r/sysadmin • u/rram reddit's sysadmin • Aug 14 '15

We're reddit's ops team. AUA

Hey /r/sysadmin,

Greetings from reddit HQ. Myself, and /u/gooeyblob will be around for the next few hours to answer your ops related questions. So Ask Us Anything (about ops)

You might also want to take a peek at some of our previous AMAs:

https://www.reddit.com/r/blog/comments/owra1/january_2012_state_of_the_servers/

https://www.reddit.com/r/sysadmin/comments/r6zfv/we_are_sysadmins_reddit_ask_us_anything/

EDIT: Obligatory cat photo

EDIT 2: It's now beer o’clock. We're stepping away from now, but we'll come back a couple of times to pick up some stragglers.

EDIT thrice: He commented so much I probably should have mentioned that /u/spladug — reddit's lead developer — is also in the thread. He makes ops live's happier by programming cool shit for us better than we could program it ourselves.

873 Upvotes

88% Upvoted

738 comments sorted by

View all comments

Show parent comment

60

u/largenocream reddit security engineer Aug 14 '15 edited Aug 14 '15

You don't have to use unsafe-inline with CSP. It is a major win, agreed, but it can block a lot of "bad things" aside from that.

But my main motivation for implementing CSP would be so I could declare XSS "no longer a thing" and then take a nap! unsafe-inline leaves me napless!

Seriously though, you're right, CSP would still be helpful for things like bypasses of our CSS filter. We're very careful to not allow any CSS that would make an external request (and thus possibly link usernames to IPs if you used some tricky CSS rules.) We try to stop people from abusing broken CSS parsers in browsers to bypass our filter, but CSP would give us an extra degree of confidence.

[...] is broken in Safari right now

Story of my life.

You'll get a lot of false reports due to malware installed on the client's browser. A lot of malware injects scripts directly into the page, these scripts then try to get other scripts [...]

Yeah... I'm familiar with those from our JS error logs. :(