The DMZ

Anonymous

2:15 AM

@DavidFreitag psst are you there?

Scott Pack

ppssstttt..no

Rоry McCune

7:50 AM

Morning

TildalWave

8:27 AM

@RоryMcCune morning Rory, that's cute :)

Rоry McCune

@TildalWave yeah there's a guy on twitter who draws them

TildalWave

I'm not sure I yet dare interpret it, I'm still gathering my own pieces ...

TildalWave

8:46 AM

from space.se meta, but ...

0

A: Topic of The Week: Heavy lift launch vehicle

Avionics. You don't even have an avionics tag yet!

I can't even start describing how I feel about that single, simple sentence

Rory Alsop

Hhahahahaha.

Morning Rory - nice dinosaur

ManishEarth

9:46 AM

What do you guys think of an HTTP header (under Content security policy) that disables the use of the web console unless overridden? To prevent self-xss.

Terry Chia

@ManishEarth Annoying solution to a non-existent problem.

3

ManishEarth

@TerryChia Nuh uh, not non existant

Take facebook for example. They have problems with people being stupid and pasting stuff into the console

incompleteness.me/blog/2011/12/14/combating-self-xss/

FEichinger

User error is user error. Let them learn the hard way instead of ingraining measures where they don't belong.

Terry Chia

@FEichinger +1

That's your main issue. People being stupid.

FEichinger

I like the idea of removing HTML elements from JS scope, though.

But that would need JS to be a better environment for it to work properly.

Otherwise it gets incredibly messy to work through.

ManishEarth

10:25 AM

@FEichinger When you expose something dangerous to users and don't do anything to prevent it, I wouldn't call that a user error. It's like giving a gun to a baby and then calling it a user error if it shoots itself.

FEichinger

10:42 AM

It's neither the site nor the protocol that exposes it, though. It's the browser itself.

Terry Chia

@ManishEarth Btw, any reason why it's a CSP instead of just a toggle in the browser?

ManishEarth

@FEichinger Yes, and this is an improvement in the browser

FEichinger

And, to be fair, it's not "exposed to the user". The console is intended for developers, not the random idiot on Facebook. So, hide the whole console and everything behind an "I am a developer" setting in the browser, instead.

ManishEarth

@TerryChia Some people want the console to be hard to get to by default, some don't. CSP is a viable alternative.

A site that wants it can just say "please make the console hard to get to"

Facebook and Netflix have currently exploited a browser API bug in Chrome to completely disable the console (FB lets you turn it off though)

Terry Chia

@ManishEarth That makes zero sense. Why will a site care about whether or not the user has access to the developer console?

TildalWave

10:44 AM

@ManishEarth awful idea

Terry Chia

Also, if I can trick a user into typing random crap into a console, why can't I trick the same idiot into setting the preference to allow console access?

FEichinger

@TerryChia This. At the end of the day, we'll have to go back to "dev browsers" and "consumer browsers" anyway, to prevent that stuff.

ManishEarth

@TerryChia Facebook, for example, is plagued by posts that provide some code to copy paste to the console, saying "this will make your facebook do XYZ"

TildalWave

how would you test and distribute your code then, if not coercing others to give it a go?

ManishEarth

@TildalWave It's not irrevocably disableabe

@TerryChia Because with this CSP stuff the browser can show a very specific warning when you change this pref.

Terry Chia

10:46 AM

@ManishEarth So I'll add a line telling them to activate console access first.

TildalWave

@ManishEarth well, I can see who'd be the first to implement it and render all ad blockers pointless

ManishEarth

@TildalWave as in?

Terry Chia

@ManishEarth Oh, stupid users read warnings now?

FEichinger

@TildalWave Good point. Ad blockers would require switching the setting off again, so it's moot.

TildalWave

@ManishEarth ^

FEichinger

10:47 AM

Once they have set up their ad blocker, they have the very same access to putting crap in the console.

ManishEarth

@FEichinger wait, why?

FEichinger

@ManishEarth Because ad blockers are also just JS run on the site.

ManishEarth

@TerryChia So Facebook actually tried this out. They gave users a way to disable the console-destroying (when you open the console it shows a big warning and a link, and the console REPL doesn't work)

@FEichinger not via the console

FEichinger

So you want to disable it only for the browser's own console, not for userscripts and plugins?

