4 ms·

That does indeed sound non-critical, how many names do you run into with equal signs in them?

by avree 6y ago

imgabe 6y ago
Little Bobby Tables’ cousin, Jenny =true
mpol 6y ago
The name is just a string, right? If some character in the string is causing havoc, maybe there is something funky going on. This is just one symptom coming up at the surface. It might require a bit of extra investigation to see what is really the underlying problem and if that might cause more and different symptoms elsewhere.
- hannob 6y ago
  This is a key issue I see with bugbounty programs. They tend to react with "either you can show us that this is a real danger or we'll ignore it". It seems pretty clear that this bug shows something is terribly wrong and probably dangerous. But the reporter might have limits in analyzing the bug, while the company could easily figure out what's going on and fix it.
  - dane-pgp 6y ago
    > They tend to react with "either you can show us that this is a real danger or we'll ignore it". This is a bit of a Catch-22 situation, as I get the feeling that proving the danger would often involve doing things that bounty programs specifically forbid, such as "Moving beyond “proof of concept” repro steps"[0]. That may be part of the reason why Microsoft got away with such a stingy response to the RCE vulnerability found in Teams by Oskars Vegeris.[1] [0] https://www.microsoft.com/en-us/msrc/bounty-online-services?rtc=1 https://www.microsoft.com/en-us/msrc/bounty-online-services?... [1] https://github.com/oskarsve/ms-teams-rce/blob/main/README.md https://github.com/oskarsve/ms-teams-rce/blob/main/README.md
  - dkdk8283 6y ago
    I fault Agile for this and not big bounty implementations. Getting points to address a big because a random internet source pointed it out to us is difficult. There is likely a long backlog of bugs already.
dane-pgp 6y ago
Interestingly, Wikipedia does give at least one example: https://en.wikipedia.org/wiki/Equals_sign#Personal_names https://en.wikipedia.org/wiki/Equals_sign#Personal_names
hoppla 6y ago
I started a small company with a colon “:” in it. Should have not done that... I regularly encounter services that does not handle it very well
polm23 6y ago
When foreign names are written in Japanese there are a couple of ways of handling puncutation, and sometimes an equals sign is used. I hadn't actually thought about why it was used, but it seems an interpunct (・) is used where a space would be and equals can be used for an internal hyphen, or for words that are separated by a space but part of the same unit (de Niro).
- polm23 6y ago
  Some more detail on this, with citations, from an ask-a-librarian board (in Japanese). https://crd.ndl.go.jp/reference/modules/d3ndlcrdentry/index.php?page=ref_view&id=1000210282 https://crd.ndl.go.jp/reference/modules/d3ndlcrdentry/index....
fgonzag 6y ago
You only need to run into one to make someone's life a PITA. Treat names as free strings, because there are a lot of names that do not conform to any notion of western normality.
nanis 6y ago
> how many names do you run into with equal signs in them? That's not the issue ... I have not personally tried this or examined it, it looks like you can change the state of the header parser by including interesting characters in your name. I am not sure if this is server-side or client-side. If the problem is server side, there is a chance you could tweak the strings to get interesting results. But trying to prove that this is a serious problem without explicit authorization will likely have adverse consequences for anyone who does, so only people who are already doing shady stuff explore it.
karmakaze 6y ago
Whenever someone mistypes their hyphenated name with an =, say on their phone.
MikusR 6y ago
https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-believe-about-names/ https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-...

That does indeed sound non-critical, how many names do you run into with equal signs in them?

by avree 6y ago

That does indeed sound non-critical, how many names do you run into with equal signs in them?

imgabe 6y ago

Little Bobby Tables’ cousin, Jenny =true

mpol 6y ago

The name is just a string, right? If some character in the string is causing havoc, maybe there is something funky going on. This is just one symptom coming up at the surface. It might require a bit of extra investigation to see what is really the underlying problem and if that might cause more and different symptoms elsewhere.

hannob 6y ago
This is a key issue I see with bugbounty programs. They tend to react with "either you can show us that this is a real danger or we'll ignore it". It seems pretty clear that this bug shows something is terribly wrong and probably dangerous. But the reporter might have limits in analyzing the bug, while the company could easily figure out what's going on and fix it.
- dane-pgp 6y ago
  > They tend to react with "either you can show us that this is a real danger or we'll ignore it". This is a bit of a Catch-22 situation, as I get the feeling that proving the danger would often involve doing things that bounty programs specifically forbid, such as "Moving beyond “proof of concept” repro steps"[0]. That may be part of the reason why Microsoft got away with such a stingy response to the RCE vulnerability found in Teams by Oskars Vegeris.[1] [0] https://www.microsoft.com/en-us/msrc/bounty-online-services?rtc=1 https://www.microsoft.com/en-us/msrc/bounty-online-services?... [1] https://github.com/oskarsve/ms-teams-rce/blob/main/README.md https://github.com/oskarsve/ms-teams-rce/blob/main/README.md
- dkdk8283 6y ago
  I fault Agile for this and not big bounty implementations. Getting points to address a big because a random internet source pointed it out to us is difficult. There is likely a long backlog of bugs already.

dane-pgp 6y ago

Interestingly, Wikipedia does give at least one example: https://en.wikipedia.org/wiki/Equals_sign#Personal_names https://en.wikipedia.org/wiki/Equals_sign#Personal_names

hoppla 6y ago

I started a small company with a colon “:” in it. Should have not done that... I regularly encounter services that does not handle it very well

polm23 6y ago

When foreign names are written in Japanese there are a couple of ways of handling puncutation, and sometimes an equals sign is used. I hadn't actually thought about why it was used, but it seems an interpunct (・) is used where a space would be and equals can be used for an internal hyphen, or for words that are separated by a space but part of the same unit (de Niro).

polm23 6y ago
Some more detail on this, with citations, from an ask-a-librarian board (in Japanese). https://crd.ndl.go.jp/reference/modules/d3ndlcrdentry/index.php?page=ref_view&id=1000210282 https://crd.ndl.go.jp/reference/modules/d3ndlcrdentry/index....

fgonzag 6y ago

You only need to run into one to make someone's life a PITA. Treat names as free strings, because there are a lot of names that do not conform to any notion of western normality.

nanis 6y ago

> how many names do you run into with equal signs in them? That's not the issue ... I have not personally tried this or examined it, it looks like you can change the state of the header parser by including interesting characters in your name. I am not sure if this is server-side or client-side. If the problem is server side, there is a chance you could tweak the strings to get interesting results. But trying to prove that this is a serious problem without explicit authorization will likely have adverse consequences for anyone who does, so only people who are already doing shady stuff explore it.

karmakaze 6y ago

Whenever someone mistypes their hyphenated name with an =, say on their phone.

MikusR 6y ago

https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-believe-about-names/ https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-...