4 ms·

Can't this be easily cached? It's GET of a unique URL, seems like a perfect solution.

btown 9y ago
An attacker could permute the load order or add other parameters, breaking any cache above the Wordpress level. This is definitely on WP to solve.
- ryanlol 9y ago
  >This is definitely on WP to solve How do you propose that WP solve DoS attacks against their application? This script simply doesn't seem particularly slow to me, despite messing with the parameters a bit. https://wordpress.com/wp-admin/load-scripts.php?c=0&load%5B%5D=accordion,accordion,bookmarklet,bookmarklet,color-picker,color-picker,comment,comment,common,common,custom-background,custom-background,custom-header,customize-controls,customize-controls,customize-nav-menus,customize-nav-menus,customize-widgets,customize-widgets,dashboard,dashboard,edit-comments,edit-comments,editor-expand,editor-expand,editor,editor,farbtastic,gallery,gallery,image-edit,image-edit,inline-edit-post,inline-edit-post,inline-edit-tax,inline-edit-tax,iris,language-chooser,language-chooser,link,link,media-gallery,media-gallery,media-upload,media-upload,media,media,nav-menu,nav-menu,password-strength-meter,password-strength-meter,plugin-install,plugin-install,post,post,postbox,postbox,press-this,press-this,revisions,revisions,set-post-thumbnail,set-post-thumbnail,svg-painter,svg-painter,tags-box,tags-box,tags,tags,theme,theme,updates,updates,user-profile,user-profile,user-suggest,user-suggest,widgets,widgets,word-count,word-count,wp-fullscreen-stub,wp-fullscreen-stub,xfn,xfn https://wordpress.com/wp-admin/load-scripts.php?c=0&load%5B%... Perhaps most people here are missing the fact that you can hit literally any part of WP a lot and it will break.
  - SippinLean 9y ago
    "literally" as in "not literally" as most parts of WP are not vulnerable to this attack.
    - ryanlol 9y ago
      But they literally are.
      - thrownaway954 9y ago
        i think you need to step away from your computer for a bit and calm down. Someone just found out about this vulnerability and yes there is debate about who is responsible for mitigating the attack vector, but that doesn't mean to get all stressed out about it. You are replying to ever comment that isn't aligned with your opinion at this point.
        ryanlol 9y ago
        I'm perfectly calm. >Someone just found out about this vulnerability This is grossly misrepresenting the issue. There is no vulnerability, webapps are slow. >that doesn't mean to get all stressed out about it. You are replying to ever comment that isn't aligned with your opinion at this point. Not getting stressed out is exactly what I am trying to advocate by calling out people spreading FUD.
  - ball_of_lint 9y ago
    Not having this script might slow down the site some, but it would completely prevent this attack. The goal isn't to prevent all DoS attacks, it's to prevent massive force multipliers like this so that DoS attacks are expensive.
    - ryanlol 9y ago
      >Not having this script might slow down the site some, but it would completely prevent this attack. Where "this attack" equals repeatedly requesting a script which isn't even particularly slow compared to other part of WP... >it's to prevent massive force multipliers This is not a "massive force multiplier". Please spend a tiny bit more time looking into the subject.
thrownaway954 9y ago
exactly, that's how every other adhoc solution does it. however the bigger issue is that since it site under wp-admin, it should require a login to access.
- ryanlol 9y ago
  >however the bigger issue is that since it site under wp-admin, it should require a login to access. wtf?

An attacker could permute the load order or add other parameters, breaking any cache above the Wordpress level. This is definitely on WP to solve.

ryanlol 9y ago
>This is definitely on WP to solve How do you propose that WP solve DoS attacks against their application? This script simply doesn't seem particularly slow to me, despite messing with the parameters a bit. https://wordpress.com/wp-admin/load-scripts.php?c=0&load%5B%5D=accordion,accordion,bookmarklet,bookmarklet,color-picker,color-picker,comment,comment,common,common,custom-background,custom-background,custom-header,customize-controls,customize-controls,customize-nav-menus,customize-nav-menus,customize-widgets,customize-widgets,dashboard,dashboard,edit-comments,edit-comments,editor-expand,editor-expand,editor,editor,farbtastic,gallery,gallery,image-edit,image-edit,inline-edit-post,inline-edit-post,inline-edit-tax,inline-edit-tax,iris,language-chooser,language-chooser,link,link,media-gallery,media-gallery,media-upload,media-upload,media,media,nav-menu,nav-menu,password-strength-meter,password-strength-meter,plugin-install,plugin-install,post,post,postbox,postbox,press-this,press-this,revisions,revisions,set-post-thumbnail,set-post-thumbnail,svg-painter,svg-painter,tags-box,tags-box,tags,tags,theme,theme,updates,updates,user-profile,user-profile,user-suggest,user-suggest,widgets,widgets,word-count,word-count,wp-fullscreen-stub,wp-fullscreen-stub,xfn,xfn https://wordpress.com/wp-admin/load-scripts.php?c=0&load%5B%... Perhaps most people here are missing the fact that you can hit literally any part of WP a lot and it will break.
- SippinLean 9y ago
  "literally" as in "not literally" as most parts of WP are not vulnerable to this attack.
  - ryanlol 9y ago
    But they literally are.
    - thrownaway954 9y ago
      i think you need to step away from your computer for a bit and calm down. Someone just found out about this vulnerability and yes there is debate about who is responsible for mitigating the attack vector, but that doesn't mean to get all stressed out about it. You are replying to ever comment that isn't aligned with your opinion at this point.
      - ryanlol 9y ago
        I'm perfectly calm. >Someone just found out about this vulnerability This is grossly misrepresenting the issue. There is no vulnerability, webapps are slow. >that doesn't mean to get all stressed out about it. You are replying to ever comment that isn't aligned with your opinion at this point. Not getting stressed out is exactly what I am trying to advocate by calling out people spreading FUD.
- ball_of_lint 9y ago
  Not having this script might slow down the site some, but it would completely prevent this attack. The goal isn't to prevent all DoS attacks, it's to prevent massive force multipliers like this so that DoS attacks are expensive.
  - ryanlol 9y ago
    >Not having this script might slow down the site some, but it would completely prevent this attack. Where "this attack" equals repeatedly requesting a script which isn't even particularly slow compared to other part of WP... >it's to prevent massive force multipliers This is not a "massive force multiplier". Please spend a tiny bit more time looking into the subject.

thrownaway954 9y ago

exactly, that's how every other adhoc solution does it. however the bigger issue is that since it site under wp-admin, it should require a login to access.

ryanlol 9y ago
>however the bigger issue is that since it site under wp-admin, it should require a login to access. wtf?