#crlf — Public Fediverse posts

Many people gave feedback, too many sites would not accept "just LF" in http headers, and Richard Hipp changed the proposal:

https://fossil-scm.org/home/ext/stop-requiring-crlf.md

#cr #lf #nl #crlf #SQLite

Call to action by Richard Hipp, best known as creator of #SQLite, to stop using the carriage-return/linefeed (CRLF) sequence alltogether. Linefeed (LF) is never used as "just a linefeed", we better rename the U+000a character to what it is really used for: Newline (NL). Carriage return (CR) should only be used to overwrite on the same line.

He substantiates his point here:
https://fossil-scm.org/home/ext/crlf-harmful.md

#cr #lf #nl #crlf

Call to action by Richard Hipp, best known as creator of #SQLite, to stop using the carriage-return/linefeed (CRLF) sequence alltogether. Linefeed (LF) is never used as "just a linefeed", we better rename the U+000a character to what it is really used for: Newline (NL). Carriage return (CR) should only be used to overwrite on the same line.

He substantiates his point here:
https://fossil-scm.org/home/ext/crlf-harmful.md

#cr #lf #nl #crlf

Found a great #opensource tool to scan sites for a laundry list of vulnerabilities https://github.com/h4r5h1t/webcopilot.

Just used it to scan all my company domains, works great!

The tools integrated into this single app are the same tools "security researchers" use to scan sites for #xss #SQLi #ssrf #crlf #lfi #subdomaintakeover #openredirect, etc. vulnerabilities - into a single CLI tool.

Can also help avoid/confirm those "beg-bounty" situations where a simple misconfiguration is touted as a "critical vulnerability" because someone use a quick scanning tool to determine that sub-domain take-over is possible (very common, not critical, easy to fix), or missing DMARC records are present (which 98% of all Internet sites have issues with, and is very easy to fix) to demand a cash reward so they can "share additional critical vulnerabilities" that aren't a thing - they just want money.

Have fun!

Found a great #opensource tool to scan sites for a laundry list of vulnerabilities https://github.com/h4r5h1t/webcopilot.

Just used it to scan all my company domains, works great!

The tools integrated into this single app are the same tools "security researchers" use to scan sites for #xss #SQLi #ssrf #crlf #lfi #subdomaintakeover #openredirect, etc. vulnerabilities - into a single CLI tool.

Can also help avoid/confirm those "beg-bounty" situations where a simple misconfiguration is touted as a "critical vulnerability" because someone use a quick scanning tool to determine that sub-domain take-over is possible (very common, not critical, easy to fix), or missing DMARC records are present (which 98% of all Internet sites have issues with, and is very easy to fix) to demand a cash reward so they can "share additional critical vulnerabilities" that aren't a thing - they just want money.

Have fun!