Hacker News Reader

Comment by stavros | Hacker News Reader

I don't see what the fuss is about. This is an effective mitigation, given that software can't just arbitrarily lie about its user agent.

View on HN

I guess the biggest problem is that the mitigation isn't future-proof. Someday, there might be other command-line tools besides cURL that can be used for this kind of attack.

A better fix would be to just drop all incoming IPv4 packets that have the "evil" bit set. (https://www.ietf.org/rfc/rfc3514.txt) Extending this protection to IPv6 is left as an exercise for the reader.

Ah, but what about packets that aren't evil, just gullible and manipulated by some third party?

Well if you’d read the RFC it’s obvious it’s your routers responsibility to flag those bits as evil. And if you’re using heuristic intrusion detection systems you need to do flag each bit as evil 50% of the time. It’s good we have such amazing protections in place.

Then add a "tainted by evil" flag to the ipv7 spec, or better, just add a "pure" flag to future ip spec.

I think I'd almost prefer an "alignment" flag, so we don't mischaracterize all the Chaotic Neutral packets.

But then what to do with the Lawful Evil packets ?

Add an x-Lawful-Warrant parameter to provide a warrant. It can’t be read by anything but the best AI technology and is included in every HTTP request. No warrant, no response!

It's not like curl can't easily spoof a user agent either.

We can claim the LSB of the sequence number.

I think you should have added a /s tag... some people don't get jokes unless you hit them over the head with it.

I will never stoop so low as to telegraph my own joke.

I couldn't agree more. The joke construction was a bit weak though, when you miss a good part of the audience. Add something like, "I mean, could you imagine the chaos it would cause if IE told websites it was really Mozilla?" and you demonstrate mastery of the subject matter, which should be enough to let other experts know you were facetious rather than ignorant. Unless you have timing issues... or need the comedian's plausible deniability.

I don't find that as funny, I think making the sarcasm more obvious makes the joke less funny as well. I prefer to take my chances than to go overboard and neuter the joke.

I like the original more without your embellishment. The addition sounds like every attempt at follow up humor on reddit.

Yeah but it's not Reddit, it's HN. You have to know your audience, read the crowd. On Reddit it's 90% sarcasm so there's no fixing it. Here it's the reverse and people take things seriously without a tell. You just have to bury the tell in another joke or it will ruin the funny.

"given that software can't [ridiculous thing no one has ever claimed]" is plenty for a tell.

Just the fact that this “fix” exists tells you some people believe differently.

If you can’t discern the joke, the joke isn’t for you to begin with; so it doesn’t matter.

Sir, your assessment of this particular joke is excellent. We should start a joke approval committee to avoid further confusion.

Yes, very well, as first action of the Joke Approval Committee, I propose that this august body instantiate the Recursed Approval Subcommittee, whose role will be to instantiate the Recursed Approval Subcommittee.

That's a perfect example you should post to JAC before. It would not pass, please never post this "joke" again.

Welcome on board :)

As soon as the subcommittees hit their break condition (0), they'll break for coffee and donuts, and I can submit my "joke" to the JAC. And I don't make a habit of repeatedly posting the same joke, but I cannot make the promise in this case.

It puts the motion in the basket.

In textualform, sarcasm and ignorance look the same. otoh, it can sometime be quite funny to see responses from people that take it seriously...

I've never posted sarcasm online without at lease one person (that guy) who takes it seriously and decides to reply. But I think it's worth it because the people who get it will get it. If a small group doesn't then who cares (if everyone doesn't then you did a bad job constructing a joke).

Then you must encounter Poe's Law frequently....?

All the time. After having seen the kinds of things some people will say in earnest, I will never begrudge someone missing my sarcasm.

Exactly. Hacking your client to use another user-agent or another IP address is illegal under CFAA. See Craigslist Inc. v. 3Taps Inc. etc...

So when I check desktop site in chrome I'm hacking?

Of course! So is right clicking and selecting inspect element to modify the page!

That's why super secure websites block right-click events on their webpage. Makes them unhackable!

I would call it hacking.. you sometimes run into those websites with 50 different opacity bits for all their web app things, and you don’t want to deal with all that rubbish so you set a “opacity: 1 !important” and the whole website looks off but it’s finally useable. I’d call that a hack.

Or also when you run into those websites designed on a $2000 screen that thinks it’s tres moderne to use 808080 text, so you “hack” it into readable text.

I think those are all happy little hacks :-)

Actually you can use -A to change the user agent in Curl itself. For example:

  curl -A "YourNewUserAgentString” http://url.com

Furthermore, there are free plugins or add-ons for both Chrome and Firefox that let you change the user agent and say you’re using IE, a mobile browser, a google bot, or anything you want the user agent string to say.

