News for hackers. Stuff that matters.

A comment on Understanding the Worst .NET Vulnerability. Parent comment

Re:Understanding the Worst .NET Vulnerability by immibis on Tuesday October 28, 2025 @11:41AM (#45734316)
We have to accept mangled requests when there are clients out there that send mangled requests, which they will continue to do as long as servers accept them. Postel's law was good for prototyping but created a security nightmare in production.
[ Parent | on HN ]
Re:Understanding the Worst .NET Vulnerability by sfn42 on Tuesday October 28, 2025 @03:42PM (#45737997)
First you create an API, then others start using it. So if you never allow mangled requests your clients will necessarily send proper requests.

If you're maintaining an old api you can publish new versions of endpoints that don't accept mangled requests. If it's important you can give clients a time limit like let's say a few months to update their software to use your updated endpoints before you remove the old ones.

[ Parent | on HN ]