News for hackers. Stuff that matters.
Re:SAML Is Insecure by Design by aidenn0 on Thursday August 05, 2021 @05:41PM (#28080302)
I ran into a similar issue trying to write an FTP client implementation from the spec. It turns out that most servers don't support 90% of the spec, and some very important things (such as the output format of LS) are completely unspecified.

I threw out that first implementation and just got the 3 most popular servers and made it work with them.

Random example: I'd like to present directories and files differently so users can chdir to a directory. There was no single method for detecting a symlink to a directory that worked on any 2 of the 3 servers I targeted for support (other than issuing a CHDIR and checking for success, and I wasn't going to issue a CHDIR for every item found when listing a directory for performance reasons; I did have to issue a CHDIR for every symlink on one of the 3 though).

Re:SAML Is Insecure by Design by cmckn on Thursday August 05, 2021 @06:56PM (#28081150)
I was once tasked with writing a crawler for FTP servers and lost about half the hair on my head over this madness. Just when I tuned the robot to work with 10 servers, an 11th would pop up that behaved totally differently. Thankfully, I'm not in that job anymore -- I'll probably never touch FTP again.
Re:SAML Is Insecure by Design by klysm on Friday August 06, 2021 @02:55AM (#28084072)
The arbitrary parameter stuff can be a real pain because there’s some loose conventions around which parameters to use, but sometimes they’re named slightly differently or clash. Terribly annoying to work with.