X-Clacks-Overhead

(hleb.dev)

122 points by hleb_dev2 days ago

18 comments

  • madeofpalk1 day ago
    FYI - no need to prefix your custom header with X- !<p>&gt; <i>Historically, designers and implementers of application protocols have often distinguished between standardized and unstandardized parameters by prefixing the names of unstandardized parameters with the string &quot;X-&quot; or similar constructs. In practice, that convention causes more problems than it solves. Therefore, this document deprecates the convention for newly defined parameters with textual (as opposed to numerical) names in application protocols.</i><p><a href="https:&#x2F;&#x2F;datatracker.ietf.org&#x2F;doc&#x2F;html&#x2F;rfc6648" rel="nofollow">https:&#x2F;&#x2F;datatracker.ietf.org&#x2F;doc&#x2F;html&#x2F;rfc6648</a>
    • nubg1 day ago
      What supposed problems does it cause in practice?
      • Bratmon1 day ago
        If a nonstandard X header becomes widely used and then adopted as the standard, there is a surprisingly lengthy and difficult transition period to the new name.<p>Both clients and servers have to support both the X name and the regular name for decades, and servers have to deal with questions like &quot;What if both are present but different?&quot;
        • lucideer1 day ago
          If both are present but different the unprefixed version should be favoured. That seems uncontroversial &amp; not complex to implement.<p>Sending two headers seems fine in most cases.<p>These are certainly downsides but hardly dealbreakers. On the other side, not prefixing has its own pros &amp; cons, which seem more difficult to work around:<p>1. The obvious clash issue. If two pieces of software implement entirely different X-Value: headers, the standardisation effort clarifies the signal in the form of an unprefixed version. If both competing software applications start out unprefixed, the signal will always be ambiguous.<p>2. Implementation changes. If any lessons are learnt during initial use of a prefixed header, these can be applied by standardising on a slightly improved unprefixed version.
          • garblegarble1 day ago
            &gt; If both are present but different the unprefixed version should be favoured. That seems uncontroversial &amp; not complex to implement.<p>oops, you just enabled smuggling where there&#x27;s a mismatch between what a proxy&#x2F;firewall&#x2F;etc supports and what an internal service supports.<p><pre><code> X-Do-Evil: true Do-Evil: false</code></pre>
            • lucideer1 day ago
              Smuggling is a general concern whenever two headers have functionality that interact - it&#x27;s not specific to prefix masking &amp; given how implementation-based it is, it&#x27;s not even likely to occur to any arbitrary prefix mask.<p>That&#x27;s not a reason not to consider it a threat vector when implementing, but no more than when implementing any header (that interacts with another)
              • MrJohz1 day ago
                But isn&#x27;t the problem with X- headers that if they ever get standardised, they necessarily create this smuggling issue? Whereas if you start with an unprefixed header and standardise it under the same name, you avoid this issue.<p>You could also solve the problem by standardising the header with the X- prefix, but this is more confusing to users and violates the idea that X- always means &quot;not standardised&quot;, at which point the prefix is useless anyway.
              • Bratmon1 day ago
                &gt; That&#x27;s not a reason not to consider it a threat vector when implementing, but no more than when implementing any header (that interacts with another)<p>But the header wouldn&#x27;t have interacted with another header if we hadn&#x27;t decided to do this X-prefix nonsense!
                • lucideer1 day ago
                  It might not have but it&#x27;s a lot more likely that it would.
  • wowczarek1 day ago
    I have been guilty of adding a custom header to all of my emails: &quot;Yo-Momma: Fat&quot;. For years. In a professional setting. Nobody noticed.
