4 ms·
Eh? Software can do exactly that.
by abraae 8y ago
Eh? Software can do exactly that.
- arcticbull 8y agoPretty sure that was sarcasm haha
- deleted 8y ago[deleted]
- StavrosK 8y agoHow? Do you think developers would be so crazy as to add some sort of "--user-agent" option to software like curl that would cause arbitrary strings to be presented as the user agent? Why would somebody write software to do this, just go on the internet and tell lies?
- faitswulff 8y agoI thought all this security nonsense ended in the 90s when they introduced the IS-MALICIOUS-REQUEST header. It must be, because I haven't seen any web traffic declaring itself malicious since then.
- ezoe 8y agoI believe most devices implemented now 11 years old RFC 3514. So evil packets and non-evil packets can be easily distinguished.
- TheCraiggers 8y agoWhile that's probably technically feasible, that sounds like something only a terrorist would do anyway. All the more reason to ban the entire program, I say!
- deleted 8y ago[deleted]
- maxaf 8y agoYour downvoters are terrible at detecting satire.
- anyfoo 8y agoEven without --user-agent, you can still pipe 'echo -e "GET ...\rnHost: ... "' through nc, or even telnet. Therefore, we obviously need to patch echo (and all echo shell builtins) to refuse to output strings containing "GET", "POST", "HTTP", or "Host:".
- colordrops 8y agoOoh boy I'm imagining some bureaucratic version of an operating system that uses this sort of security up and down the entire stack like some rube Goldbergian contraption to whack a mole a particular vulnerability. Like an operating system designed by doctor Seuss.
- zrm 8y ago> Therefore, we obviously need to patch echo (and all echo shell builtins) to refuse to output strings containing "GET", "POST", "HTTP", or "Host:". Unfortunately it is also possible to do this using file redirection or to write a new program that will make a TCP connection and send arbitrary data through it, making it necessary to do the same for all editors, compilers and interpreters. That sounds like a lot of work though (there are many such programs), so maybe we ought to just patch the kernel to prohibit any of those strings from being written to a file descriptor. There can't be that many false positives.
- ezoe 8y agoWhy stop there? The user can easily modify the kernel to disable such prevention measures for malicious usage. We must have a regulation to require a hardware level detection and prevention features of curl which all hardware vendors must follow.
- asynch8 8y agooh god stop some politician might see this and take you for being srs
- craftinator 8y agoBut users have fingers, which can be used to disable or subvert said "features". Thus, those fingers are just gonna have to go. They're a security risk, and security risks are against the regulations.
- sbmassey 8y agoOnly software developers with no honour would ever do that.