So it's purely a browser setting then.

Why put that in the protocol?

Not to mention that I could just replicate the console in a plugin and have the original effect again.

Terry Chia

23 secs ago, by FEichinger

Why put that in the protocol?

ManishEarth

10:49 AM

They only did it in Chrome, where the API vulnerability giving the console disable powaz was there. But it did end up reducing the number of self-xss cases directly

Terry Chia

EXACTLY!

Hide the console behind a dev-only switch if you want, why does it concern CSP AT ALL?

ManishEarth

@FEichinger because then they can show a very specific warning. If you jsut disable the console by default you have to give a generic warning

FEichinger

@ManishEarth So can the browser itself by implementing such a toggle in its settings.

ManishEarth

@FEichinger Uh, I don't think you understand the proposal

@FEichinger the proposal is to allow websites to ask the browser to disable the console

TildalWave

@ManishEarth so would simply removing the user from the equation :)

FEichinger

10:51 AM

And, again, why would the site need to request that?

ManishEarth

@TerryChia Uh, CSP already does this, partly. Facebook, for example, doesn't allow external scripts. This is done via CSP. YOu cannot inject jQuery other than by direct copy-paste.

@FEichinger Because some sites like Facebook (and apparently Netflix) have issues with people being tricked into pasting code into the console

FEichinger

@ManishEarth Because consumers are using a tool that isn't intended for consumers.

Terry Chia

@ManishEarth And why can't this be a global setting for all sites?

ManishEarth

@TerryChia It can. There is opposition for that. I wouldn't mind it much

FEichinger

That is irrelevant for individual sites, has no relevance for the protocol and causes more harm than good.

ManishEarth

10:52 AM

@TerryChia but again, if it is on a per-request basis, then the warning shown can be specific instead of generic.

FEichinger

@ManishEarth Oh, so you want the site to give a specific warning?

ManishEarth

@FEichinger No, the browser.

But if a site suspects that people will be self-xss-ed on it

Terry Chia

@ManishEarth I don't get that argument. At all.

FEichinger

How would the warning become specific just because an individual site requests the setting?

Terry Chia

^

ManishEarth

10:53 AM

gah let me type

FEichinger

Type faster, then. :P

TildalWave

I wouldn't be against being able to display a custom warning, but only if it doesn't override some generic warning from the browser vendor

so "Don't be stupid!" should stay, whatever the site itself wants to add to that

FEichinger

"Enabling this setting allows you to enter code into the console. Be warned: The console is intended for developers only, so please mind what you enter and make sure you understand what it really does." <-- No need for the site to request that, just put it in the browser and be done with it.

ManishEarth

@FEichinger Alright, a stupid user would just dismiss that.

FEichinger

Give me a specific example that the user wouldn't just dismiss.

ManishEarth

10:55 AM

But for a site like FB where there is a specific problem (and self-xss is the same specific problem for all sites that have it, there is not much variation)

FEichinger

@ManishEarth The "specific problem" has nothing to do with your proposal, though.

Terry Chia

@ManishEarth A stupid user will just dismiss anything. People click through invalid cert warnings. What makes you think this will be any different?

ManishEarth

@FEichinger not my proposal

FEichinger

"the proposal you're talking about"

ManishEarth

@TerryChia People are more likely to click through a "there seems to be something wrong" warning than an "The site security blah blah is invalid"

as an example

TildalWave

10:56 AM

@ManishEarth But we need stupid users! They're the best thing that happened to Internet!!

ManishEarth

"Be warned: Do not copy paste code into this unless you are ABSOLUTELY SURE you know what it does"

Terry Chia

@ManishEarth Proof?

ManishEarth

That is better than "Be warned: The console is intended for developers only, so please mind what you enter and make sure you understand what it really does."

FEichinger

@TildalWave To be quite honest, without stupid users we'd all be out of our jobs.

ManishEarth

But the former does not make sense as a warning to be shown on sites with the problem

@TerryChia Gah, don't have any :/

Terry Chia

10:57 AM

@ManishEarth Exactly!

FEichinger

@ManishEarth I'm assuming you meant to say "without the problem" there.

Terry Chia

You keep saying "it's more likely". You can't back that up.

