Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Curl is just the hobby

daniel.haxx.se

Post reply on HN
Print view View original

71–80 of 90 posts

Re: Curl is just the hobby

#71

Post by talkin »

Nextgrid wrote: post #51
talkin wrote: post #37

Earlier quoted context omitted.

Common misconception, but Https / TLS provides a combination of gaurantees, and the one cannot work without the other: Encrypted transit but you might be talking with the hacker on the other end == worthless. And with plaintext transit you cannot prove integrity during transit AND also not prove talking with the proper endpoint. In short: Browser really is warning you that something is fishy. Don’t shoot the messenge…

I think his complaint is that HSTS also prevents the user from overriding it and Firefox is complying, which I agree is a bit annoying.

Complaining about no overrides is complaining about not being able to ignore quite serious symptoms.

Firefox makes you fix the root problem.

Re: Curl is just the hobby

#72

Post by thaumasiotes »

The_Colonel wrote: post #47
thaumasiotes wrote: post #15

Earlier quoted context omitted.

> Just wondering, if the resource ID is known, I thought PUT is the recommended method? Recommended for what purpose? The set of recommendations I'm familiar with is: GET: requests without side effects POST: requests with side effects PUT: never use other: never use POST gets special treatment from browsers for various security risks. Otherwise, methods don't differ. You can use PUT as part of an effort to feel like…

PUT has a big advantage in that it is mandated to be idempotent - it is safe to be repeated if it fails for whatever reason. Meanwhile, POST is generally not considered safe to repeat in case of failure, because the client/proxy does not know where exactly the failure happened and if thus the processing has been already done or not.

Yes, that's why you use POST for everything with effects.

But if this is really your concern, you should also be using PUT to create new database records. In principle, those requests are safer to repeat than updates are, since the database will ignore repeated inserts and apply repeated updates. (Though as far as I can tell this only matters if your update adjusts a value rather than setting it outright.)

Re: Curl is just the hobby

#73

Post by JonChesterfield »

michaelt wrote: post #33
JonChesterfield wrote: post #21

Earlier quoted context omitted.

You don't see why Firefox refusing to connect would be annoying? I don't care whether the blog about curl is encrypted in transit or not and I do care about a forced change to chrome to see the content.

I can visit it in Firefox 123 just fine. Tests like [1] say the site works on everything from Firefox 31 to Firefox 73. You're probably the target of a MITM attack. Or you've done something weird, like taking a job with an employer that MITMs your web traffic then refusing to install their MITM certificates. [1] https://www.ssllabs.com/ssltest/analyze.html?d=daniel.haxx.s...

I'm definitely the victim of Vodafone screwing with the connection. They want me to prove my identity by giving them a card number, despite already having that because I pay for the SIM connection, but both their website and their mobile app are so poorly implemented that it's not actually possible to meet that inherently meaningless request.

It seems Firefox notices this and refuses to contact the site, and Chrome notices this and lets me override, but generally I don't see this failure mode. I wonder what is significant about this particular website.

I unsportingly separate work hardware from personal, no idea if my employer's likely MITM nonsense would have the same behaviour.

Learned something today, albeit with details missing. Oh and Vodafone employee if you're reading this? None of your tech works for shit.

Re: Curl is just the hobby

#74

Post by JonChesterfield »

Nextgrid wrote: post #51
talkin wrote: post #37

Earlier quoted context omitted.

Common misconception, but Https / TLS provides a combination of gaurantees, and the one cannot work without the other: Encrypted transit but you might be talking with the hacker on the other end == worthless. And with plaintext transit you cannot prove integrity during transit AND also not prove talking with the proper endpoint. In short: Browser really is warning you that something is fishy. Don’t shoot the messenge…

I think his complaint is that HSTS also prevents the user from overriding it and Firefox is complying, which I agree is a bit annoying.

Bingo. Primarily because I don't really mind if reading this post is compromised, but at least partly because I hadn't thought through the implications of vodafone intercepting traffic.

