I see just error 429 can someone please explain?
They switched it to make the page redirect to the Web Archive for now.
So this guy is now S3. All of S3
171–180 of 522 posts
Re: So this guy is now S3. All of S3
#172This is why mastodon , webfinger and ACME uss .well-known uri prefix. .well-known is reserved and you can't e.g. make a bucket named .well-known It's funny the bluesky devs say they implemented "something like webfinger" but left out the only important part of webfinger that protects against these attacks in the first place. Weird oversight and something something don't come up with your own standards
Nostr too
Re: So this guy is now S3. All of S3
#173Kiss of death
They switched it to make the page redirect to the Web Archive for now.
Re: So this guy is now S3. All of S3
#174Earlier quoted context omitted.
What about serving the challenge file from the root or a near-root of the fully qualified url? Like www.domain.com/mastodon.txt or abc.freehost.com/mastodon.txt? Maybe I'm old but what are some popular use cases for webfinger? (I'm just learning about it now)
The /.well-known/ path prefix is the standard name to use ( https://www.rfc-editor.org/rfc/rfc8615 ) so that any sort of “we’ll host user content from our domain” thing can block it. (Hosting user content from the user’s domain is fine and doesn’t need this restriction.) A few things are effectively grandfathered in due to their vintage: /favicon.ico, /sitemap.xml and /robots.txt are the three that occur to me—so if…
> A few things are effectively grandfathered in due to their vintage: /favicon.ico, /sitemap.xml and /robots.txt are the three that occur to me—so if you’re running something vaguely like S3, you’ll want to make sure users can’t create files at the top level of your domain matching at least those names.
I also recall /crossdomain.xml as an important one; allowing users to create an arbitrary file matching that name could allow certain kinds of cross-site attacks against your site.
Re: So this guy is now S3. All of S3
#175> 429 Too Many Requests Aight, level with me: Is every mastodon server running on a Raspberry Pi?
You can also see the same "toot" as a "tweet": https://twitter.com/jonty/status/1653915932677271552
Re: So this guy is now S3. All of S3
#176Earlier quoted context omitted.
Stunning that there are (were) any 4-char bucket names left.
I guess I'm not too surprised in that, unlike domain names, these aren't obviously exposed to end users, so terseness doesn't particularly matter. Verbose and descriptive is honestly better for most names.
And given that bucket names are a giant shared namespace, there's absolutely an incentive toward lots of prefixing to help ensure you get the ones you want.
Re: So this guy is now S3. All of S3
#177Re: So this guy is now S3. All of S3
#178Earlier quoted context omitted.
> slowing down the entire site This is mind-blowing. Last I checked, the front page of HN sends tens of requests per second to each link. There are humans who can pack envelopes faster than the typical mastodon server can answer GETs. I'd love to see someone benchmark the top servers for a few seconds to see what it takes to break a reasonable latency SLA.
Clearly they're not microservicing hard enough.
I suggest making the current team explain to 4 new teams how to port it to something fast, like elixir and rust (both!)
Probably messaging with pulsar and the build system from python 4, too.
I read this in a whitepaper. Let’s do this, guys! ;)
Re: So this guy is now S3. All of S3
#179Re: So this guy is now S3. All of S3
#180Earlier quoted context omitted.
.well-known seems unintuitive Also the penalty isn't very high here. Someone impersonated a domain on a burgeoning protocol for a short while. So what?
> .well-known seems unintuitive We're talking about folks setting up a custom domain for a personal social media presence. If they can handle nameservers and DNS records, they can handle a folder with a dot in the name.
but it disappears when you add the dot.