5 ms·

Since we're sharing war stories .. I have an O'Name. My employer game me an email address, first.o'name@corp. This, while being technically valid, broke many t

by soneil 3y ago

Since we're sharing war stories .. I have an O'Name. My employer game me an email address, first.o'name@corp. This, while being technically valid, broke many things as you can imagine. I asked repeatedly to have it changed, but to no avail. I got used to reciting my ID number on the phone because that@corp worked too. One day, I got a call from IT, almost apologetically asking if they could change my email address because it was causing them issues. I pointed out I'd requested such approximately every 3 years since I started. It turns out they'd never received those requests. I'll give you two guesses ..

layer8 3y ago
A long time ago, I used “/” as a separator in email address localparts under my domain (as in “foo/bar@example.com”), because that’s a valid email address syntax and I filtered my email into corresponding folders. As it turned out, some MTAs mapped localparts to local file system paths, with my email addresses wreaking havoc…
- nneonneo 3y ago
  Ah, time to use `foo/../../../etc/bar@example.com`! (Replace bar with passwd - I was blocked from submitting my original comment by Cloudflare's WAF...)
- pixl97 3y ago
  Heh, back in IE3 or IE4 days the temporary internet files directory would commonly save files temp files with the domain they came from without an extension. So if you visited microsoft.com it could save some asset in temp internet files as 'microsoft.com', which a com file is a valid executable extension. Of course this would trigger many anti-virus programs to scan it and now freak out that random content is ending up in executables. It took a bit of time between Microsoft making the temp internet a 'special directory' and AV working properly in the directory, and the browser not saving attacker controlled literals to the filesystem to get past these. Also fun in NTFS because it could cause bluescreens was the AUX, CON, PRNT filenames. Your post just reminded me of that kind of issue.
  - nneonneo 3y ago
    When I was quite young, I remember visiting a website on a public library machine (probably running Windows 98 at the time) which mistakenly downloaded a .com file instead of showing a page. I opened the .com (expecting it to be the file I wanted to read), and instead got a console window that showed some gibberish and then started up the printer. Surprisingly, the random text in the program was interpreted as valid program code. I was too young to understand exactly what had happened at the time, but now I understand it's because one of the valid forms of .com programs is a headerless chunk of x86 code for DOS, and I guess that website's output just happened to (a) not immediately crash and (b) invoke the DOS service for printing.
    - Aaron2222 3y ago
      Reminds me of a similar story from my childhood. I was also quite young at the time, accessing the public library OPAC from my home computer, and noticed the URL for the page ended in (I think) `.exe`. I know now that the OPAC was likely using CGI[0], but at the time I was curious, and somehow was able to download this `.exe`, Given it was a`.exe` and that it actually ran, I can't have just saved the webpage. I have a vague feeling I might have stripped the query parameters off the end of the URL, and that caused the web server to serve up the underlying `.exe` file. But whatever happened, when I ran the file, all it did was cause my printer (a parallel port one, not USB) to start printing blank pages. [0]: https://en.wikipedia.org/wiki/Common_Gateway_Interface https://en.wikipedia.org/wiki/Common_Gateway_Interface
      - miki123211 3y ago
        Hafas (the system of record for train scheduling information for Deutsche Bahn and the national Polish railways) does the same thing. An example URL is[1]. Both have better consumer frontends now (although I remember Deutsche Bahn still recommending this system around 2019), but those systems ultimately get all their data from this one, as far as I'm aware. [1] http://old.rozklad-pkp.pl/bin/query.exe/pn http://old.rozklad-pkp.pl/bin/query.exe/pn?
    - LorenPechtel 3y ago
giancarlostoro 3y ago
> It turns out they'd never received those requests. I'll give you two guesses .. I thought me having a hyphen on my last name was bad. I'm glad no place I work at has tried to add them. This is a great ending to this story btw, and maybe a reason to try and contact them via phone if you never hear back at all.
- checkyoursudo 3y ago
  "Using the alphanumeric keypad on your landline office phone, please type in your last name and first initial to route your call to the appropriate help desk."
ahazred8ta 3y ago
Most government systems in Ireland are not able to handle accented letters in names. SRSLY
noman-land 3y ago
This reads like a horror story. Especially the end.

