3 ms·
Or, how I made my service a DDoS target. It's not just the extra compute, it's the lack of a formal specification. If different services applied this kind of a
by mwkaufma 10y ago
Or, how I made my service a DDoS target.
It's not just the extra compute, it's the lack of a formal specification. If different services applied this kind of ad hoc "postel's principle" they may parse the malformed markup differently, and end up introducing downstream inconsistencies.
- hueving 10y agoOr even vulnerabilities. Imagine a scenario where a parser for an authentication engine reads a different value for a given key than the value the authorization logic reads.
- brassic 10y agoThis isn't theoretical, I've seen it with HTTP, HTML and elsewhere. Any time two pieces of software disagree on how to parse a chunk of data, especially if one of them is supposed to be doing some sort of security check, you should expect to find a vulnerability lurking. I don't know if there's a name for this class of problem. I'd be interested to know.