Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wikimedia narrows down the app sendin 90M requests to a pic of flower

phabricator.wikimedia.org

Post reply on HN
Print view View original

61–70 of 105 posts

Re: Wikimedia narrows down the app sendin 90M requests to a pic of flower

#61

Post by ohgodplsno »

oefrha wrote: post #59
zwily wrote: post #55

Earlier quoted context omitted.

The app may not load at all with mitmproxy if it has pinned its server cert though.

No, you can selectively decrypt HTTPS requests for only some domains, and act as passthrough for others.

Nope. Starting from Android 10, unless an app has explicitly allowed user certificates (and no-one reasonably does, it's all behind a flag), you will not be able to MITM it. You may inject your certificates as much as you want. The only option is to have a device on which you have root access, which can push system certificates with adb. This pretty much only means the android emulator these days.

Re: Wikimedia narrows down the app sendin 90M requests to a pic of flower

#62

Post by zymhan »

4cao wrote: post #60
rob74 wrote: post #56

Earlier quoted context omitted.

It's usually not a good idea to explain a joke, and I'm not the GP so I'm not sure that's what they meant, but "plant" has multiple meanings, and I suspect they are referring to meanings 3 to 5 from this list: https://www.oxfordlearnersdictionaries.com/definition/americ... . Basically, you were asking for some kind of elaborate meaning to a random image downloaded by a random app, and they provided an elaborate consp…

Thanks, I appreciate your effort but there really isn't any need to explain this to me. I understood the parent comment this way too (i.e. as a snide remark trying way too hard to be funny in the worst possible, low effort, Reddit kind of way). It's just that since it's rare to see this kind of response here, I was wondering if the author was trying to make any finer point, although admittedly that was unlikely to be…

Lol, I don't think you got the joke if you needed a paragraph long explanation of why you don't think it's funny.

It's also okay to not get a joke, you can simply move on with your life.

Re: Wikimedia narrows down the app sendin 90M requests to a pic of flower

#63

Post by jhamilton »

4cao wrote: post #60
rob74 wrote: post #56

Earlier quoted context omitted.

It's usually not a good idea to explain a joke, and I'm not the GP so I'm not sure that's what they meant, but "plant" has multiple meanings, and I suspect they are referring to meanings 3 to 5 from this list: https://www.oxfordlearnersdictionaries.com/definition/americ... . Basically, you were asking for some kind of elaborate meaning to a random image downloaded by a random app, and they provided an elaborate consp…

Thanks, I appreciate your effort but there really isn't any need to explain this to me. I understood the parent comment this way too (i.e. as a snide remark trying way too hard to be funny in the worst possible, low effort, Reddit kind of way). It's just that since it's rare to see this kind of response here, I was wondering if the author was trying to make any finer point, although admittedly that was unlikely to be…

Heaven forbid someone make a joke on the internet and not take your frustrations as seriously as you seem to take yourself.

To address your frustration at the analysis stopping there: What do you expect someone who is likely more versed in web dev and their unique distributed systems to do? Do you expect them to have the expertise to decompile an app from a third party, an app popular enough to cause this much traffic? And if they did, would it be worthwhile when their only concern is limiting/lowering that traffic?

Re: Wikimedia narrows down the app sendin 90M requests to a pic of flower

#64

Post by oefrha »

ohgodplsno wrote: post #61
oefrha wrote: post #59

Earlier quoted context omitted.

No, you can selectively decrypt HTTPS requests for only some domains, and act as passthrough for others.

Nope. Starting from Android 10, unless an app has explicitly allowed user certificates (and no-one reasonably does, it's all behind a flag), you will not be able to MITM it. You may inject your certificates as much as you want. The only option is to have a device on which you have root access, which can push system certificates with adb. This pretty much only means the android emulator these days.

I don’t use Android so I wasn’t aware of that. But that’s a completely separate concern from cert pinning which does not hinder decrypting third party connections at all.

Edit: after looking into this a bit, this is pretty nuts. How do enterprises inject certificates now?

Re: Wikimedia narrows down the app sendin 90M requests to a pic of flower

#65

Post by 4cao »

jhamilton wrote: post #63
4cao wrote: post #60

Earlier quoted context omitted.

