Changes between Version 5 and Version 6 of Ticket #1005, comment 23


Ignore:
Timestamp:
06/28/16 21:50:09 (8 years ago)
Author:
simonhf@…

Legend:

Unmodified
Added
Removed
Modified

  • Ticket #1005, comment 23

    v5 v6  
    77The purpose of the RFCs is to consider all such situations even with garbage input (see [1]), and to show what the correct response should be. IMO a mature service like Amazon ELB or a mature daemon like nginx should take something like Fuzz Testing in their stride and not give 'garbage out' as you suggest. Rather they should behave in a predictable manner according to the RFCs. Do you think otherwise?
    88
     9As it is, the Amazon ELB to nginx timeout incompatibility could be used in theory as an attack vector. An attacker could send many intentionally incorrect POSTs knowing that nginx will timeout and cause the Amazon ELB to block for 60 seconds, thus over-whelming the ELB upstream connections and blocking the service for others. So this is the type of situation that would be uncovered via Fuzz Testing. It's just a coincidence that I discovered it in regular production traffic.
     10
    911[1] https://en.wikipedia.org/wiki/Fuzz_testing