Fog Creek Software
Discussion Board




Throwing the Baby Along with the Water

There was an IIS bug some time ago, in which IIS could accept paths with ../../../ etc. leading to other documents in the hard-disk. (e.g: http://myhost.com/../../../windows/system.ini)

Microsoft "fixed" this bug by saying that it won't allow a path component which starts with a dot in it URLs. Thus, I cannot serve "http://myhost.com/~shlomi/.vimrc" - I have to rename it.

Now, Microsoft is ruling that Internet Explorer will not accept a username on the URL, because it had some security vulnerabilities in handling it.

These fixes do not remedy the bug or increase the code quality. And they harm the users due to the developers' incompetence. It's like throwing the baby along with the water.

Shlomi Fish
Sunday, February 01, 2004

Microsoft also produces extremely high quality software.

Yes, it has some problems, but all software has some problems.

We must look at the global picture, not at small features.

Row
Sunday, February 01, 2004

Well you could also consider that .xxxx files are also generally hidden on *nix and that they shouldn't be expressly displayed by default.

Simon Lucy
Sunday, February 01, 2004

You should probably serve that file as vimrc.txt, or serve it as a gzipped file with the .vimrc file inside of it.  Your server probably defaults the mime type to text for the .vimrc file, but these solutions make sure it gets served the way you want it (as text) and retains enough of the name to make it identifiable and useful as well as servable from an Apache host if you ever decide to move your server.

Lou
Sunday, February 01, 2004

Simon Lucy: yes, but if I do "less $HOME/.bashrc" I see the contents of .bashrc. Similarly, I expect that if a web server has a file lilke that I can do a "wget http://myhost.com/~shlomif/.bashrc", I'll retrieve the file, whether I may or may not see it in http://myhost.com/~shlomif/.

In IIS however, I cannot do that, and it sucks, because I may want to. I know it causes problems with potentially serving Subversion repositories with such files over IIS.

Lou: why should I bother renaming the file? I'm not looking for workarounds, I'm looking for fixes that fix the bugs and not avoid the problem, and make life worse for the users. Imagine telling a webmaster which has thousands of accounts on his machine, telling all the people there to rename their files. If you have a problem fix it, but don't disable otherwise legitimate functionality.

Shlomi Fish
Sunday, February 01, 2004

Row, the problem is that bugs are a good indicator
of other bugs and poor design and implementation.
Work arounds do work around the bugs you
don't know about.  Given the stream of bugs poor
quality must be the case. They need to fix it in the
code for anyone to feel secure. Work arounds should
make you feel less secure.

son of parnas
Sunday, February 01, 2004

Should read Work arounds do NOT work around bugs...

son of parnas
Sunday, February 01, 2004

"Microsoft "fixed" this bug by saying that it won't allow a path component which starts with a dot in it URLs. "

While I've never had the need, a quick test (IIS 5.1 fully patched) just confirmed that IIS has no such limitations -- it'll happily serve up . prefaced files successfully. Do you have IIS Lockdown with URLScan installed? If so, URLScan is rule driven -- if you think that that rule is unnecessary then change the rules to allow it.

Dennis Forbes
Sunday, February 01, 2004

ln -s /home/shlomif/.vimrc /home/shlomif/vimrc.txt

old fart
Sunday, February 01, 2004

Ah shit. I am going to have to change every single page on all my web sites. I used HREF="../../index.html" type links everywhere in my documentation webs to refer back to parent pages so that my pages work as well on a local folder as they do in a hosted browser.

Tony Chang
Sunday, February 01, 2004

I agree with Shlomi that this is not a fix for the stated bug - it is a horid and poorly thought out hack by the code monkeys at MS.

.. links don't go above the web directory on any web server I've ever used - I guess IIS is some freaky exception. The way to fix it was to fix it (a single line of code I imagine), not to break 20% of the web.

Tony Chang
Sunday, February 01, 2004

It's don't throw out the baby with the bath water.

Jorel on Software
Sunday, February 01, 2004

"Microsoft also produces extremely high quality software."

How do you define quality Row?

Tony Chang
Sunday, February 01, 2004

"Given the stream of bugs poor quality must be the case. They need to fix it in the code for anyone to feel secure. Work arounds should make you feel less secure."

son of parnas, this is a fantastically lucid statement. Couldn't have said it better myself.

Tony Chang
Sunday, February 01, 2004

"Microsoft also produces extremely high quality software."

Great news. Must have missed those titles. Tell me what they are and I'll switch to using them. :)

sgf
Sunday, February 01, 2004

Shlomi, relax. You are not going to have any problem with user directories or dot-files.

IE is removing support for RFC-1738 "user:pw@" syntax, which is a monumentally stupid idea anyway. The people using this for legitimate purposes ought to know better, and are probably NOT using IE or IIS. Nothing is going to break.

http://support.microsoft.com/?id=834489

Furthermore, the use of ".." in path names through ASP code may be disabled on IIS 5 and earlier, and is disabled by default in IIS 6. You can still turn it back on, and it only affects ASP code anyway.

http://support.microsoft.com/?id=332117

Any announcement that "Microsoft is about to make all of our web sites stop functioning" should generally be rephrased as "Microsoft is going to make everyone stop using their web browser" which is such an incredibly absurd concept that you will intuitively give it precisely the attention and credit it deserves.

Caliban Tiresias Darklock
Sunday, February 01, 2004

Damn, plain-text authentication is perfectly acceptable for many situations, e.g. forums.  I have appropriate bookmarks set to username:password@forum.whatever.com to keep things simple for me.  The idea of having to periodically type it in again is annoying.

i like i
Sunday, February 01, 2004

I'm rather embarassed to post, when I sense that I missed a joke.  But...  I really hope, Row, you were being ironic and we just missed the joke, because that response is ridiculous.

(Just on the off chance that you weren't being ironic... exactly which big picture could possibly justify such a shameful workaround?)

Shlomi, if you didn't have reason already, that sounds like reason enough to dump IIS.  There are plenty of much better web servers, even on Windows.

veal
Sunday, February 01, 2004

"Damn, plain-text authentication is perfectly acceptable for many situations, e.g. forums.  I have appropriate bookmarks set to username:password@forum.whatever.com to keep things simple for me.  The idea of having to periodically type it in again is annoying."

Considering Windows will remember these passwords for you, why don't you just let the browser do the work instead of contriving the URL? It's not like it's that big a deal to hit enter when prompted with the already-filled-in user and password information... ;)

Brad Wilson (dotnetguy.techieswithcats.com)
Sunday, February 01, 2004

Because then the browser will periodically transmit my password information to Microsoft, allowing Bill Gates to surf my favorite porn sites while spoofing as me.

Zahid
Sunday, February 01, 2004

Zahid: that's it, he's crossed the line!  DOWN WITH GATES!!!

H. Lally Singh
Sunday, February 01, 2004

Brad, I said 'periodically' because I periodically clean my cache, or visit places so rarely as for it to be forgotten anyway.  And now I'm back to periodically going and looking at my list of insecure passwords..

The proper solution to people using @ to hide urls is to make the hyperlink preview emphaise it; presumably the bit before the @ can easily be another colour or slanted (italic, whatever, that was another thread) or something.

i like i
Monday, February 02, 2004

Mozilla shows the full link.

Opera handles it best.  They pop up a dialog  "You are logging into 'www.goatse.cx' with the username 'www.microsoft.com' and the password ''.  Is this correct?"

Stuffing password in teh URL is insecure, but what's wrong with putting the username in the URL?

Richard P
Monday, February 02, 2004

*  Recent Topics

*  Fog Creek Home