Mastadon has no chance if every time something becomes a little bit viral it's instance dies over the traffic.
[flagged]
So this guy is now S3. All of S3
121–130 of 522 posts
Re: So this guy is now S3. All of S3
#122This is why mastodon , webfinger and ACME uss .well-known uri prefix. .well-known is reserved and you can't e.g. make a bucket named .well-known It's funny the bluesky devs say they implemented "something like webfinger" but left out the only important part of webfinger that protects against these attacks in the first place. Weird oversight and something something don't come up with your own standards
.well-known seems unintuitive
Also the penalty isn't very high here. Someone impersonated a domain on a burgeoning protocol for a short while. So what?
Re: So this guy is now S3. All of S3
#123Mastadon has no chance if every time something becomes a little bit viral it's instance dies over the traffic.
Let’s be honest… Mastodon was never going to make it outside niche technical circles, regardless of scaling. It’s a fun project though.
Re: So this guy is now S3. All of S3
#124Earlier quoted context omitted.
> slowing down the entire site This is mind-blowing. Last I checked, the front page of HN sends tens of requests per second to each link. There are humans who can pack envelopes faster than the typical mastodon server can answer GETs. I'd love to see someone benchmark the top servers for a few seconds to see what it takes to break a reasonable latency SLA.
It has been 20+ years since slashdotting with the requisite hardware and connection upgrades and still things fall over.
[flagged]
Re: So this guy is now S3. All of S3
#125Earlier quoted context omitted.
Further context: Bluesky lets you use a domain name you own as a user handle. The official method is to set a TXT record, but apparently their "AT protocol" also lets you confirm a domain by serving `GET your.domainname.com/xrpc/com.atproto.identity.resolveHandle` and `xrpc` was available as an S3 bucket name :)
Stunning that there are (were) any 4-char bucket names left.
I guess I'm not too surprised in that, unlike domain names, these aren't obviously exposed to end users, so terseness doesn't particularly matter. Verbose and descriptive is honestly better for most names.
Re: So this guy is now S3. All of S3
#126Earlier quoted context omitted.
Further context: Bluesky lets you use a domain name you own as a user handle. The official method is to set a TXT record, but apparently their "AT protocol" also lets you confirm a domain by serving `GET your.domainname.com/xrpc/com.atproto.identity.resolveHandle` and `xrpc` was available as an S3 bucket name :)
Stunning that there are (were) any 4-char bucket names left.
Path based bucket addressing isn't supported anymore, so this must be a legacy bucket:
https://aws.amazon.com/blogs/aws/amazon-s3-path-deprecation-...
Re: So this guy is now S3. All of S3
#127This is a terrible implementation of domain verification. dns-01 and http-01 are more or less standardized at this point. Use them, and don't roll your own. Reference: https://letsencrypt.org/docs/challenge-types/ .
I don't get http-based verification in general. If you want to really prove someone owns a domain, make them change an authoritative DNS record. Everything else feels like it is begging for edge cases to crop up. Why should my social media or SSL certificate vendor care about my web servers?
> If you want to really prove someone owns a domain, make them change an authoritative DNS record.
You're not wrong (ignoring how easy it is to hack DNS), but at the same time it's hard enough to get people to buy their own domain name, nevermind understand the system well enough to add a TXT record.
It's a strategy that's fine to implement when your target audience is server admins. It's a terrible strategy when your target audience is everyday users who you hope own their own domain. Doubly so in a world where owning your own domain is so rare for individuals.
Re: So this guy is now S3. All of S3
#128Re: So this guy is now S3. All of S3
#129bluesky dev here. whoops. as others mentioned, not a hard fix.
Hilarious though! I'm guessing this is the kind of stuff the Beta was supposed to find. Any other cool/funny bugs y'all have found?
I created a rich text system for posts to handle things like links and mentions with the eventual goal of it being the basis for all kinds of rich text (bolding, italics, spoiler tags, etc)
the flexibility bit us on the butt. people started faking mentions via the APIs and one user figured out he could pack 1000 mentions into one "@everyone" and cause us all to get notified. pretty predictable in hindsight but I dropped the ball there
Re: So this guy is now S3. All of S3
#130Earlier quoted context omitted.
I hope I never work on software you folks use. The grand claims about something that is not even hard to fix is just wild to me.
Being easy to fix is completely irrelevant. The thing is that it's easy to avoid. The only way to end up there is to not put any thought into the domain verification scheme before deploying it. Any kind of review would catch it. That's what makes it look really bad.
[deleted]