How I learned about corporate firewalls • Hacker News Board

Re: How I learned about corporate firewalls

#51

Post by [deleted] » Wed, Oct 05, 2022, 1:23 PM UTC

richbell wrote: post #30

criddell wrote: post #19

Earlier quoted context omitted.

Can you expand on this a bit? I googled "ntlm proxy" and "sonatype nexus" and still have no idea what it is you've done but I'd like to understand.

Nexus Repository (commonly referred to as just "Nexus", which is confusing because Sonatype has several products called "Nexus $name") is a local artifact repository. Running it locally allows you to cache artifacts from external repositories like pypi.org or repo.maven.org, which is beneficial because it cuts down on the amount of outbound traffic required to install dependencies.

[deleted]

Re: How I learned about corporate firewalls

#52

Post by Karawebnetwork » Wed, Oct 05, 2022, 1:24 PM UTC

ravio64 wrote: post #43

easton wrote: post #27

Earlier quoted context omitted.

If anyone is stuck somewhere like this, Stack Overflow has dumps regularly updated on archive.org -- https://archive.org/download/stackexchange/ Dash (or its Windows equivalent, name escapes me) can be used to view and search these dumps (as well as dumps from GitHub, language docs, etc) offline: https://kapeli.com/dash

Windows equilevant is zeal, which dash is a mac version of :)

Another alternative to Zeal is DevDocs with its offline mode. https://devdocs.io/offline

Re: How I learned about corporate firewalls

#53

Post by coldcode » Wed, Oct 05, 2022, 1:24 PM UTC

I worked in a financial company in mid 2000s where the network head did not believe in internal firewalls so that all internal users were on the same network as all the web app servers and database servers. If someone was downloading a movie then customer web access slowed; since everyone used Windows everyone was required to run virus scanners on their computers and that included the app and database server machines since they were not isolated from the rest of the network. If a vendor came to demo something they were unable to since there was no way to isolate their laptop from everyone else so they could not access the internet.

Good thing I never put any of my money in the company accounts...

Re: How I learned about corporate firewalls

#54

Post by criddell » Wed, Oct 05, 2022, 1:27 PM UTC

richbell wrote: post #30

criddell wrote: post #19

Earlier quoted context omitted.

Can you expand on this a bit? I googled "ntlm proxy" and "sonatype nexus" and still have no idea what it is you've done but I'd like to understand.

Nexus Repository (commonly referred to as just "Nexus", which is confusing because Sonatype has several products called "Nexus $name") is a local artifact repository. Running it locally allows you to cache artifacts from external repositories like pypi.org or repo.maven.org, which is beneficial because it cuts down on the amount of outbound traffic required to install dependencies.

Okay, that makes sense and I can certainly see why that often makes sense.

It seems that running the proxy leaves the original problem uncorrected. I'd be inclined to exercise a bit of malicious compliance to increase pressure for changes to the security configuration.

Re: How I learned about corporate firewalls

#55

Post by jve » Wed, Oct 05, 2022, 1:31 PM UTC

shireboy wrote: post #40

jve wrote: post #37

I wonder what _showHtmlPage_ does? Did he just write something, something that allows 3rd party (corporate firewalls) inject HTML under his domain within TLS protected connection? Cannot judge by not knowing how he displays errors. But a question to HN public: Is opening unknown HTML under my domain within another window safe? Or is there any possibility to strip down any "permissions" to cookies, requests, resources…

Came here to point this out. For non-trivial implementations of showHtmlPage, this is a vulnerability. A malicious user could set up a 403 response with a fake “please re-enter your card to verify” form that sends to the attacker, or possibly even script to scrape the card number. Probably low risk of this actually happening in this scenario, but I’m pretty sure this fix is a bad idea. Better to show a generic error…

I think loading HTML within DOM Node and getting .innerText would be pretty innocent way of communicating user about some unknown error condition. Or logging that text so developer can better understand unexpected failures.

