« first day (4005 days earlier)      last day (46 days later) » 

jrh
6:29 PM
There's a recommendation on openapi scanner sites: set a min and max expected length of responses. Is this supposed to prevent me from sending requests 1 TB in length or something? Is there any reason why I shouldn't just set it to something like 1000 (or even 1000000) characters if it's not static string length? Computers are pretty good at shuffling text around.
Does it think I'm running a C API behind it and used statically allocated arrays or something? Seems kinda silly...
 
7:24 PM
I don't think that's the case...depending on your side, 1TB of traffic can be costy
 
jrh
Right, but that's not really a "security" issue. I'd say 1 MB would be a limit I'd probably never hit for what I'm doing, 1K if I want to be stingy. High server costs aren't really a 'security issue' either as the site presents it.
 
jrh
7:46 PM
chat.stackexchange.com/transcript/message/59598842#59598842 @forest do you have a link for this? Mailing list / etc? I haven't heard about this.
 
 
1 hour later…
8:53 PM
@jrh Why would you say high server costs aren't a security issue?
 
jrh
@nobody It's not great, for sure, but I would define a security issue as something that allows for arbitrary code execution, leaks data, installs a cryptominer, installs some other malware/backdoor, etc.
 
@jrh Would you call a denial of service attack a service issue?
Because this is worse than a simple dos, it causes real damage to you.
 
jrh
@nobody A service issue, yes, but not "security", unless it causes some other bug
The reason why it's a distinction is, if I drop the ball on security, my users are the victims, if I get DDoSed it hurts me, but they just get an outage
 
Well, depending on the the service, an outage can cause significant issues for users
 
jrh
It gets interesting when the service is critical and downtime is dangerous, for the sake of simplifying things, let's say it's not safety critical
 
9:01 PM
@jrh By your definition, running a cryptominer on your systems is also not a security issue :)
Because, the users don't get hurt
 
jrh
it's an easy example to type out, it could just as easily be a keylogger / data stealer / etc
the important part is "installs this thing on the server that does bad stuff"; kinda just an extension of ACE
 
Well, if someone hacks my bank account and empties it, I call that a security issue. If they do the same by abusing my service maliciously, I call that a security issue too.
It's possible that it isn't an issue for you (perhaps because you're rich), but for some people it will be.
 
jrh
9:46 PM
DDoS / abuse isn't solved by setting a max field length though, a bad person could send 1 trillion 10 kb messages an hour from a zombie cluster and have the same effect
There's sensible cases, if you're just sending a phone number it shouldn't be 10^345 digits long, but when it comes to file-like things, or flexible length things, it gets harder to say what that "upper limit" ought to be. If it's a DDoS concern I can pretty confidently say even 1 MB is probably not going to sink my server, but if it's some kind of thing like "<some HTTP Server> has been known to have memory corruption with requests longer than 1024 bytes" that's something else
 

« first day (4005 days earlier)      last day (46 days later) »