4 ms·

It's not safe to visit random URLs, especially URLs with parameters in them.

by partycoder 10y ago

averagewall 10y ago
Why? Drive by exploits get stomped out by browser makers. What could go wrong? A 0-day being wasted on a stranger?
- partycoder 10y ago
  More like tricking you into interacting with a website in an unintended way, not only through GET parameters but through clickjacking and other tricks. https://en.wikipedia.org/wiki/Clickjacking https://en.wikipedia.org/wiki/Clickjacking
  - laumars 10y ago
    There's no such thing as "GET parameters". I assume you are referring to the query string but that's not necessary for encoding resource specific content. You could use the path structure (which is the common way these days), the domain name itself (eg different sub domains for different content), the user agent string, referrer, IP location (eg GeoIP). This is only just scratching the surface too as I've not even began to cover the client side rules one can apply to create a targeted page. Essentially anything that runs like an application can be dynamically generated to be specific to the visitor and since websites can be executed both at the server side and client side (eg Javascript) you're blindly placing you're trust on any URL. Frankly, these days you can't even trust the domain name itself since punycode and data inlining create easy vectors for spoofing, and DNS poisoning attacks are still widely possible.
iagooar 10y ago
Never heard of someone dying because of visiting a random URL. For those with hyperparanoia, just install a VM.
laumars 10y ago
All URLs are parameters. The only safe way to browse the web is simply not to.
- partycoder 10y ago
  laumars, you seem to be antagonizing my comments and downvoting regularly. There are people with different perspectives here in HN, but I do not see you replying to each one of them. Your only recent activity has been exclusively on my threads, with a tone not allowed on the HN comments section (personal attacks), baiting for responses so you can downvote them, since you can only downvote a reply once and there's a minimum karma requirement for downvoting so it's unfeasible to do it with fake accounts. We just had a pointless argument thread 20 levels deep a few days ago (which was not the first one), where neither of us conceded to the other's point of view. A waste of time, HN karma, and I still think you were wrong. HN is not the Monty Python argument clinic: https://www.youtube.com/watch?v=kQFKtI6gn9Y https://www.youtube.com/watch?v=kQFKtI6gn9Y
  - deleted 10y ago
    [deleted]
  - laumars 10y ago
    You cannot down vote replies so it's not me who's been negative reping you. I also haven't been following you around HN nor posting personal attacks. I just said "all URLs are parameters" because your comment was weird and misleading (for reasons i elaborated in the other post i left yesterday). HN is a technical discussion forum so there will be times when people will disagree with the technical points you raise; particularly when you continue to comment on technical topics you only partially understand (as seen here). My advice to you would be to take a second to digest those counterarguments to check if they are informative rather than assuming every counterargument is a "personal attack". And if there's not enough data to understand their point then ask for clarification or an elaboration. I've learned a lot from the discussions on here just through reading those counterarguments and certainly am not too proud to admit when i have been wrong.
    - 10y ago

It's not safe to visit random URLs, especially URLs with parameters in them.

averagewall 10y ago

Why? Drive by exploits get stomped out by browser makers. What could go wrong? A 0-day being wasted on a stranger?

partycoder 10y ago
More like tricking you into interacting with a website in an unintended way, not only through GET parameters but through clickjacking and other tricks. https://en.wikipedia.org/wiki/Clickjacking https://en.wikipedia.org/wiki/Clickjacking
- laumars 10y ago
  There's no such thing as "GET parameters". I assume you are referring to the query string but that's not necessary for encoding resource specific content. You could use the path structure (which is the common way these days), the domain name itself (eg different sub domains for different content), the user agent string, referrer, IP location (eg GeoIP). This is only just scratching the surface too as I've not even began to cover the client side rules one can apply to create a targeted page. Essentially anything that runs like an application can be dynamically generated to be specific to the visitor and since websites can be executed both at the server side and client side (eg Javascript) you're blindly placing you're trust on any URL. Frankly, these days you can't even trust the domain name itself since punycode and data inlining create easy vectors for spoofing, and DNS poisoning attacks are still widely possible.

iagooar 10y ago

Never heard of someone dying because of visiting a random URL. For those with hyperparanoia, just install a VM.

laumars 10y ago

All URLs are parameters. The only safe way to browse the web is simply not to.

partycoder 10y ago
laumars, you seem to be antagonizing my comments and downvoting regularly. There are people with different perspectives here in HN, but I do not see you replying to each one of them. Your only recent activity has been exclusively on my threads, with a tone not allowed on the HN comments section (personal attacks), baiting for responses so you can downvote them, since you can only downvote a reply once and there's a minimum karma requirement for downvoting so it's unfeasible to do it with fake accounts. We just had a pointless argument thread 20 levels deep a few days ago (which was not the first one), where neither of us conceded to the other's point of view. A waste of time, HN karma, and I still think you were wrong. HN is not the Monty Python argument clinic: https://www.youtube.com/watch?v=kQFKtI6gn9Y https://www.youtube.com/watch?v=kQFKtI6gn9Y
- deleted 10y ago
  [deleted]
- laumars 10y ago
  You cannot down vote replies so it's not me who's been negative reping you. I also haven't been following you around HN nor posting personal attacks. I just said "all URLs are parameters" because your comment was weird and misleading (for reasons i elaborated in the other post i left yesterday). HN is a technical discussion forum so there will be times when people will disagree with the technical points you raise; particularly when you continue to comment on technical topics you only partially understand (as seen here). My advice to you would be to take a second to digest those counterarguments to check if they are informative rather than assuming every counterargument is a "personal attack". And if there's not enough data to understand their point then ask for clarification or an elaboration. I've learned a lot from the discussions on here just through reading those counterarguments and certainly am not too proud to admit when i have been wrong.
  - 10y ago