Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Is This Website Port Scanning Me?

nullsweep.com

Post reply on HN
Print view View original

231–240 of 448 posts

Re: Why Is This Website Port Scanning Me?

#231

Post by djsumdog »

bradly wrote: post #204
djsumdog wrote: post #108

Earlier quoted context omitted.

Websockets are nice for some things. I hack on Mastodon and it uses WSS for streams and they're very helpful. But WebBluetooth, ASM, etc are all fairly insane. WebRTC feels like a massive security issue (I've seen a demo of someone using WebRTC to find computers on an internal network at a security conference years ago. Even if that hole is fixed, it's still a hacky solution to video streaming behind NAT). I agree; m…

> I hack on Mastodon and it uses WSS for streams and they're very helpful. I'm not familiar with Mastodon or WSS. Can you describe how using WSS make the end user's experience better? What would be different if web sockets weren't used?

Mastodon is a federated/distributed social networking server that communicates with other servers via a protocol called ActivityPub. The interface feels sorta like Twitter, but it doesn't have to be.

There are other FOSS ActiviyPub servers such as Pleroma (written in Elixir), Pixelfed (Instagram type interface) and PeerTube (distributed video). ActivityPub is a protocol (like e-mail/SMTP) for subscribing and replying to posts. ActiviyPub is just used for the backend (how servers communicate with other servers; like SMTP sending e-mail or RSS readers polling RSS).

Mastodon uses websockets to stream posts to the client/web browser. People who make mobile apps and desktop clients also tend to use WSS. It does fall back to regular HTTP polling in case WSS fails. Pleroma and others also re-implement the mastodon API. It means you can have different front-end web clients (Pleroma-fe, soapbox-fe, etc) on top of different backends (Mastodon/Pleroma).

The advantage of WSS is being able to stream new statuses with a socket, rather than polling constantly for new updates.

If you get on a Mastodon/Pleroma/Pixelfed instance (there are hundreds out there or you can setup your own), you can follow me at @djsumdog@hitchhiker.social

Re: Why Is This Website Port Scanning Me?

#232

Post by r00fus »

datenwolf wrote: post #118
bjt2n3904 wrote: post #75

Every time I hear about some shiny new feature being added to a browser, I think... 1) Will I ever actually use this 2) How is this gonna screw me over WebSockets, WebBluetooth, WebAssembly, Web-You-Can-Access-my-Accelerometer-and-Battery, haven't ever wanted to use those. Ever. For anything. For any reason. (Edit 3: Oh yeah, I forgot! WebRTC!) Edit: Fantastic. You can't disable it in Firefox. So what, does Firefox n…

You forgot WebUSB – I wish I was joking, but I'm not: https://developer.mozilla.org/en-US/docs/Web/API/USB

I see WebUSB and I immediately think: "This is something that already exists in ChromeOS and Google wants to standardize it".

Chrome the browser is a stalking horse/test harness for ChromeOS.

Re: Why Is This Website Port Scanning Me?

#233

Post by imiric »

louis_pasteur wrote: post #110
bjt2n3904 wrote: post #75

Every time I hear about some shiny new feature being added to a browser, I think... 1) Will I ever actually use this 2) How is this gonna screw me over WebSockets, WebBluetooth, WebAssembly, Web-You-Can-Access-my-Accelerometer-and-Battery, haven't ever wanted to use those. Ever. For anything. For any reason. (Edit 3: Oh yeah, I forgot! WebRTC!) Edit: Fantastic. You can't disable it in Firefox. So what, does Firefox n…

We need a simple browser implementation for the masses. Is there any such browser in existence?

I'm a big fan of https://surf.suckless.org/ .

With some polish and maintenance it could serve as base for a simple(r) browser for the masses. It is essentially a small wrapper around WebKit, which is far from simple, but it has the benefit of great support for modern web features.

Re: Why Is This Website Port Scanning Me?