Most programmers should be able to write a small script using Python’s urllib or urllib2 to do a basic PUT or GET request with any User Agent. Heck, just type “change user agent python urllib” into google, click on the first stack overflow link, and copy/paste the answer. You can use Go, ruby, java, nodeJS, or PHP instead as well.

Edit: Maybe your comment was sarcasm :)

> Edit: Maybe your comment was sarcasm :)

I still appreciate you putting in the effort to explain. Have an upvote!

I have to fix my sarcasm detection AI again because of this comment

You're welcome!

Exactly, once they roll out the patch with a boolean OR in the conditional as '$http_user_agent ~* "wget"', it'll pretty much be hack proof!

It does seem so obviously simple to sidestep that it makes me wonder if they pushed it because they had an active attack they believed it would mitigate. Were they concerned that the attack was already baked into some automated script in the wild and this could perhaps at least trip up the script long enough for them to engineer a real fix?

Scripted attacks can of course be modified too, but it still takes more than zero human effort to do it.

Well, they can, but first they have to flip the RFC3514 "Evil" bit.

Curl can, easily. Curl is not just a client to get a file and pipe it to other programs, it's a diagnostic tool, and it has all sorts of parameters to help it simmulate all kinds of interaction with a webserver, including the -A parameter to change the user-agent, this is why this 'fix' is so stupid.

I see, thank you for the explanation!

Well played, sir.

It was nice of them to explain it, though, in case I meant it seriously!

This is quite funny

I am not laughing one bit let me tell you. Honesty in user agents is one of the last few defenses we have against hackers running rampant on the internet and turning it into some lawless wasteland where people don't even answer truthfully about their A/S/L.

> "A/S/L"

I have not seen that in a long time.

I guess American Sign Language isn't as widespread as it used to be, now that everyone just texts all day anyway.

They might be able to fix it by making the only valid user agent “not-curl-honest”.

curl -A "iswearimnotcurl" <exploit>

libcurl is open source, I would imagine it'd not be difficult to make it "lie."

Someone who also did not get the joke is going to read your comment, and suggest that libcurl being closed source somehow fixes the problem.

(Hint: the curl command already has a --user-agent parameter which allows the user to set the user agent string.)

Eh? Software can do exactly that.

How? Do you think developers would be so crazy as to add some sort of "--user-agent" option to software like curl that would cause arbitrary strings to be presented as the user agent? Why would somebody write software to do this, just go on the internet and tell lies?

I thought all this security nonsense ended in the 90s when they introduced the IS-MALICIOUS-REQUEST header. It must be, because I haven't seen any web traffic declaring itself malicious since then.

I believe most devices implemented now 11 years old RFC 3514. So evil packets and non-evil packets can be easily distinguished.

Even without --user-agent, you can still pipe 'echo -e "GET ...\rnHost: ... "' through nc, or even telnet.

Therefore, we obviously need to patch echo (and all echo shell builtins) to refuse to output strings containing "GET", "POST", "HTTP", or "Host:".

> Therefore, we obviously need to patch echo (and all echo shell builtins) to refuse to output strings containing "GET", "POST", "HTTP", or "Host:".

Unfortunately it is also possible to do this using file redirection or to write a new program that will make a TCP connection and send arbitrary data through it, making it necessary to do the same for all editors, compilers and interpreters.

That sounds like a lot of work though (there are many such programs), so maybe we ought to just patch the kernel to prohibit any of those strings from being written to a file descriptor. There can't be that many false positives.

Why stop there? The user can easily modify the kernel to disable such prevention measures for malicious usage.

We must have a regulation to require a hardware level detection and prevention features of curl which all hardware vendors must follow.

oh god stop some politician might see this and take you for being srs

But users have fingers, which can be used to disable or subvert said "features". Thus, those fingers are just gonna have to go. They're a security risk, and security risks are against the regulations.

Ooh boy I'm imagining some bureaucratic version of an operating system that uses this sort of security up and down the entire stack like some rube Goldbergian contraption to whack a mole a particular vulnerability. Like an operating system designed by doctor Seuss.

Your downvoters are terrible at detecting satire.

I know, that top comment has been a rollercoaster, +6, +2, 0, -3, -1, 2, and so on.

Thanks. I needed that laugh.

While that's probably technically feasible, that sounds like something only a terrorist would do anyway. All the more reason to ban the entire program, I say!

Only software developers with no honour would ever do that.

Pretty sure that was sarcasm haha

And it is also very good that regexes are simple, unambiguous, easy to debug and their engines are heavily scrutinized that no code execution/undefined behavior is possible.

Reply on news.ycombinator.com