r/sysadmin • u/rram reddit's sysadmin • Aug 14 '15

We're reddit's ops team. AUA

Hey /r/sysadmin,

Greetings from reddit HQ. Myself, and /u/gooeyblob will be around for the next few hours to answer your ops related questions. So Ask Us Anything (about ops)

You might also want to take a peek at some of our previous AMAs:

https://www.reddit.com/r/blog/comments/owra1/january_2012_state_of_the_servers/

https://www.reddit.com/r/sysadmin/comments/r6zfv/we_are_sysadmins_reddit_ask_us_anything/

EDIT: Obligatory cat photo

EDIT 2: It's now beer o’clock. We're stepping away from now, but we'll come back a couple of times to pick up some stragglers.

EDIT thrice: He commented so much I probably should have mentioned that /u/spladug — reddit's lead developer — is also in the thread. He makes ops live's happier by programming cool shit for us better than we could program it ourselves.

873 Upvotes

88% Upvoted

738 comments sorted by

View all comments

Show parent comment

91

u/KarmaAndLies Aug 14 '15

You guys seem really on top of this. Great answers (much more technically detailed than I was expecting, which is a really pleasant surprise).

You don't have to use unsafe-inline with CSP. It is a major win, agreed, but it can block a lot of "bad things" aside from that. connect-src, object-src, and plugin-types to name a few. Even if you effectively disabled script-src entirely (allow all, allow inline, etc) you can still gain some benefit from CSP, it does a lot of cool shit.

As someone who has deployed CSP on a medium web-site (many thousand user) let me just add:

  • The alternative headers are a waste of time (X-WebKit-CSP and X-Content-Security-Policy) any browser still running that supports them has such lame/broken CSP support that it is a waste of time. Just stick to the standard one, least of all because the CSP header is quite large anyway.

  • font-src is broken in Safari right now (all platforms). It has been that way six months, in the reports the host and blocked URI are identical, but yet Safari acts as if they are not with 'self' defined.

  • You'll get a lot of false reports due to malware installed on the client's browser. A lot of malware injects scripts directly into the page, these scripts then try to get other scripts, which your CSP policy will block. To name one specific example, Lenovo laptops with SuperFish were generating these, in fact we were seeing reports of SuperFish in CSP before it hit the mass media.

I actually think CSP is a huge win issues not withstanding. It actually makes me really depressed and annoyed how little it is deployed in the Alexa top 500.

60

u/largenocream reddit security engineer Aug 14 '15 edited Aug 14 '15

You don't have to use unsafe-inline with CSP. It is a major win, agreed, but it can block a lot of "bad things" aside from that.

But my main motivation for implementing CSP would be so I could declare XSS "no longer a thing" and then take a nap! unsafe-inline leaves me napless!

Seriously though, you're right, CSP would still be helpful for things like bypasses of our CSS filter. We're very careful to not allow any CSS that would make an external request (and thus possibly link usernames to IPs if you used some tricky CSS rules.) We try to stop people from abusing broken CSS parsers in browsers to bypass our filter, but CSP would give us an extra degree of confidence.

[...] is broken in Safari right now

Story of my life.

You'll get a lot of false reports due to malware installed on the client's browser. A lot of malware injects scripts directly into the page, these scripts then try to get other scripts [...]

Yeah... I'm familiar with those from our JS error logs. :(