News for hackers. Stuff that matters.
Re:The “Chad” bug by Animats on Thursday December 31, 2015 @12:20AM (#10816317)
"Some people, when confronted with a problem, think "I know, I'll use regular expressions." Now they have two problems."

Yes. My favorite was a Coyote Point load balancer bug. If the last character of the HTTP options is "m", the connection will not get past the load balancer.[1] I found this because a web crawler was having trouble with one site. Fortunately, I knew someone with their own Coyote Point load balancer, and was able to establish that the connection went into the load balancer and never came out.

The load balancer has a big file of rules which contain regular expressions. Somewhere, I think there's a "\m" where they meant "\n". Reporting this to the vendor, along with a Python program to demonstrate the problem, was of course futile; they suggested "upgrading the software". I demonstrated that the bug existed on their own load balancer on their own site. I finally added a completely useless field to the HTTP header so that the last character was not "m".

[1] https://www.webmasterworld.com/webmaster_hardware/3312997.ht...

Re:The “Chad” bug by chris_wot on Thursday December 31, 2015 @03:43AM (#10816845)
Tell them they've violated their contract and you are migrating from them ASAP.
Re:The “Chad” bug by rdancer on Thursday December 31, 2015 @06:53AM (#10817257)
That doesn't work when it's software on your client's computer. Remember when all the web devs revolted and ditched IE6 back in 2001, because MS was just taking the Mickey? Yeah, me neither.
Re:The “Chad” bug by Animats on Thursday December 31, 2015 @02:54PM (#10819311)
Right. I didn't have a Coyote Point unit. Many other sites did, and they all appeared to be down to my web crawler until I figured out the problem.

(Current web crawler problem: sites that won't let you read their robots.txt file if they don't like your user-agent string.)

Re:The “Chad” bug by ThisIs_MyName on Thursday December 31, 2015 @09:40PM (#10820893)
>sites that won't let you read their robots.txt file if they don't like your user-agent string

That's hilarious. So do you use borrow a browser's user-agent or do you ignore the robots.txt?

Re:The “Chad” bug by chris_wot on Friday January 01, 2016 @11:38AM (#10822285)
I'd assume they want you to crawl their website. When they say you are ignoring their robots.txt file, tell them you actively prevented you from seeing it and you could only assume that mean they WANTED to be crawled.

That would get them to fix the issue pretty quickly :-)

Re:The “Chad” bug by rdancer on Friday January 01, 2016 @06:30PM (#10824086)
No `robots.txt` indeed means weapons free, but crawler gleans useful info from it, e.g. which areas of the site are dynamically generated.

More likely the site is trying to serve custom versions of `robots.txt` to different bots, with good intentions, and the code is buggy.

Re:The “Chad” bug by Animats on Friday January 08, 2016 @04:08AM (#10863757)
The strict interpretation is that if "robots.txt" returns 403 Forbidden, it's interpreted as "deny all". That's what the Python library does. We list those sites as "Blocked".
Re:The “Chad” bug by beachstartup on Thursday December 31, 2015 @08:26AM (#10817467)
> upgrading the software

they told you this because they probably fixed the bug in a newer release. what response were you expecting, exactly? to dive in with a hex editor?

for what it's worth we run into the same issues with our network devices, it's a pain in the ass, and that's why we're shifting to SDN.

Re:The “Chad” bug by mgkimsal on Thursday December 31, 2015 @10:06AM (#10817812)
Proper response would be something like

"You've obviously put a lot of time in to this. Thanks. We actually had found that bug 4 months ago in R1892, and it's patch in R1899. Please upgrade, or let us know that you're, in fact, using R1899 and still experiencing the issue (it's issue #847 on our bug tracker at foobugz.xyz)"

Or maybe...

"You've obviously put a lot of time in to this. Thanks. We actually had found that bug 4 months ago in R1892, and we're planning on a maintenance release next quarter. If you'd like to test out our upgrade version, please contact [email protected] and let them know you want to be in the testing group - he'll get you the appropriate documentation and code. Thanks for helping fix and test these issues!"

Re:The “Chad” bug by beachstartup on Thursday December 31, 2015 @10:36AM (#10817963)
right, so in other words, a software upgrade.
Re:The “Chad” bug by mgkimsal on Thursday December 31, 2015 @10:54AM (#10818068)
In other words, acknowledge that someone did some work, and actually ask if they're using the latest version, and vitally - acknowledge that they read the correspondence and that upgrading will address the issue.

"Update your software" is often a BS answer that can introduce many other issues or breakages in production systems. Without a clean "downgrade" path (which many companies don't provide) you run a risk of introducing more problems.

Re:The “Chad” bug by beachstartup on Thursday December 31, 2015 @02:28PM (#10819193)
i think you're misunderstanding me. i'm agreeing with you - network device vendors are universally terrible across the board, and that's why nobody should count on them unless they absolutely have to.

in other words, what i'm saying is to expect that kind of response is naive, and that you should seek alternatives.