Stupid question, but CORS is designed explicitly to defend against this type of side-surf attack. Adding a strict cors policy should fix this, or am I missing something?
[dead]
Archive.today is directing a DDoS attack against my blog
141–150 of 187 posts
Re: Archive.today is directing a DDoS attack against my blog
#142Stupid question, but CORS is designed explicitly to defend against this type of side-surf attack. Adding a strict cors policy should fix this, or am I missing something?
Not here, though. The exact code:
fetch("https://gyrovague.com/?s="+Math.random().toString(36).substring(2,3+Math.random()*8),{ referrerPolicy:"no-referrer",mode:"no-cors" });
But more to the point, so long as the request meets the requirements of a "simple request", CORS won't preflight it. GETs qualify as a simple request so long as no non-CORS-safelisted headers are sent; since the sent headers are attacker-controlled, we can just assume that to be the case. In a non-preflighted request, the CORS "yes, let JS do this" are just on the response headers of the actual request itself.
Since GETs are idempotent, the browser assumes it safe to make the request. CORS could/would be used to deny JS access to the response.
Things are this way b/c there are, essentially, a myriad of other ways to make the same request. E.g.,
Re: Archive.today is directing a DDoS attack against my blog
#143Re: Archive.today is directing a DDoS attack against my blog
#144Earlier quoted context omitted.
What do you mean by “afford the cost”? The list is free of charge ( https://support.google.com/a/answer/10026322?hl=en-GB ) and maintenance can be fully automated.
I mean cost of server setup and execution.
The server that is providing the content exists already. That's a sunk cost.
Re: Archive.today is directing a DDoS attack against my blog
#145Earlier quoted context omitted.
Rights don’t emanate from one’s subjective personal beliefs. Sure, there are “natural rights” espoused by political philosophers, but in the real world, rights are enshrined in constitutions and codified in laws that we are all subject to.
Again, irrelevant to the question of whether it's doxing.
It's absolutely relevant. Some activities break the law; others don't. Why should we care about and assign a negative appellation like "doxxing" to lawful investigative activity?
Re: Archive.today is directing a DDoS attack against my blog
#146Re: Archive.today is directing a DDoS attack against my blog
#147Earlier quoted context omitted.
OP here. I obviously registered to post my own blog entry. You might also want to read your own link: https://en.wikipedia.org/wiki/Siege_of_Leningrad#Finnish_par...
Finland did send hundreds of people to be murdered in Nazi concentration camps.
I couldn't care less if this person's grandfather was a Nazi, even if it turns out to be true. What are they supposed to do, go back in time and convince their grandfather to change their ways? It ridiculous using this as some kind of insult, and it disturbs me that people might take it as one.
Re: Archive.today is directing a DDoS attack against my blog
#148Re: Archive.today is directing a DDoS attack against my blog
#149Earlier quoted context omitted.
Again, irrelevant to the question of whether it's doxing.
It's absolutely relevant. Some activities break the law; others don't. Why should we care about and assign a negative appellation like "doxxing" to lawful investigative activity?
Whether you care about somebody getting doxed is orthogonal to whether they've been doxed. Whether you care or not is entirely up to you, it has no relevance.
Re: Archive.today is directing a DDoS attack against my blog
#150Earlier quoted context omitted.
"setup and execution".
What serious operator of a service isn't budgeting time to implement and operate critical maintenance functions?
Me for one. Adding an auto-updating IP address blocker to my personal blog site would probably cost more than setting up the whole site did in the first place.