    • akoboldfrying1 day ago
      Discovering this at work one day would have brought a smile to my face!<p>Perhaps there&#x27;s a whole new joke format here.<p>Long-Face-Reason: horse
  • There&#x27;s a list of sites broadcasting X-Clacks-Overhead: <a href="https:&#x2F;&#x2F;xclacksoverhead.org&#x2F;listing&#x2F;the-signal" rel="nofollow">https:&#x2F;&#x2F;xclacksoverhead.org&#x2F;listing&#x2F;the-signal</a>
  • nindalf1 day ago
    I miss Terry Pratchett. Just a good guy, writing joyful books. None of that &quot;gritty realism&quot; here. There&#x27;s only about 40 books by him, so I read 2 a year. By the time I get to 40, I figure I would have forgotten the first few and I can start again.<p>My blog has had this header since the day he died.
  • gclawes1 day ago
    There are Chrome and Firefox extensions to indicate the presence of the header.<p><a href="https:&#x2F;&#x2F;chromewebstore.google.com&#x2F;detail&#x2F;clacks-overhead-gnu-terry&#x2F;lnndfmobdoobjfcalkmfojmanbeoegab?hl=en&amp;pli=1" rel="nofollow">https:&#x2F;&#x2F;chromewebstore.google.com&#x2F;detail&#x2F;clacks-overhead-gnu...</a><p><a href="https:&#x2F;&#x2F;addons.mozilla.org&#x2F;en-US&#x2F;firefox&#x2F;addon&#x2F;x-clacks-overhead&#x2F;" rel="nofollow">https:&#x2F;&#x2F;addons.mozilla.org&#x2F;en-US&#x2F;firefox&#x2F;addon&#x2F;x-clacks-over...</a>
  • stackoverflow.com and all stack exchange sites also include X-Clacks-Overhead in the response thanks to yours truly
  • regularfry1 day ago
    I think strictly speaking any node on the network which receives the header should forward it on. So if your browser ever sees it, it should use it for all HTTP requests from that point. And if a server ever receives it, it should pass it to all clients.
  • hoppp1 day ago
    I am all for goofy headers. Its especially fun when randomly stumbling into it.
    • kotaKat1 day ago
      I was poking at the AT&amp;T U-Verse outage reporting endpoint and caught &quot;X-Employment&quot;.<p>Sadly no additional challenge other than &quot;If you are reading this, please consider a technology job at AT&amp;T www.att.jobs&quot;.
      • NewJazz1 day ago
        Eww why would they buy a .jobs domain what a joke.
  • achillean1 day ago
    Honeypots are advertising that header as well nowadays:<p><a href="https:&#x2F;&#x2F;www.shodan.io&#x2F;search&#x2F;report?query=x-clacks-overhead" rel="nofollow">https:&#x2F;&#x2F;www.shodan.io&#x2F;search&#x2F;report?query=x-clacks-overhead</a><p>Most of the non-honeypot results are for the Gargoyle Router Management interface exposed by Korea Telecom:<p><a href="https:&#x2F;&#x2F;www.shodan.io&#x2F;search&#x2F;report?query=x-clacks-overhead+-tag%3Ahoneypot" rel="nofollow">https:&#x2F;&#x2F;www.shodan.io&#x2F;search&#x2F;report?query=x-clacks-overhead+...</a><p>The results have increased significantly over time:<p><a href="https:&#x2F;&#x2F;trends.shodan.io&#x2F;search?query=x-clacks-overhead" rel="nofollow">https:&#x2F;&#x2F;trends.shodan.io&#x2F;search?query=x-clacks-overhead</a>
  • rcarmo1 day ago
    I had that header set back when I ran my blog on my own HTTP server. Probably should spend some Cloudflare worker cycles to put it back now that it’s purely static…
    • NewJazz1 day ago
      You don&#x27;t need cloudflare workers for that. The blog post mentioned how to add it. And there are other options as well.
      • rcarmo1 day ago
        I have a fully static site. And the backing storage doesn’t let me set custom headers
        • NewJazz1 day ago
          Did you read the article? That method doesn&#x27;t work for you?<p>What about this one? <a href="https:&#x2F;&#x2F;developers.cloudflare.com&#x2F;rules&#x2F;transform&#x2F;request-header-modification&#x2F;" rel="nofollow">https:&#x2F;&#x2F;developers.cloudflare.com&#x2F;rules&#x2F;transform&#x2F;request-he...</a>
  • satvikpendem1 day ago
    &gt; <i>But sometimes small, unnecessary things are exactly what make the internet better.</i><p>Or, worse? I don&#x27;t think this is the point you&#x27;re wanting to make but it&#x27;s not always the case that it&#x27;s better.
