Change Details

Since T95715 is nearing a conclusion, time to discuss the next step. Let's be honest, `format=php` sucks. It is not human-readable, it's restricted to one programming language, and even there it can result in a remote code execution on client if attacker owns/MITMs the server. Therefore, it would be wise to get rid of it, yet its current usage share is over 5% so even marking it as deprecated would be a poinless waste of bandwidth and logs to generate a zillion of deprecation warnings. What can be done here? Some kind of soft-deprecation? Also, probably the time has come to start preaching to bot developers to cease using it. A fix in a couple of frameworks could improve the statistics significantly.

Since T95715 is nearing a conclusion, time to discuss the next step. Let's be honest, `format=php` sucks. It is not human-readable, it's restricted to one programming language, and even there it can result in a remote code execution on client if attacker owns/MITMs the server. Therefore, it would be wise to get rid of it, yet its current usage share is over 5% so even marking it as deprecated would be a poinless waste of bandwidth and logs to generate a zillion of deprecation warnings. What can be done here? Some kind of soft-deprecation? Also, probably the time has come to start preaching to bot developers to cease using it. A fix in a couple of frameworks could improve the statistics significantly. For the reference: $ head -n 1000000 api.log | grep format=php | grep -oE 'API (GET|POST) \S+' | awk '{print $3;}' | sort | uniq -c | sort -rn | sed -r -e 's/[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+/<IP user>/' | head -n 30 23521 Cyberbot_I 12615 <IP user> 6833 <IP user> 4664 Cyberbot_II 3347 ClueBot_III 1726 Legobot 1612 Luke081515Bot 1568 <IP user> 868 ArndBot 717 <IP user> 338 <IP user> 242 <IP user> 240 ClueBot_NG 240 <IP user> 210 <IP user> 191 <IP user> 152 OLMBot 152 NasirkhanBot 135 <IP user> 105 <IP user> 81 <IP user> 77 <IP user> 74 <IP user> 69 SineBot 67 <IP user> 66 <IP user> 62 Beau.bot.admin 59 <IP user> 51 <IP user> 39 <IP user>

Since T95715 is nearing a conclusion, time to discuss the next step. Let's be honest, `format=php` sucks. It is not human-readable, it's restricted to one programming language, and even there it can result in a remote code execution on client if attacker owns/MITMs the server. Therefore, it would be wise to get rid of it, yet its current usage share is over 5% so even marking it as deprecated would be a poinless waste of bandwidth and logs to generate a zillion of deprecation warnings. What can be done here? Some kind of soft-deprecation? Also, probably the time has come to start preaching to bot developers to cease using it. A fix in a couple of frameworks could improve the statistics significantly. For the reference: $ head -n 1000000 api.log | grep format=php | grep -oE 'API (GET|POST) \S+' | awk '{print $3;}' | sort | uniq -c | sort -rn | sed -r -e 's/[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+/<IP user>/' | head -n 30 23521 Cyberbot_I 12615 <IP user> 6833 <IP user> 4664 Cyberbot_II 3347 ClueBot_III 1726 Legobot 1612 Luke081515Bot 1568 <IP user> 868 ArndBot 717 <IP user> 338 <IP user> 242 <IP user> 240 ClueBot_NG 240 <IP user> 210 <IP user> 191 <IP user> 152 OLMBot 152 NasirkhanBot 135 <IP user> 105 <IP user> 81 <IP user> 77 <IP user> 74 <IP user> 69 SineBot 67 <IP user> 66 <IP user> 62 Beau.bot.admin 59 <IP user> 51 <IP user> 39 <IP user>