Earlier quoted context omitted.
Yes, port it to Google voice.
I think that costs $20.
Whatever the cost is, it's one time. I ported a number to Google Voice in 2016 and haven't paid a dime for it since then.
We spent $20 to achieve RCE and accidentally became the admins of .mobi
301–310 of 391 posts
Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi
#302I have the feeling that any day now I’m gonna wake up in the morning and I’ll find out that there just isn’t internet anymore because somebody did something from a hotel room in the middle of nowhere with a raspberry pi connected to a wifi hotspot of a nearby coffee shop.
even worse, the raspberry pi, tripped, fell, and burst into flames for no good reason.
[flagged]
Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi
#303Earlier quoted context omitted.
What if you need to stop paying for a phone bill entirely though? Maybe you're living paycheck to paycheck and money is just too tight this month. That's what I think GP was talking about. Is it possible to "park" your phone number until you can start a new plan?
Yes, port it to Google voice.
Its Google. They can kill any services with no reason
Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi
#304Earlier quoted context omitted.
Do you have any references/examples of this?
tons rapid7 for example use LLMs to analyze code and identify vulnerabilities such as SQL injection, XSS, and buffer overflows. Their platform can also identify vulnerabilities in third-party libraries and frameworks from what i can see
[flagged]
Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi
#305Earlier quoted context omitted.
I think one reason is that a subdomain of github.com (like username.github.com) might be able to read and set cookies that are shared with the main github.com domain. There are ways to control this but using a different domain (github.io is the one I'm familiar with) creates wider separation and probably helps reduce mistakes. I read about this a while back but I can't find the link anymore (and it's not the same one…
client browsers have no "idea" of subdomains, either. if i have example.com login saved, and also a one.example.com and a two.example.com, a lot of my browsers and plugins will get weird about wanting to save that two.example.com login as a separate entity. I run ~4 domains so i use a lot of subdomains, and the root domain (example.com) now has dozens of passwords saved. I stand up a new service on three.example.com…
> client browsers have no "idea" of subdomains, either.
They have. That's why PSL list exists. It applies to all CSP rules.
> if i have example.com login saved,
It's the passsword wallet thing. It uses different rules and have no standards
Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi
#306Pretty horrible negligence on the part of .mobi to leave a domain like this to expire.
Can't agree entirely. It's negligent, sure, but the negligent part wasn't letting it expire.
The negligent part was not holding the domain with an error result for 10 years and respond to every request with an email telling them to stop using that domain. And I say 10 years because 10 years of having a broken system is already way too long to not go addressing, no matter how sluggish the service underneath.
You can not be expected to cover your own ass for OTHER people's fuckups into perpetuity. Every system issuing an whois to a supposed dead domain should be considered the actual responsible party for this.
Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi
#307The article puts the blame on > Never Update, Auto-Updates And Change Are Bad as the source of the problem a couple of times. This is pretty common take from security professionals, and I wish they'd also call out the other side of the equation: organizations bundling their "feature" (i.e. enshittification) updates and security updates together. "Always keep your programs updated" is just not feasible advice anymore…
[flagged]
Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi
#308[flagged]
Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi
#309Obviously there are a lot of errors by a lot of people that led to this, but here's one that would've prevented this specific exploit: > As part of our research, we discovered that a few years ago the WHOIS server for the .MOBI TLD migrated from whois.dotmobiregistry.net to whois.nic.mobi – and the dotmobiregistry.net domain had been left to expire seemingly in December 2023. Never ever ever ever let a domain expire.…
I like the point you are making in this post. It makes me think about the Backblaze blog posts where they discuss the likelihood of enough drive failures to lose user data. Then, they decided the calculation result hardly matters, because people are more likely to forget to pay due to an expired credit card or email spam filtering (missed renewal reminders!). How do mega corps remember to pay their domain bills? Do t…
Services like https://www.markmonitor.com/ sort this out. Notice that google.com is registered with them.
Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi
#310Earlier quoted context omitted.
Not true. If you are hosting user content, you want their content on a completely separate domain, not a subdomain. This is why github uses githubusercontent.com. https://github.blog/engineering/githubs-csp-journey/
interesting, why is this?
Also subdomains could set cookies on parent domains. Also causes a security problem between sibling domains.
I presume this issue has been reduced over the years by browsers as part of the third-party cookies denial fixes...?
Definitely was a bad security problem.