Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

So this guy is now S3. All of S3

chaos.social

Post reply on HN
Print view View original

31–40 of 522 posts

Re: So this guy is now S3. All of S3

#31

Post by tingletech »

Nick87633 wrote: post #24
arianvanp wrote: post #8

This is why mastodon , webfinger and ACME uss .well-known uri prefix. .well-known is reserved and you can't e.g. make a bucket named .well-known It's funny the bluesky devs say they implemented "something like webfinger" but left out the only important part of webfinger that protects against these attacks in the first place. Weird oversight and something something don't come up with your own standards

What about serving the challenge file from the root or a near-root of the fully qualified url? Like www.domain.com/mastodon.txt or abc.freehost.com/mastodon.txt? Maybe I'm old but what are some popular use cases for webfinger? (I'm just learning about it now)

.well-known is basically the same idea https://datatracker.ietf.org/doc/html/rfc5785

Re: So this guy is now S3. All of S3

#33

Post by steveklabnik »

chrismorgan wrote: post #29
Ciantic wrote: post #5

Solution is also on the works like use /.well-known/, so this is more like funny, rather than a big problem. Key to trick was to have bucket named "xrpc" and store a file there: https://s3.amazonaws.com/xrpc/com.atproto.identity.resolveHa... There is also another funny thing in the image, the user posting about is sending one from "retr0-id.translate.goog", which is odd. Somehow he has got https://retr0-id.translate.…

Eh, it’s worse than just funny; it’s concerning, because they should have known about and easily avoided this kind of vulnerability, it’s standard stuff you have to think about. So what else have they missed?

This is a private beta. Nobody is suggesting that any of this be used for anything serious just yet. Development happens out in the open, you can go find out what else they've missed by doing the work, or by waiting until others you trust have done so.

I myself have had an account for like a month now, but only started really using it a week ago, because that calculus changed for me, personally.

Like, it's not even possible to truly delete posts at the moment. This all needs to be treated as a playground until things mature.

This isn't even the first "scandal" related to this feature already!!!! There is another hole in what currently exists that allowed someone to temporarily impersonate a Japanese magazine a few weeks back.

Re: So this guy is now S3. All of S3

#34

Post by ownagefool »

Nick87633 wrote: post #24
arianvanp wrote: post #8

This is why mastodon , webfinger and ACME uss .well-known uri prefix. .well-known is reserved and you can't e.g. make a bucket named .well-known It's funny the bluesky devs say they implemented "something like webfinger" but left out the only important part of webfinger that protects against these attacks in the first place. Weird oversight and something something don't come up with your own standards

What about serving the challenge file from the root or a near-root of the fully qualified url? Like www.domain.com/mastodon.txt or abc.freehost.com/mastodon.txt? Maybe I'm old but what are some popular use cases for webfinger? (I'm just learning about it now)

Or why not just serve it from www.domain.com/.well-known so we only have one thing to block. :p

Re: So this guy is now S3. All of S3

#35

Post by capableweb »

chrismorgan wrote: post #29
Ciantic wrote: post #5

Solution is also on the works like use /.well-known/, so this is more like funny, rather than a big problem. Key to trick was to have bucket named "xrpc" and store a file there: https://s3.amazonaws.com/xrpc/com.atproto.identity.resolveHa... There is also another funny thing in the image, the user posting about is sending one from "retr0-id.translate.goog", which is odd. Somehow he has got https://retr0-id.translate.…

Eh, it’s worse than just funny; it’s concerning, because they should have known about and easily avoided this kind of vulnerability, it’s standard stuff you have to think about. So what else have they missed?

Wouldn't be funny if it was a public beta that they want people to use for serious stuff. But it's neither serious, a beta or public, but basically a private alpha for playing around, so i'd be a bit lenient on screwups.

Re: So this guy is now S3. All of S3

#36

Post by steveklabnik »

ShadowBanThis01 wrote: post #27
m348e912 wrote: post #21

Earlier quoted context omitted.

If you can upload a custom file to a domain/subdomain, bluesky social (Jack Dorsey's new twitter) uses it to verify you are the owner of the domain. Chaz uploaded his custom file to their Amazon s3 bucket and now since he was the first one to do it, his account is now associated with Amazon S3.

It's ridiculous that this is not in the title.

Hacker News discourages "editorializing" the title, which means there's incentive to repeat what's being linked to exactly.

Most of the time, it's a good thing, but in cases like this is where this falls over.

(You can also see this in the other direction parent comment, for what it's worth, "Jack Dorsey's New Twitter" isn't really accurate, as far as I'm concerned. It is more informative overall, though.)

Re: So this guy is now S3. All of S3

#37

Post by arianvanp »

Nick87633 wrote: post #24
arianvanp wrote: post #8

This is why mastodon , webfinger and ACME uss .well-known uri prefix. .well-known is reserved and you can't e.g. make a bucket named .well-known It's funny the bluesky devs say they implemented "something like webfinger" but left out the only important part of webfinger that protects against these attacks in the first place. Weird oversight and something something don't come up with your own standards

What about serving the challenge file from the root or a near-root of the fully qualified url? Like www.domain.com/mastodon.txt or abc.freehost.com/mastodon.txt? Maybe I'm old but what are some popular use cases for webfinger? (I'm just learning about it now)

That is basically the idea of .well-known

Webfinger is when you want to multiplex multiple identities on a single domain

E.g. https://example.com/.well-known/webfinger?resource=nick@exam...

Will serve the challenge proving your handle is @nick@example.com

Re: So this guy is now S3. All of S3

#38

Post by YtvwlD »

steveklabnik wrote: post #33
chrismorgan wrote: post #29

Earlier quoted context omitted.

Eh, it’s worse than just funny; it’s concerning, because they should have known about and easily avoided this kind of vulnerability, it’s standard stuff you have to think about. So what else have they missed?

This is a private beta. Nobody is suggesting that any of this be used for anything serious just yet. Development happens out in the open, you can go find out what else they've missed by doing the work, or by waiting until others you trust have done so. I myself have had an account for like a month now, but only started really using it a week ago, because that calculus changed for me, personally. Like, it's not even p…

Okay, yes, but this indicates that they didn't read the ActivityPub before developing their own new shiny protocol.

Re: So this guy is now S3. All of S3

#40

Post by chrismorgan »

Nick87633 wrote: post #24
arianvanp wrote: post #8

This is why mastodon , webfinger and ACME uss .well-known uri prefix. .well-known is reserved and you can't e.g. make a bucket named .well-known It's funny the bluesky devs say they implemented "something like webfinger" but left out the only important part of webfinger that protects against these attacks in the first place. Weird oversight and something something don't come up with your own standards

What about serving the challenge file from the root or a near-root of the fully qualified url? Like www.domain.com/mastodon.txt or abc.freehost.com/mastodon.txt? Maybe I'm old but what are some popular use cases for webfinger? (I'm just learning about it now)

The /.well-known/ path prefix is the standard name to use (https://www.rfc-editor.org/rfc/rfc8615) so that any sort of “we’ll host user content from our domain” thing can block it. (Hosting user content from the user’s domain is fine and doesn’t need this restriction.)

A few things are effectively grandfathered in due to their vintage: /favicon.ico, /sitemap.xml and /robots.txt are the three that occur to me—so if you’re running something vaguely like S3, you’ll want to make sure users can’t create files at the top level of your domain matching at least those names.

But nothing new should use anything other than /.well-known/ for domain-scoped stuff, or else you run into exactly this problem.

Post reply on HN