Re: How I learned about corporate firewalls

#56

Post by [deleted] » Wed, Oct 05, 2022, 1:32 PM UTC

pilif wrote: post #47

My favourite issue caused by a corporate firewall was when it altered an AJAX request to replace a specific combination of digits (in a long product ID) by asterisks. Turns out that a substring of that product ID matched the client company's phone number and their security theatre intercepting proxy was replacing all occurrences of "sensitive" strings sent to the internet with asterisks. The irony is, of course, that…

[deleted]

Re: How I learned about corporate firewalls

#57

Post by gabesullice » Wed, Oct 05, 2022, 1:38 PM UTC

PcChip wrote: post #26

gabesullice wrote: post #15

> It helpfully spits out this HTML response in return but, of course, my frontend code was expecting a JSON response. I had no idea I was ever going to get anything different. I wish more front-end devs recognized that they're building HTTP clients whenever they make HTTP requests. There's a whole specification written about how to do that well so one doesn't have to learn things like this the hard way. Specs may loo…

Isn't there some kind of library to handle this without having to code it each time?

Yes and no. A library might check for the status codes, but then what? Will it throw an exception? You'll have to catch them.

Will it fail silently? If so, is your code prepared for null to be returned instead of parsed JSON objects. You'll have to check for that.

Using a library isn't going to save you from handling all the error states and unexpected response bodies. It'll just change the documentation you're reading and the name of the abstractions you're dealing with (e.g. status codes -> exceptions)

Re: How I learned about corporate firewalls

#58

Post by thedougd » Wed, Oct 05, 2022, 1:44 PM UTC

richbell wrote: post #21

cheschire wrote: post #12

"Aha, so an overzealous IT network decided to block the request before it even reached my server." What classifies this as an "overzealous" act of network configuration? There may be a subjectively legitimate reason the user's network was configured this way. "I had no idea I was ever going to get anything different." There's an entire list of HTTP status codes. That was your clue that you would get something differe…

> What classifies this as an "overzealous" act of network configuration? There may be a subjectively legitimate reason the user's network was configured this way. Worked at a large FI. Our corporate firewall used to block any website or payload that contained the word "hack". At one point, the security team decided to roll out a change that blocked all verbs except GET and POST without telling anyone. I could go on.

And probably replies with a 200 and a blocked page.

What you tend to see is the web firewall is administered by someone who has only one duty (manage this firewall) and very narrow set of skills (certification in this appliance). They probably have a very shallow understanding of the http protocol.

Re: How I learned about corporate firewalls

#59

Post by thedougd » Wed, Oct 05, 2022, 1:58 PM UTC

BizarroLand wrote: post #5

hyperman1 wrote: post #4

We once had to fight for stackoverflow access. Security responds: you devs should only require the manual provided by the vendor(in this case: Oracle javadocs)?

I would have taken that as my queue to start finding another job. Not that I can't puzzle everything out from scratch every single time I need to do anything, but why should I reinvent the wheel when off-the-shelf is both faster and higher quality?

These types of policies and mismanagement drives out the best talent and leaves the organization filled with coasters who love any excuse to not do their job.

Re: How I learned about corporate firewalls

#60

Post by duckydude20 » Wed, Oct 05, 2022, 2:03 PM UTC

zasdffaa wrote: post #23

hyperman1 wrote: post #4

We once had to fight for stackoverflow access. Security responds: you devs should only require the manual provided by the vendor(in this case: Oracle javadocs)?

Little experience with javadocs, so how do they fall?

i am a junior developer and now i am rely heavily on them. esp, multi-threading stuff. but in most cases i know what i am looking for. the particular interface or at least i have some idea. this in true for most jdk framework. others java docs indirectly. ctrl + q. but i do sometimes go back and search uses/example of some implementation i found via docs. eg. selector and channels... but rn, i am liking reading docs first.