Re:What We Do in the /etc./Shadow – Cryptography with Passwords
by thaumaturgy on Saturday January 07, 2023 @03:55AM
(#34286383)
...that's a Cloudflare security page. Is this a default setting for one of Cloudflare's security options, or did Algolia specifically add this to some edge detection worker or something? I'm curious which party is being ridiculous.
[ Parent
| on HN ]
Re:What We Do in the /etc./Shadow – Cryptography with Passwords
by technion on Saturday January 07, 2023 @04:05AM
(#34286425)
I just hit a website I know has an entirely default config on the free plan as https://website/q=cat /etc/shadow and got the same exact error page.
Re:What We Do in the /etc./Shadow – Cryptography with Passwords
by thaumaturgy on Saturday January 07, 2023 @04:28AM
(#34286569)
Ohhh Cloudflare. I have to wonder how many sites are left that are actually vulnerable to having their shadow file dumped. Even for the sites that have filesystem traversal vulns, how many of those would cough up something publicly accessible from the shadow file?
Re:What We Do in the /etc./Shadow – Cryptography with Passwords
by some_furry on Saturday January 07, 2023 @04:09AM
(#34286450)
So much for CloudFlare's stance on free speech, I'm being censored for comedy!
(The title is a wordplay on What We Do in the Shadows.)
Joke aside, I can understand why, generally, protecting from /etc/shadow disclosures is a good default, but it should be possible to disable this particular protection. If anyone knows how, that'd be good to share.