News for hackers. Stuff that matters.

A comment on CRLF is obsolete and should be abolished. Parent comment

Re:CRLF is obsolete and should be abolished by theamk on Sunday October 13, 2024 @08:12PM (#41832905)
[delayed]
[ Parent | on HN ]
Re:CRLF is obsolete and should be abolished by tptacek on Sunday October 13, 2024 @08:24PM (#41832974)
I mean the safest thing would be to send an RST as soon as you see a SYN for 80/tcp.
[ Parent | on HN ]
Re:CRLF is obsolete and should be abolished by theamk on Sunday October 13, 2024 @10:31PM (#41833686)
That would have a severe downside of not letting your customers access your website.

Fast-abort on bare-0ah will still be compatible with all browsers and major http clients, thus providing extra mitigations practically for free.

[ Parent | on HN ]
Re:CRLF is obsolete and should be abolished by RedShift1 on Sunday October 13, 2024 @08:59PM (#41833159)
Wouldn't not replying at all be the safest?
[ Parent | on HN ]