Hacker News Reader

Comment by cedivad | Hacker News Reader

That doesn't necessarily mean they are willingly blocking linux, I've seen inconspicuous user agent strings triggering 502 errors before. It's just badly written code.

View on HN

It's curious though, that the thread narrows it down to "X11; Linux", with that specific casing (update: nope, not case sensitive). Changing or removing any single char in that string stops the error.

They most likely had a reason to threat those people differently and a bug came up under that special case ;) Watch them fix it.

Ah, yes, I concur with that. I thought you meant some generic parsing error related to the user agent string.

I agree with the first sentence, but would advise against holding your breath until they have fixed it.

s/threat/treat/, though.

What browsers on Linux produce a User-agent containing that exact string _by default_, without user customization?

EDIT: Elsewhere in thread confirms Firefox and Chrome affected on lots of Linux.

Mine only contains "X11; Fedora; Linux".

I picked that up from the linked thread: 'So they're sniffing for "X11; Linux"'

Maybe just an oversimplified explanation, and it cares only about "X11;" and "Linux", regardless of whether they are together or not.

From the first comment of TFA:

> If I lowercase the 'L' it fails

so no, not that specific casing.

Ah, yeah. My head read failed as "failed to fail". Updated my comment.

Same, I read it twice to be sure because of the cognitive dissonance!

Could it be that they identified a crash/vuln that involves X11 on Linux, or DDoS, or ATO, and proactively block that as an emergency mitigation?

I still vote for a filter gone awry, no need to be needlessly conspiracist.

Yeah, I'd wager the firewall has a rule to check against bot traffic, which tend to come from Linux instances.

Probably overzealous, sure. Malicious? Doubtful.

Don't bots typically fake a windows/chrome user agent though? I guess there might be enough low effort bots that just throw up a default platform/curl user agent.

Narh, it's extremely common to see stuff like Firefox 34 for Linux trying to log into WordPress sites a few hundred times per hour. I guess it's old malware that lives on in hacked web sites that the owners abandoned.

Such a firewall could even have learned to block Linux user agents on its own. Similar to how some spam filters learn what email headers are associated with spammers. So if the firewall is seeing a lot of bad traffic with “X11; Linux” in their UA strings and little normal traffic with that in their UA strings then the firewall will take the presence of that as an indicator of possibly bad traffic.

I'm pretty sure they have integration tests to make sure that it doesn't block iOS devices. Not having those tests for common Linux browsers is... Apple.

any decent bot spoofs the UA string randomly to one of the top 10 most frequent UA strings. That's like a number 2 feature after the one the bot was built for.

A service we use has just started banning logins from the whole country of Japan on their cloudflare, just about to contact them about this. At this point I'm still willing to assume it's an automated filter gone wild and not some odd xenophobia

Reply on news.ycombinator.com