5 ms·

The URL: > http://fahrinfo.vbb.de/bin/help.exe http://fahrinfo.vbb.de/bin/help.exe Who would run this on a webserver?

by eloy 11y ago

TeMPOraL 11y ago
CGI lives. > Who would run this on a webserver? Who wouldn't? It's an executable. Just like your favourite language runtime. Just like 90% of the web.
- avar 11y ago
  It's quite easy to make this particular *.exe path return an "Internal Error" by fuzzing the GET parameters, which may or may not be due to someone having written something that parses user-supplied data in C that then segfaults :)
  - TeMPOraL 11y ago
    Assuming that they're even using C. It may as well be a dumped executable Lisp image.
    - germanier 11y ago
      The company behind that software, HAFAS (which is used almost everywhere in the German-speaking countries) constantly advertises for C++ and Java positions. As far as I'm aware the main part of the software, including the web facing portions, is written in C++. The software has a long history, the first webserver with it was started in 1995 and even that most likely reused logic from their first version of 1989. So the language choice is not too surprising.
      - orless 11y ago
        Small correction: the company is HaCon (http://www.hacon.de/ http://www.hacon.de/), HaFas is their software.
  - Piskvorrr 11y ago
    Well, what else would you return? A `400 Bad Request` error might be more appropriate, but a `500 Internal Server Error` is "A generic error message, given when an unexpected condition was encountered and no more specific message is suitable." - you don't want to leak internal state, obviously, so just log the problem and respond with a 500. TL;DR: Might be a segfault, but it's 2015 - it probably isn't.
    - lmm 11y ago
      5xx to me suggests that retrying is worthwhile. Any "deterministic" error (as a function of the parameters I submitted) should be a 4xx.
      - Piskvorrr 11y ago
        Definitely.
revelation 11y ago
A paths meaning is what they mean to the webserver, not to you. (That said, I'd be concerned if this is actually CGI..)
JonnieCache 11y ago
Ebay has .dll in its urls, or at least it used to. It's just code.
Piskvorrr 11y ago
RewriteRule /bin/help.exe /node/whatever.js [L,QSA] # where's your CGI now? I have seen such rewrites in place to keep old CGI URLs from breaking, as their consumers were scattered all over time and space, and it was easier to internally remap the old URLs (which have over the years essentially become a public API) than have them stop working.
- dagw 11y ago
  Yea, had a colleague many years ago who worked on a very large web site where all the php files ended in .asp
orless 11y ago
It's HaCon software, "exe" extensions are kept for historical reasons. These are not Windows binary for a long time already.

The URL: > http://fahrinfo.vbb.de/bin/help.exe http://fahrinfo.vbb.de/bin/help.exe Who would run this on a webserver?

by eloy 11y ago

The URL: > http://fahrinfo.vbb.de/bin/help.exe http://fahrinfo.vbb.de/bin/help.exe Who would run this on a webserver?

CGI lives. > Who would run this on a webserver? Who wouldn't? It's an executable. Just like your favourite language runtime. Just like 90% of the web.

avar 11y ago
It's quite easy to make this particular *.exe path return an "Internal Error" by fuzzing the GET parameters, which may or may not be due to someone having written something that parses user-supplied data in C that then segfaults :)
- TeMPOraL 11y ago
  Assuming that they're even using C. It may as well be a dumped executable Lisp image.
  - germanier 11y ago
    The company behind that software, HAFAS (which is used almost everywhere in the German-speaking countries) constantly advertises for C++ and Java positions. As far as I'm aware the main part of the software, including the web facing portions, is written in C++. The software has a long history, the first webserver with it was started in 1995 and even that most likely reused logic from their first version of 1989. So the language choice is not too surprising.
    - orless 11y ago
      Small correction: the company is HaCon (http://www.hacon.de/ http://www.hacon.de/), HaFas is their software.
- Piskvorrr 11y ago
  Well, what else would you return? A `400 Bad Request` error might be more appropriate, but a `500 Internal Server Error` is "A generic error message, given when an unexpected condition was encountered and no more specific message is suitable." - you don't want to leak internal state, obviously, so just log the problem and respond with a 500. TL;DR: Might be a segfault, but it's 2015 - it probably isn't.
  - lmm 11y ago
    5xx to me suggests that retrying is worthwhile. Any "deterministic" error (as a function of the parameters I submitted) should be a 4xx.
    - Piskvorrr 11y ago
      Definitely.

revelation 11y ago

A paths meaning is what they mean to the webserver, not to you. (That said, I'd be concerned if this is actually CGI..)

JonnieCache 11y ago

Ebay has .dll in its urls, or at least it used to. It's just code.

Piskvorrr 11y ago

RewriteRule /bin/help.exe /node/whatever.js [L,QSA] # where's your CGI now? I have seen such rewrites in place to keep old CGI URLs from breaking, as their consumers were scattered all over time and space, and it was easier to internally remap the old URLs (which have over the years essentially become a public API) than have them stop working.

dagw 11y ago
Yea, had a colleague many years ago who worked on a very large web site where all the php files ended in .asp

orless 11y ago

It's HaCon software, "exe" extensions are kept for historical reasons. These are not Windows binary for a long time already.