Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

This website is hosted on Bluesky

danielmangum.com

Post reply on HN
Print view View original

31–40 of 184 posts

Re: This website is hosted on Bluesky

#31

Post by benatkin »

simonw wrote: post #3

I was curious as to the security context this runs in: curl -i 'https://porcini.us-east.host.bsky.network/xrpc/com.atproto.sync.getBlob?did=did:plc:j22nebhg6aek3kt2mex5ng7e&cid=bafkreic5fmelmhqoqxfjz2siw5ey43ixwlzg5gvv2pkkz7o25ikepv4zeq' Here are the headers I got back: x-powered-by: Express access-control-allow-origin: * cache-control: private vary: Authorization, Accept-Encoding ratelimit-limit: 3000 ratelimit-rema…

Blocking/allowlisting all JavaScript is the only way [1] to have a CSP fully contain an app (no exfiltration) [2] and with prefetch that might not be enough. The author is correct at the end to suggest using WebAssembly. (Also, it still has the issue of clicking links, which can be limited to certain domains or even data: by wrapping the untrusted code in an iframe and using child-src on the parent of the iframe)

1: https://github.com/w3c/webappsec/issues/656#issuecomment-246...

2: https://www.w3.org/TR/CSP3/#exfiltration

Re: This website is hosted on Bluesky

#34

Post by benatkin »

remram wrote: post #32
h4x0rr wrote: post #24

Anyone else feels like this will be abused for phishing and/or malware distribution?

I don't see how. This is a direct link to the author's bluesky server (PDS) so of course it is controlled by them.

Lack of moderation combined with an offical-sounding domain name.

This would have to get the user to follow a link or call a phone number or something though. These are plausible. It's too bad the content-security-policy can't prevent following links.

Re: This website is hosted on Bluesky

#35

Post by skybrian »

I'm wondering whether a third-party PDS implementation should support other protocols as well. Would a combined git/PDS repo make any sense at all? (That is, it's a PDS, but it also implements enough of git to do read-only access via git commands.)

What other protocols would make sense?

Re: This website is hosted on Bluesky

#36

Post by EGreg »

lazystar wrote: post #33
h4x0rr wrote: post #24

Anyone else feels like this will be abused for phishing and/or malware distribution?

is there any hosting site that isn't? feels like a computing law at this point; if you build a hosting site, someone will try to use it for malicious purposes.

Can’t you just make the hosting site features only be for real purposes?

Like a link shortener which only forwards to a domain that matches the subdomain? Or only for watching videos and collecting metrics etc.

Re: This website is hosted on Bluesky

#39

Post by hi_hi »

Could some awesome person possibly summarise any limitations or use cases where this might not work well?

The example provided is quite basic static text, so I'm wondering if there's a reason for that?

Re: This website is hosted on Bluesky

#40

Post by dv35z »

dangerlibrary wrote: post #19
tr1ll10nb1ll wrote: post #2

unrelated probably, but it made me realize how I don't really see Hugo/Jekyll type websites anymore.

I just use mkdocs for everything.

Have you found a decent bare bones starter theme? I've been using MkDocs Material, and I find the theme too complicated (HTML etc) - hoping to find a super simple one that looks decent - plain - and is a good base for theming / styling. Thanks & take care.
Post reply on HN