Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

This website is hosted on Bluesky

danielmangum.com

Post reply on HN
Print view View original

141–150 of 184 posts

Re: This website is hosted on Bluesky

#141

Post by pfraze »

sebmellen wrote: post #55
pfraze wrote: post #15

Appreciated Daniel reaching out to the team about this! Hosting blobs is one of those things that will inevitably go through iterations as we understand the abuse vectors more and more, but for now it's really fun to see this kind of usage in action. The PDS is meant to be a database host in the same sense that a webserver is a website host.

Are you ever going to bring back Beaker Browser? Used to love playing around with that! Didn't realize you'd gone on to Bluesky, very neat.

Thanks! Probably won’t revive it, but it was a great experience. Wrote some notes on it here: https://github.com/beakerbrowser/beaker/blob/master/archive-...

Re: This website is hosted on Bluesky

#142

Post by pfraze »

philipwhiuk wrote: post #106
pfraze wrote: post #15

Appreciated Daniel reaching out to the team about this! Hosting blobs is one of those things that will inevitably go through iterations as we understand the abuse vectors more and more, but for now it's really fun to see this kind of usage in action. The PDS is meant to be a database host in the same sense that a webserver is a website host.

You're walking headfirst into the copyright, CSAM, pornography hole of content moderation here.

As opposed to running a social network? What else is new

Re: This website is hosted on Bluesky

#144

Post by preciousoo »

chefandy wrote: post #139
thesuitonym wrote: post #113

Earlier quoted context omitted.

How is this any different than the regular hole of content moderation they're already in?

I don’t have a well-considered answer, but a) I imagine being able to host a phishing site on an official domain from them using their SSL cert is problematic, and b) my gut says that as soon as you start hosting arbitrary files— e.g. zip files— and browser executable JavaScript with your domain in there, that’s a different level of possible content. I guess the question is whether or not the disposition of a social…

It’s not possible for me, a non Google employee to create a file that’s hosted on Google.com, or any Google domain and have it read in the browser as text/html, bypassing many a firewall, for example

Re: This website is hosted on Bluesky

#146

Post by rpastuszak »

Just a (very unserious) reminder that you can host +7kb of data in a single tweet using data URIs + gzip.

Here's Pong (HTML + JS) and the Epic of Gilgamesh: https://x.com/rafalpast/status/1316836397903474688

(brought to you by the ad tracking pixel parameters ignoring the tweet length limit)

More links + the "Twitter CDN" editor™: https://sonnet.io/projects#:~:text=Laconic!%20(a%20Twitter%2...

Re: This website is hosted on Bluesky

#147

Post by hk1337 »

willscott wrote: post #89

One of the points that is made is that since the PDS that's being interacted with here is part of a 'Personal Data Server' rather than the Bluesky product, it ends up able to offer infinite free data storage. This seems like one of the things that might be part of the references the bluesky team has made at time to introducing a subscription service - providing more space / bandwidth / higher quality video on your PD…

> 'Personal Data Server' rather than the Bluesky product

If I understood correctly, the PDS was hosted on Bluesky. I assume it could be hosted somewhere else, so yeah it could be interacted with more than Bluesky.

Re: This website is hosted on Bluesky

#148

Post by hiop »

The recent API changes in Strava reminded me of how limited our access is to the data stored on their platform. As a dominant player in the fitness space, they could gradually lock features behind a subscription wall.

While this might raise privacy or safety concerns, could the AT Protocol be a suitable platform for storing GPX or FIT files?

Re: This website is hosted on Bluesky

#149

Post by nightpool »

johncolanduoni wrote: post #41
nightpool wrote: post #30

Earlier quoted context omitted.

is the default-src necessary if you're using sandbox or is it redundant?

`sandbox` doesn’t affect making requests via HTML (images, stylesheets, etc.).

Right, but what would be the security impact of that compared to just plain HTML? I guess it allows for some form of view counting or IP exfiltration, but other than that anything you can do with an external request you could do with an embedded data URI.

Re: This website is hosted on Bluesky

#150

Post by benatkin »

EE84M3i wrote: post #91
benatkin wrote: post #31

Earlier quoted context omitted.

Blocking/allowlisting all JavaScript is the only way [1] to have a CSP fully contain an app (no exfiltration) [2] and with prefetch that might not be enough. The author is correct at the end to suggest using WebAssembly. (Also, it still has the issue of clicking links, which can be limited to certain domains or even data: by wrapping the untrusted code in an iframe and using child-src on the parent of the iframe) 1:…

I didn't realize you could use CSP for preventing exhilaration now! How did they close the WebRTC loopholes?

They haven't. That in the spec stops short of actually saying that it will stop all exfiltration. What it will do is make it harder because you'd have to put the data in a subdomain or in a username/password. It also could make it hard to deny that an attempt to exfiltrate was deliberate.
Post reply on HN