CRLF is obsolete and should be abolished

Re:CRLF is obsolete and should be abolished by LegionMammal978 on Sunday October 13, 2024 @08:03PM (#41832865)

My apologies, I was using a client which kept the connection alive between the 0D0A and 0A requests, which has an effect on www.pinterest.com. Rerunning the test with separate connections for 0D0A and 0A requests, www.pinterest.com and phys.org are no longer affected (I've removed the two from the list), but all other URLs are still affected.

[ Parent | on HN ]

Re:CRLF is obsolete and should be abolished by tptacek on Sunday October 13, 2024 @08:12PM (#41832909)

I picked one at random --- hhs.gov --- and it too appears to work?

For what it's worth: I'm testing by piping the bytes for a bare-newline HTTP request directly into netcat.

[ Parent | on HN ]

Re:CRLF is obsolete and should be abolished by LegionMammal978 on Sunday October 13, 2024 @09:39PM (#41833406)

Make sure you're contacting hhs.gov and not www.hhs.gov, the www. subdomain reacts differently.

  $ printf 'GET / HTTP/1.1\r\nHost: hhs.gov\r\n\r\n' | nc hhs.gov 80
  HTTP/1.1 302 Found
  Date: Mon, 14 Oct 2024 01:38:29 GMT
  Server: Apache
  Location: http://www.hhs.gov/web/508//
  Content-Length: 212
  Content-Type: text/html; charset=iso-8859-1
  
  <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
  <html><head>
  <title>302 Found</title>
  </head><body>
  <h1>Found</h1>
  <p>The document has moved <a href="http://www.hhs.gov/web/508//">here</a>.</p>
  </body></html>
  ^C
  $ printf 'GET / HTTP/1.1\nHost: hhs.gov\n\n' | nc hhs.gov 80
  HTTP/1.1 400 Bad Request
  Date: Mon, 14 Oct 2024 01:38:40 GMT
  Server: Apache
  Content-Length: 226
  Connection: close
  Content-Type: text/html; charset=iso-8859-1
  
  <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
  <html><head>
  <title>400 Bad Request</title>
  </head><body>
  <h1>Bad Request</h1>
  <p>Your browser sent a request that this server could not understand.<br />
  </p>
  </body></html>

[ Parent | on HN ]

Re:CRLF is obsolete and should be abolished by tptacek on Sunday October 13, 2024 @10:18PM (#41833624)

Ahh, that was it, thanks.

[ Parent | on HN ]

Re:CRLF is obsolete and should be abolished by shadowgovt on Monday October 14, 2024 @09:56AM (#41837585)

And this whole exercise is an example of why this is a non-starter proposal (at least the "change existing implementations" part).

How much do we expect the domain owners to invest in changing an implementation that already works? Hint: it's a number smaller than epsilon.

Google might, but their volume is so high they care about the cost of individual bytes on the wire.

[ Parent | on HN ]

Re:CRLF is obsolete and should be abolished by tptacek on Monday October 14, 2024 @11:57AM (#41838741)

This exercise was about demonstrating that our security can't rely on making sure there's a carriage return in HTTP line termination, because there is no such norm. See the root of the thread, where I asked the question.

[ Parent | on HN ]

Re:CRLF is obsolete and should be abolished by shadowgovt on Monday October 14, 2024 @12:38PM (#41839176)

Oh, I agree it's about that too, but my point is you've already volunteered more time and resources investigating the situation than most companies would be willing to spend.

[ Parent | on HN ]