ManishEarth

Here's an example of self-xss, btw: blog.commtouch.com/cafe/web-security/…

FEichinger

But I disagree. People should never paste stuff into the console without knowing what it does.

TildalWave

@FEichinger exactly, and all this "making users less stupid" is only worthwhile until you bloody annoy everyone else that isn't with it

ManishEarth

10:58 AM

@FEichinger yes

@FEichinger agreed, but the console has more problems than just copy paste

Terry Chia

I get why devs like to tack on fancy things to the protocol to fix what they perceive to be a problem, but it won't fix anything.

FEichinger

It's irrelevant whether or not "it's a problem on the site". Don't put stuff in a dev tool if you have no idea what you're doing, period.

ManishEarth

@TerryChia Alright, so what are your comments on this post?

@TerryChia I actually agree to a degree. But I think it can reduce the issue

Terry Chia

@ManishEarth Browser setting only if you really want to implement it. Don't tack on pointless things to the protocol.

ManishEarth

Again, Facebook provided a way to turn it off. People were not convinced that they should turn it off. And the warning was specific

FEichinger

11:00 AM

I'm not saying self-XSS isn't an issue. Stupid users messing up because they have no idea what they're doing causes problems for them, sure. But it's not relevant to the protocol. It's only relevant to the tools the users do this with.

TildalWave

So we're now back to user modes ... build it into browsers, and that's it. Default: user mode. Switch: dev mode (with ample warnings and hard to find for your average Joe)

Terry Chia

Or fuck it, fork off firefox into a "dev-only version".

FEichinger

And these tools are provided solely by the browser.

15 mins ago, by FEichinger

@TerryChia This. At the end of the day, we'll have to go back to "dev browsers" and "consumer browsers" anyway, to prevent that stuff.

ManishEarth

@FEichinger So why does CSP already include a "don't allow external scripts to run on this page" directive?

TildalWave

so the problem with dev tools is that they're too easy to find for those that aren't

disable F12 and that's it

FEichinger

11:02 AM

@ManishEarth Because people like to bastardize protocols and standards into stuff it shouldn't do.

ManishEarth

So it shouldn't do that either. Okay.

FEichinger

A protocol should define the transfer and the content. Not the behaviour at the end point.

3

Terry Chia

Seriously, it boils down to this. There is no proof that the solution suggested will improve the situation of stupid people being stupid. Don't piss off the rest of your users who know better.

ManishEarth

@FEichinger Care to leave a comment on the bugzilla bug? THis makes sense

TildalWave

@TerryChia ... or else! :)))

ManishEarth

11:04 AM

@TerryChia Uh, there is proof.

4 mins ago, by ManishEarth

Again, Facebook provided a way to turn it off. People were not convinced that they should turn it off. And the warning was specific

Of course, I turned it off for myself. But they did measure a drop in the number of XSS cases.

FEichinger

@ManishEarth Which one?

ManishEarth

Uh, digs

THere's a whole list of them, but this is a specific bug

Terry Chia

@ManishEarth Because people cannot be bothered to turn if off. You have no proof that a more specific warning will improve things over there just being a dev mode switch.

ManishEarth

bugzilla.mozilla.org/show_bug.cgi?id=710273

@TerryChia Oh, I don't have proof for that, yes

FEichinger

@ManishEarth Oh God, that reminds me that I haven't had a Bugzilla account in ages ...

Terry Chia

11:07 AM

But hey, I don't use FF on a daily basis and I can always turn it off if I need to. I'm just saying it doesn't make sense to involve the website at all.

@FEichinger Thank god the projects I work with just use the GH issue tracker.

ManishEarth

@TerryChia Mozilla likes to use bugzilla for some and GitHub for others. Also, almost every version control system is there

O.o

Terry Chia

@ManishEarth And that's just goddamn confusing. :P

ManishEarth

@TerryChia A single project is a single issue tracker/VCS though

THen again, iirc core gecko development is done on a github mirror of mozilla-central (the repo that holds Firefox / Core / Toolkit / Fennec / etc)

Terry Chia

@ManishEarth I'd just hate to maintain multiple accounts if I were contributing to multiple projects.

ManishEarth

@TerryChia True

Currently I'm working on Firefox and Servo (and un peu de Bugzilla). I need GitHub for servo. Fortunately, I do use github so that's not an issue

FEichinger

11:14 AM

And now I remember why I don't have a Bugzilla account anymore (well, none I have access to) ... I am so much more inclined to start ranting about stupid decisions ...