by soneil 3y ago

layer8 3y ago

A long time ago, I used “/” as a separator in email address localparts under my domain (as in “foo/bar@example.com”), because that’s a valid email address syntax and I filtered my email into corresponding folders. As it turned out, some MTAs mapped localparts to local file system paths, with my email addresses wreaking havoc…

nneonneo 3y ago
Ah, time to use `foo/../../../etc/bar@example.com`! (Replace bar with passwd - I was blocked from submitting my original comment by Cloudflare's WAF...)
pixl97 3y ago
Heh, back in IE3 or IE4 days the temporary internet files directory would commonly save files temp files with the domain they came from without an extension. So if you visited microsoft.com it could save some asset in temp internet files as 'microsoft.com', which a com file is a valid executable extension. Of course this would trigger many anti-virus programs to scan it and now freak out that random content is ending up in executables. It took a bit of time between Microsoft making the temp internet a 'special directory' and AV working properly in the directory, and the browser not saving attacker controlled literals to the filesystem to get past these. Also fun in NTFS because it could cause bluescreens was the AUX, CON, PRNT filenames. Your post just reminded me of that kind of issue.
- nneonneo 3y ago
  When I was quite young, I remember visiting a website on a public library machine (probably running Windows 98 at the time) which mistakenly downloaded a .com file instead of showing a page. I opened the .com (expecting it to be the file I wanted to read), and instead got a console window that showed some gibberish and then started up the printer. Surprisingly, the random text in the program was interpreted as valid program code. I was too young to understand exactly what had happened at the time, but now I understand it's because one of the valid forms of .com programs is a headerless chunk of x86 code for DOS, and I guess that website's output just happened to (a) not immediately crash and (b) invoke the DOS service for printing.
  - Aaron2222 3y ago
    Reminds me of a similar story from my childhood. I was also quite young at the time, accessing the public library OPAC from my home computer, and noticed the URL for the page ended in (I think) `.exe`. I know now that the OPAC was likely using CGI[0], but at the time I was curious, and somehow was able to download this `.exe`, Given it was a`.exe` and that it actually ran, I can't have just saved the webpage. I have a vague feeling I might have stripped the query parameters off the end of the URL, and that caused the web server to serve up the underlying `.exe` file. But whatever happened, when I ran the file, all it did was cause my printer (a parallel port one, not USB) to start printing blank pages. [0]: https://en.wikipedia.org/wiki/Common_Gateway_Interface https://en.wikipedia.org/wiki/Common_Gateway_Interface
    - miki123211 3y ago
      Hafas (the system of record for train scheduling information for Deutsche Bahn and the national Polish railways) does the same thing. An example URL is[1]. Both have better consumer frontends now (although I remember Deutsche Bahn still recommending this system around 2019), but those systems ultimately get all their data from this one, as far as I'm aware. [1] http://old.rozklad-pkp.pl/bin/query.exe/pn http://old.rozklad-pkp.pl/bin/query.exe/pn?
  - LorenPechtel 3y ago

giancarlostoro 3y ago

> It turns out they'd never received those requests. I'll give you two guesses .. I thought me having a hyphen on my last name was bad. I'm glad no place I work at has tried to add them. This is a great ending to this story btw, and maybe a reason to try and contact them via phone if you never hear back at all.

checkyoursudo 3y ago
"Using the alphanumeric keypad on your landline office phone, please type in your last name and first initial to route your call to the appropriate help desk."

ahazred8ta 3y ago

Most government systems in Ireland are not able to handle accented letters in names. SRSLY

noman-land 3y ago

This reads like a horror story. Especially the end.