Hacker News Reader

Comment by StavrosK | Hacker News Reader

How? Do you think developers would be so crazy as to add some sort of "--user-agent" option to software like curl that would cause arbitrary strings to be presented as the user agent? Why would somebody write software to do this, just go on the internet and tell lies?

View on HN

I thought all this security nonsense ended in the 90s when they introduced the IS-MALICIOUS-REQUEST header. It must be, because I haven't seen any web traffic declaring itself malicious since then.

I believe most devices implemented now 11 years old RFC 3514. So evil packets and non-evil packets can be easily distinguished.

Even without --user-agent, you can still pipe 'echo -e "GET ...\rnHost: ... "' through nc, or even telnet.

Therefore, we obviously need to patch echo (and all echo shell builtins) to refuse to output strings containing "GET", "POST", "HTTP", or "Host:".

Ooh boy I'm imagining some bureaucratic version of an operating system that uses this sort of security up and down the entire stack like some rube Goldbergian contraption to whack a mole a particular vulnerability. Like an operating system designed by doctor Seuss.

> Therefore, we obviously need to patch echo (and all echo shell builtins) to refuse to output strings containing "GET", "POST", "HTTP", or "Host:".

Unfortunately it is also possible to do this using file redirection or to write a new program that will make a TCP connection and send arbitrary data through it, making it necessary to do the same for all editors, compilers and interpreters.

That sounds like a lot of work though (there are many such programs), so maybe we ought to just patch the kernel to prohibit any of those strings from being written to a file descriptor. There can't be that many false positives.

Why stop there? The user can easily modify the kernel to disable such prevention measures for malicious usage.

We must have a regulation to require a hardware level detection and prevention features of curl which all hardware vendors must follow.

oh god stop some politician might see this and take you for being srs

But users have fingers, which can be used to disable or subvert said "features". Thus, those fingers are just gonna have to go. They're a security risk, and security risks are against the regulations.

Your downvoters are terrible at detecting satire.

I know, that top comment has been a rollercoaster, +6, +2, 0, -3, -1, 2, and so on.

Thanks. I needed that laugh.

While that's probably technically feasible, that sounds like something only a terrorist would do anyway. All the more reason to ban the entire program, I say!

Only software developers with no honour would ever do that.

Reply on news.ycombinator.com