←back to thread

Writing "/etc/hosts" breaks the Substack editor

(scalewithlee.substack.com)
601 points scalewithlee | 1 comments | 25 Apr 25 13:48 UTC | HN request time: 0s | source
Show context
Y_Y ◴[25 Apr 25 14:13 UTC] No.43793778[source]▶
Does it block `/etc//hosts` or `/etc/./hosts`? This is a ridiculous kind of whack-a-mole that's doomed to failure. The people who wrote these should realize that hackers are smarter and more determined than they are and you should only rely on proven security, like not executing untrusted input.
replies(6): >>43793862 #>>43793868 #>>43793954 #>>43794072 #>>43794473 #>>43802345 #
eli ◴[25 Apr 25 14:28 UTC] No.43793954[source]▶
Is a security solution worthless if it can't stop a dedicated attacker? A lot of WAF rules are blocking probes from off-the-shelf vulnerability scanners.
replies(4): >>43794116 #>>43794355 #>>43795518 #>>43796747 #
1. kevincox ◴[25 Apr 25 18:05 UTC] No.43796747[source]▶
IMHO the primary value for WAFs is for quickly blocking known vulnerabilities with specific rules to mitigate vulnerabilities while they are being properly patched. Ideally the WAF knows what software is behind it (example WordPress, Java app, ...) and can apply filters that may be relevant.

Anything else is just a fuzzy bug injector that will only stop the simplest scanners and script kiddies if you are lucky.