ManishEarth

thanks, @FEichinger

FEichinger

I can see the use of CSP to restrict attacks from third-party sources in the transfer, or for users to restrict what they wish to transmit to and from the server. But this is an attack purely between the user and the server - and executed almost solely on the user's end.

TildalWave

@ManishEarth I was asked a question about physics that's pretty basic, but I found it quite difficult to explain in as simple terms as possible, you have 2 minutes?

ManishEarth

yeah

TildalWave

OK, it goes something like this: if you have a satellite in orbit, and its orbital velocity causes the centrifugal force to be exactly opposite to centripetal force of gravity, why doesn't it simply fly in a straight line away from Earth if it's velocity vector is perpendicular to the focus?

ManishEarth

11:23 AM

@TildalWave Centrifugal force is not a force in the same sense as centripetal force

Centripital force is the real force required (in this case, gravity, in other cases, string tension) to make it rotate

Centrifugal force is the pseudo force, as viewed from the rotating frame, that is felt by the rotating people

They don't "balance each other out"

TildalWave

@ManishEarth I know, but I need "a 5 year old" explanation

ManishEarth

They're effectively the same thing in two frames

@TildalWave just explain that the centrifugal force doesn't exist and is felt by the people on the rotating planet

(and on the rotating planet there is no visible rotation so no need for a centripetal force so gravity balances the centrifugal)

TildalWave

hmmm OK that might work

will have to test it :)

Terry Chia

@ManishEarth @TildalWave "Nurdz"

TildalWave

@TerryChia not really, there's absolutely nothing nerdy there

ManishEarth

11:27 AM

@FEichinger @TerryChia btw, if you look at the comments on that post it becomes a bit more evident why they aren't making it a by default thing

FEichinger

@ManishEarth It boils down to "We think only sites frequently affected by self-xss will use this." which is a nonsense argument.

ManishEarth

@FEichinger hm

Terry Chia

@FEichinger Really because there is literally zero reason for a normal user to even open the console.

FEichinger

You can bet your ass people will start making this a default setting to "prevent it before it happens".

ManishEarth

True

FEichinger

11:32 AM

And, more importantly, it's still not a site issue. It's a user issue.

ManishEarth

I know

but users who cannot be educated .....

TildalWave

@ManishEarth I think I'll try explaining what's radial motion and why it doesn't cancel out gravitational acceleration any more, if it went in a straight line instead ... hope that's not too difficult :)

FEichinger

Users who cannot be educated need the tools taken away.

ManishEarth

I've seen too much of this passing the buck of security issues though :/

FEichinger

But that's not a decision of the site, it's a decision of whoever holds the tools.

And that's the browser.

ManishEarth

11:33 AM

And I find it pointless -- fix it somewhere first, and see what happens

There is currently a bug I reported for Chromium and some Google services. Google says it's a browser bug. Chromium says it's a website bug. In the end, the bug hasn't been fixed.

Terry Chia

@ManishEarth That's no excuse to add questionable "fixes".

ManishEarth

@TerryChia Well, at least one can try this out and see what happens. Want proof? You'll get it right there.

FEichinger

"try this out and see what happens" is the cornerstone of how we bastardized HTTP into what it has become today.

ManishEarth

Hm

anyway, got to go

FEichinger

We turned a one-off fetch and receive into a pseudo-asynchronous pile of metadata. I really don't like that.

Terry Chia

12:02 PM

THIS IS FUNNY! slate.com/articles/technology/low_concept/2014/03/…

Mike Pennington

1:47 PM

Security brethren: is this question interesting or on-topic here?

0

Q: Is it a bad idea to use port forwarding as a long-term access strategy?

We are deploying multiple copies of the same system (some devices behind a gateway with NAT), and we need to have continued access for some of those devices. Right now our strategy is to have a set of non-standard ports that are configured to route to specific IP addresses behind the NAT. This se...

Rory Alsop

7:02 PM

@mike - I think that would work here

Lucas Kauffman

10:13 PM

evening

I'm still having a tuesday feeling

Iszi

@LucasKauffman You're working this weekend, too?

Transcript for