you are viewing a single comment's thread
view the rest of the comments
[–] 81 points 3 years ago* (4 children)

Our business-critical internal software suite was written in Pascal as a temporary solution and has been unmaintained for almost 20 years. It transmits cleartext usernames and passwords as the URI components of GET requests. They also use a single decade-old Excel file to store vital statistics. A key part of the workflow involves an Excel file with a macro that processes an HTML document from the clipboard.

I offered them a better solution, which was rejected because the downtime and the minimal training would be more costly than working around the current issues.

  • source
  • hideshow 8 child comments
  • [–] 30 points 3 years ago

    The library I worked for as a teen used to process off-site reservations by writing them to a text file, which was automatically e-faxed to all locations every odd day.

    If you worked at not-the-main-location, you couldn't do an off-site reservation, so on even days, you would print your list and fax it to the main site, who would re-enter it into the system.

    This was 2005. And yes, it broke every month with an odd number of days.

  • source
  • parent
  • [–] 8 points 3 years ago

    downtime

    minimal retraining

    I feel your pain. Many good ideas that cause this are rejected. I have had ideas requiring one big downtime chunk rejected even though it reduces short but constant downtimes and mathematically the fix will pay for itself in a month easily.

    Then the minimal retraining is frustrating when work environments and coworkers still pretend computers are some crazy device they’ve never seen before.

  • source
  • parent
  • [–] 6 points 3 years ago (4 children)

    cleartext usernames and passwords as the URI components of GET requests

    I’m not an infrastructure person. If the receiving web server doesn’t log the URI, and supposing the communication is encrypted with TLS, which removes the credentials from the URI, are there security concerns?

  • source
  • parent
  • hideshow 8 child comments
  • [–] 12 points 3 years ago* (1 child)

    Anyone who has access to any involved network infrastructure can trace the cleartext communication and extract the credentials.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 3 years ago (1 child)

    What do you mean by any involved network infrastructure? The URI is encrypted by TLS, you would only see the host address/domain unless you had access to it after decryption on the server.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 5 points 3 years ago (1 child)

    They said clear text, I would assume it's not https.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 3 years ago* (1 child)

    The comment we are replying to is asking about a situation where there is TLS. Also using clear text values in the URI itself does not mean there wouldn't be TLS.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 2 years ago

    Browser history

    Even if the destination doesn't log GET components, there could be corporate proxies that MITM that might log the URL. Corporate proxies usually present an internally trusted certificate to the client.

  • source
  • parent
  • [–] 1 point 3 years ago (1 child)

    I'm not 100% on this but I think GET requests are logged by default.

    POST requests, normally used for passwords, don't get logged by default.

    BUT the Uri would get logged would get logged on both, so if the URI contained @username:Password then it's likely all there in the logs

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 2 years ago

    Get and post requests are logged

    The difference is that the logged get requests will also include any query params

    GET /some/uri?user=Alpha&pass=bravo

    While a post request will have those same params sent as part of a form body request. Those aren’t logged and so it would look like this

    POST /some/uri

  • source
  • parent
  • [–] 1 point 3 years ago (1 child)

    As weird as it may seem, this might be a good argument in favor of Pascal. I despised learning it at uni, as it seems worthless, but is seems that it can still handle business-critical software for 20 years.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 3 years ago*

    What OP didn't tell you is that, due to its age, it's running on an unpatched WinXP SP2 install and patching, upgrading to SP3, or to any newer Windows OS will break the software calls that version of Pascal relies upon.

  • source
  • parent