Hacker News Reader

Comment by benburleson | Hacker News Reader

Can't this be easily cached? It's GET of a unique URL, seems like a perfect solution.

An attacker could permute the load order or add other parameters, breaking any cache above the Wordpress level. This is definitely on WP to solve.

>This is definitely on WP to solve

How do you propose that WP solve DoS attacks against their application?

This script simply doesn't seem particularly slow to me, despite messing with the parameters a bit.

https://wordpress.com/wp-admin/load-scripts.php?c=0&load%5B%...

Perhaps most people here are missing the fact that you can hit literally any part of WP a lot and it will break.

"literally" as in "not literally" as most parts of WP are not vulnerable to this attack.

But they literally are.

i think you need to step away from your computer for a bit and calm down. Someone just found out about this vulnerability and yes there is debate about who is responsible for mitigating the attack vector, but that doesn't mean to get all stressed out about it. You are replying to ever comment that isn't aligned with your opinion at this point.

I'm perfectly calm.

>Someone just found out about this vulnerability

This is grossly misrepresenting the issue. There is no vulnerability, webapps are slow.

>that doesn't mean to get all stressed out about it. You are replying to ever comment that isn't aligned with your opinion at this point.

Not getting stressed out is exactly what I am trying to advocate by calling out people spreading FUD.

Not having this script might slow down the site some, but it would completely prevent this attack. The goal isn't to prevent all DoS attacks, it's to prevent massive force multipliers like this so that DoS attacks are expensive.

>Not having this script might slow down the site some, but it would completely prevent this attack.

Where "this attack" equals repeatedly requesting a script which isn't even particularly slow compared to other part of WP...

>it's to prevent massive force multipliers

This is not a "massive force multiplier". Please spend a tiny bit more time looking into the subject.

exactly, that's how every other adhoc solution does it. however the bigger issue is that since it site under wp-admin, it should require a login to access.

Reply on news.ycombinator.com