensor Watch project[1]! It's "An ARM Cortex M0+ board swap for the classic Casio F-91W wristwatch" that allows you to write custom firmware.

[1]: https://www.sensorwatch.net/

Re: What Is Date:Italy?

#50

Post by scubbo »

Ah, the cause of the weirdest bug I ever debugged. Obvious in hindsight - but we were totally puzzled as we continued debugging further and further down the stack of why one particular random seed would cause a fuzzed-input test to cause some date-handling code to error out.
Post reply on HN