Thanks, I appreciate your effort but there really isn't any need to explain this to me. I understood the parent comment this way too (i.e. as a snide remark trying way too hard to be funny in the worst possible, low effort, Reddit kind of way). It's just that since it's rare to see this kind of response here, I was wondering if the author was trying to make any finer point, although admittedly that was unlikely to be…

Heaven forbid someone make a joke on the internet and not take your frustrations as seriously as you seem to take yourself. To address your frustration at the analysis stopping there: What do you expect someone who is likely more versed in web dev and their unique distributed systems to do? Do you expect them to have the expertise to decompile an app from a third party, an app popular enough to cause this much traffi…

> What do you expect someone [...] to do?

I don't expect anyone to do anything. As a person reading this story, I just commented on the fact that it would be interesting to know more details as to how the app ended up making these requests in the first place.

I was just expressing my personal opinion that if I went this far investigating the situation, that's what I'd like to find out as well.

> [...] when their only concern is limiting/lowering that traffic?

If that were their only concern, they could have just (quoting my previous comment):

>> block[ed] the request URL/UA string pair, which was also an option

However:

>> since they already traced the culprit with a lot of effort [...] the logical ultimate step to conclude their investigation should be to see what the code does

Like everything else, this is just my personal opinion of course.

> your frustrations

> your frustration

Not really sure where this comes from but it's really unnecessary.

I'm glad for Wikimedia that they resolved the issue, and shared the details, which make for an interesting read.

Re: Wikimedia narrows down the app sendin 90M requests to a pic of flower

#67

Post by offtop5 »

raverbashing wrote: post #22
segfaultbuserr wrote: post #12

> [...] We will thus hold back the banning of the url for now, awaiting for confirmation of the desired effect to reduce the potential harmful impact on the application users. Given how much "sample code" we found around the internet using that url, it might still be a good idea to merge the patch later just to prevent this from happening again. Looks like a case that the developers carelessly copied and pasted some…

On one side, StackOverflow has been a blessing. On the other, it made "Copy Paste Programming" go to eleven. (There was even a C# example the other day that famously broke in a big project but I can't find it) Maybe it would be a case of Stack Overflow linting examples to remove stuff like builtin urls and such. I've seen "developers" complaining that example code with a very explicit >replace this part for your use…

I recall once, there's at least a prototype visual studio plugin which would copy code examples straight from the internet.

I would love a bet it list of common use case templates which can just pop up when I use visual studio.

Or maybe a sort of snippet box to drag and drop in my code. For example reading and writing a file in C sharp isn't something I exactly know off the top of my head.

Re: Wikimedia narrows down the app sendin 90M requests to a pic of flower

#69

Post by izacus »

cypressious wrote: post #28
raverbashing wrote: post #22

Earlier quoted context omitted.

On one side, StackOverflow has been a blessing. On the other, it made "Copy Paste Programming" go to eleven. (There was even a C# example the other day that famously broke in a big project but I can't find it) Maybe it would be a case of Stack Overflow linting examples to remove stuff like builtin urls and such. I've seen "developers" complaining that example code with a very explicit >replace this part for your use…

You're probably thinking about some app not being able to start when some other specific app is running because both were using a GUID copied from SO for implementing single-instance apps. Possibly the SO question in question: https://stackoverflow.com/a/522874/615306

Yeah, it was Docker for Windows and Razer Synapse 3 who couldn't work together because they both copied the same SO code: https://twitter.com/Foone/status/1229641258370355200 :)

Re: Wikimedia narrows down the app sendin 90M requests to a pic of flower

#70

Post by DaniloDias »

jgrahamc wrote: post #27

Some time we'll get round to writing this up but there's a small customer of Cloudflare that gets a very high HTTP requests per second rate. It's a simple service (bit like a "what's my IP address" but not that) and it turns out that a quite popular hardware device hard-coded requests to this service and doesn't appear to cache the results and so it asks over and over and over again for the same information. We've co…

Could you be more explicit on the nature of the service?

I’d like to explore mechanisms for tests that detect IoT devices that misbehave this way (and other ways as well). Your anecdote sounds interesting. Is it unrelated to time servers? Unrelated to internet connectivity tests?

Post reply on HN