Re: Curl is just the hobby

#75

Post by UncleEntity »

aitchnyu wrote: post #67
polycaster wrote: post #3

Earlier quoted context omitted.

From Daniel's contact page: > Just don’t send me private emails about the open source projects I participate in – unless you want to pay for commercial and private support! So it's support basically, I suppose.

So who do I email when I'm angry at my car's screen and get lost at the "open source licenses" screen?

RMS I would presume.

Re: Curl is just the hobby

#76

Post by The_Colonel »

thaumasiotes wrote: post #72
The_Colonel wrote: post #47

Earlier quoted context omitted.

PUT has a big advantage in that it is mandated to be idempotent - it is safe to be repeated if it fails for whatever reason. Meanwhile, POST is generally not considered safe to repeat in case of failure, because the client/proxy does not know where exactly the failure happened and if thus the processing has been already done or not.

Yes, that's why you use POST for everything with effects. But if this is really your concern, you should also be using PUT to create new database records. In principle, those requests are safer to repeat than updates are, since the database will ignore repeated inserts and apply repeated updates. (Though as far as I can tell this only matters if your update adjusts a value rather than setting it outright.)

> Yes, that's why you use POST for everything with effects.

I don't get it. Isn't an idempotent effect still an effect?

> you should also be using PUT to create new database records.

If the client is free to define the identity, then I do. But if the resource gets e.g. an ID from Postgres sequence, then I need to use POST, because repeated call would create duplicates.

Re: Curl is just the hobby

#77

Post by BuildTheRobots »

JonChesterfield wrote: post #16

> https://daniel.haxx.se/blog/2024/04/22/curl-is-just-the-hobb... has a security policy called HTTP Strict Transport Security (HSTS), which means that Firefox can only connect to it securely. You can’t add an exception to visit this site. That's aggravating. What's the workaround? edit0: Chrome made more progress, then collided with Vodafone's shitty approximation to infrastructure which is known unsolvable. edit1: M…

Can I be cheeky and ask what VF service and in what country?

I've been using their CityFibre backed broadband in the UK for about 3 years and really can't complain - £32/month for 900mbit synchronous (which mostly actually lives up) and 4g backup.

I had to call them to remove the "child safe" filters when I first got it, but that's been the case for every ISP or phone provider I've used in the last 20 years. I also run my own DNS which might help, as I've seen others complain about that, but other than those two it's been impressively ignorable.

Re: Curl is just the hobby

#78

Post by yencabulator »

thaumasiotes wrote: post #44
eptcyka wrote: post #38

Earlier quoted context omitted.

PUT's can have request bodies, GETs can not.

Incorrect; GET requests are free to have bodies. See the note here: https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods/GE...

If you want a GET-with-body that actually works, use QUERY. The draft is expired, but at least it's just a non-standard method (which is fine!), not actively broken like GET-with-body.

https://datatracker.ietf.org/doc/draft-ietf-httpbis-safe-met...

Re: Curl is just the hobby

#80

Post by JonChesterfield »

BuildTheRobots wrote: post #77
JonChesterfield wrote: post #16

> https://daniel.haxx.se/blog/2024/04/22/curl-is-just-the-hobb... has a security policy called HTTP Strict Transport Security (HSTS), which means that Firefox can only connect to it securely. You can’t add an exception to visit this site. That's aggravating. What's the workaround? edit0: Chrome made more progress, then collided with Vodafone's shitty approximation to infrastructure which is known unsolvable. edit1: M…

Can I be cheeky and ask what VF service and in what country? I've been using their CityFibre backed broadband in the UK for about 3 years and really can't complain - £32/month for 900mbit synchronous (which mostly actually lives up) and 4g backup. I had to call them to remove the "child safe" filters when I first got it, but that's been the case for every ISP or phone provider I've used in the last 20 years. I also r…

The 4G mobile service, UK. Chosen based on mast placement. That's the filter that complained under Chrome, Firefox didn't get that far. DNS by Google, nominally, though I wouldn't be shocked if that wasn't configured successfully.
Post reply on HN