Hacker News Reader

Comment by bjornsing | Hacker News Reader

I'll say it again [1]: Thank God for Florian Weimer! And after this excellent post I'm adding Michal Zalewski to that list.

1. https://news.ycombinator.com/item?id=8378515

View on HN

His main website contains hours of reading on everything from computer security to home-machining and robotics. Well worth a read.

http://lcamtuf.coredump.cx/

Don't forget 'Silence on the Wire' and 'The Tangled Web', two of my personal favorite computer security books.

That stuff's great. But do you know why he's on my list? He doesn't seem to think it's a good idea for a shell to parse its entire environment; he seems to think that its better to use the name of an environment variable than its value to determine if it's input to the shell or not; he seems to feel somewhat less at ease with the thought of millions of HTTP request headers passing through the bash parser, relying on its myriad of parsing rules to ensure that no part of them is accidentally executed as a shell command - now or tomorrow.

I must say that this shellchock thing has shaken my belief in humanity somewhat... Why is it that these are not obvious principles that we all agree on? Am I just too "oldschool" or something? :)

Part of this is reflected in things like "Robustness Principle". This encourages programs to go out of spec and be creative with inputs to make things "easier"... but it only makes things worse.

SIP, for instance, has very complicated parsing rules (like HTTP) because the messages are designed to be written by hand. This introduces security holes as well as interop. But instead of recognizing this and trying to get programs to be strict, the IETF publishes a document where they gleefully list a bunch of crazy things possible in their spec, and encourage programs that guess at the intent of malformed messages.

Yea... That's also utterly insane...

I'm currently dealing with SIP messages at work. My manager actually told me not to be so pedantic with the parsing as we got some complaints from other vendors (and privately, I thought: why bother with standards if you aren't going to follow them?) I ended up with logging a warning instead of returning an error. Sigh.

You can't actually parse SIP messages unambiguously these days. Even big open source projects like Asterisk and OpenSIPS have strictly different and incompatible interpretations. I'm purely talking about parsing, not actually interpretation of the content. It's that bad. And yes, this opens up security holes when one system is trusted to read the message correctly.

Reply on news.ycombinator.com