#234

Post by gsnedders »

derefr wrote: post #198
bjt2n3904 wrote: post #75

Every time I hear about some shiny new feature being added to a browser, I think... 1) Will I ever actually use this 2) How is this gonna screw me over WebSockets, WebBluetooth, WebAssembly, Web-You-Can-Access-my-Accelerometer-and-Battery, haven't ever wanted to use those. Ever. For anything. For any reason. (Edit 3: Oh yeah, I forgot! WebRTC!) Edit: Fantastic. You can't disable it in Firefox. So what, does Firefox n…

> WebSockets ... haven’t ever wanted to use those. Ever. For anything. For any reason. You’ve never used a web-app chat client? > WebBluetooth APIs like these don’t exist for the sake of regular unprivileged web-apps. They exist for the sake of browser extensions (or browser “apps”, or apps within a browser-projector like Electron), specifically in order to be used to add driver-like or service-like capabilities to d…

> APIs like these don’t exist for the sake of regular unprivileged web-apps. They exist for the sake of browser extensions (or browser “apps”, or apps within a browser-projector like Electron), specifically in order to be used to add driver-like or service-like capabilities to devices like Chromebooks where the browser is the OS.

That's not really true, though: they're part of the Chrome team's belief in not limiting the capabilities of the web as a platform for app development (on the basis of "if you lack one feature the app needs, the entire app ends up native"). This is a large part of Project Fugu: https://developers.google.com/web/updates/capabilities

Re: Why Is This Website Port Scanning Me?

#235

Post by billme »

thanksforfish wrote: post #153
gruez wrote: post #56

Earlier quoted context omitted.

Ublock allows you to block websocket requests. eg. *$websocket will block all websocket connections. You probably want to operate on a whitelist on a site by site basis. Blocking localhost or 127.0.0.1 isn't reliable because sites can use dns rebinding attacks to bypass your filters.

This helps, but can't you also do this sort of scanning without websockets?

How? This appears to bypass NATs Network Address Translation) & Firewalls.

Re: Why Is This Website Port Scanning Me?

#236

Post by Macha »

tlb wrote: post #115
zrobotics wrote: post #97

Earlier quoted context omitted.

I'm curious, what would be a good reason to do this? I'm not creative enough to think of anything this enables a site to do that isn't malicious. If I'm running a service on localhost, and that service needs to communicate with the site I'm browsing, surely I could just direct that service to communicate with the site itself. For instance, if I'm running a local chat application and need it to communicate with the we…

Ubiquiti routers have a fairly magical browser SPA that can run on their domain and talk to local routers. It involves webrtc connections to local addresses. But I think if same-origin were enforced more strictly, they could have found another way.

Huh, I never looked but always assumed this was proxying through the controller.

Re: Why Is This Website Port Scanning Me?

#238

Post by rhizome »

Reelin wrote: post #139
djsumdog wrote: post #108

Earlier quoted context omitted.

Websockets are nice for some things. I hack on Mastodon and it uses WSS for streams and they're very helpful. But WebBluetooth, ASM, etc are all fairly insane. WebRTC feels like a massive security issue (I've seen a demo of someone using WebRTC to find computers on an internal network at a security conference years ago. Even if that hole is fixed, it's still a hacky solution to video streaming behind NAT). I agree; m…

> Even if that hole is fixed ... Last I checked (> 1 year ago) it was WONTFIX because of some very idiotic (IMO) reasoning. I keep it permanently disabled and have never missed it (media.peerconnection.enabled in Firefox btw).

No doubt like canvas, font, audio, etc. fingerprinting, it will eventually be required to use Google apps like Maps and Messages for Web (to cite two recent discoveries).

"If you're not paying, you're the product" has its own form of economic inflation.

Re: Why Is This Website Port Scanning Me?

#239

Post by michaelt »

derefr wrote: post #200
michaelt wrote: post #187

Earlier quoted context omitted.

Web sockets, but redesigned to only connect to the host shown in the address bar, on port 443.

Doesn’t work if www.example.com is just an S3 bucket, with the actual website at api.example.com.

That sounds like the developer's problem, not the browser's problem.

I mean, I could half-ass my work a lot more often if they'd get rid of these burdensome restrictions on cross-origin requests. But they ain't going to.

Re: Why Is This Website Port Scanning Me?

#240

Post by gsnedders »

bjt2n3904 wrote: post #119
jackewiehose wrote: post #102

Earlier quoted context omitted.

The alternative is to ask the user on a site basis.

That would be amazing, but it would never happen. Mom and Pop would always click "no" out of fear of the unknown, and my awesome feature wouldn't get used! It has to be enabled by default, they don't know what they're missing!

That's literally the opposite of the concern with permission prompts: all the evidence from years of SSL/TLS certificate errors is that users will blindly grant permission.
Post reply on HN