  • danaris1 day ago
    GNU Terry Pratchett<p>&quot;A man never truly dies until the his name is no longer spoken.&quot;
  • maxmcd1 day ago
    Is this possibly an intentional reference to GNU Linux, or unrelated?
    • kingsfoil1 day ago
      Within the book itself the clacks system has its own technical protocol which is briefly touched upon. The &quot;overhead&quot; is essentially packet or request metadata.<p>From the LSpace wiki, GNU is a metadata that means:<p><pre><code> G: Send the message onto the next Clacks Tower. N: Do not log the message. U: At the end of the line, return the message. </code></pre> And yes, it is almost certainly a reference to GNU as in &quot;GNU&#x27;s Not Unix&quot;. =)<p><a href="https:&#x2F;&#x2F;wiki.lspace.org&#x2F;GNU_Terry_Pratchett" rel="nofollow">https:&#x2F;&#x2F;wiki.lspace.org&#x2F;GNU_Terry_Pratchett</a>
    • TRiG_Ireland1 day ago
      It&#x27;s Terry Pratchett, so of course it&#x27;s an intentional reference.
    • shadowgovt1 day ago
      Quite intentional.
  • kingsfoil1 day ago
    A while back I wrote a tiny piece of Phoenix middleware to add the GNU message for an arbitrary name to phoenix applications:<p><a href="https:&#x2F;&#x2F;github.com&#x2F;alex0112&#x2F;ex_clacks_overhead" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;alex0112&#x2F;ex_clacks_overhead</a><p>I haven&#x27;t touched it in years, so it&#x27;s possible that it no longer works. But maybe this post is a kick in the pants for me to go test it again.<p>Thanks for keeping it in the overhead. GNU Terry Pratchett.<p>&gt; &quot;A man&#x27;s not dead while his name is still spoken&quot;
  • stevekemp1 day ago
    Looks like the site uses the deprecated &quot;Report-To:&quot; header in responses too, something I&#x27;ve never seen before and had to lookup.
  • xena1 day ago
    Whenever you load my blog, it randomly sends back a name from my configuration&#x27;s clackset: <a href="https:&#x2F;&#x2F;github.com&#x2F;Xe&#x2F;site&#x2F;blob&#x2F;ff8627975e5f6718fff33051d11a16c241f7035e&#x2F;dhall&#x2F;package.dhall#L11-L29" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;Xe&#x2F;site&#x2F;blob&#x2F;ff8627975e5f6718fff33051d11a...</a>. I hate that the list is so long but over time it will only grow longer.
    • tapete12 hours ago
      Damn. I was not aware that Kevin Mitnick has passed away.
    • dylanh1 day ago
      Thank you for putting Matt trout there.
  • atemerev1 day ago
    The most important HTTP header (though clacks is a packet routing system, not an application-level streaming protocol)
    • kijin1 day ago
      Well, there&#x27;s no reason we couldn&#x27;t have clacks-over-HTTP(-over-DNS)?(-over-avian-carrier)?, is there?
      • falcor841 day ago
        Of course, the good old CLOACA protocol (CLacks Over Avian CArrier), with the HTTP and DNS tunneling being OPTIONAL.
    • wiml1 day ago
      True, perhaps it should be added as an IP option field or TCP option...
  • dejj1 day ago
    Does “saying the name lest he be forgotten” classify as Cargo Cult?
    • falcor841 day ago
      Why would it? Cargo Cutlting is when you believe that doing something symbolic will have a tangible effect on the world (e.g. bring you cargo from the sky), but this is just intended to be symbolic.
      • dejj1 day ago
        I was curious, and you’re right. It would be Cargo Culting then, if we believed the ritual actually had an effect on Pratchett in the afterlife.