Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

So this guy is now S3. All of S3

chaos.social

Post reply on HN
Print view View original

321–330 of 522 posts

Re: So this guy is now S3. All of S3

#321

Post by [deleted] »

jmccarthy wrote: post #221
bradfitz wrote: post #211

Here's the original email where I proposed .well-known: https://mailarchive.ietf.org/arch/msg/apps-discuss/1_a06NU8z... > 1) I feel that /host-meta is too casual of a name and prone to collisions. It matches /^[\w\-]+$/, which I think is a subset of a fair number of sites' usernames." ... > i.e. put something ugly and weird in there, like a semicolon, to minimize the chance that it interferes with people's existing U…

And later, how the semi became the dot: https://mailarchive.ietf.org/arch/msg/apps-discuss/j6KWTSTVC... Fun bit of history!

[deleted]

Re: So this guy is now S3. All of S3

#322

Post by vidarh »

chrismorgan wrote: post #29
Ciantic wrote: post #5

Solution is also on the works like use /.well-known/, so this is more like funny, rather than a big problem. Key to trick was to have bucket named "xrpc" and store a file there: https://s3.amazonaws.com/xrpc/com.atproto.identity.resolveHa... There is also another funny thing in the image, the user posting about is sending one from "retr0-id.translate.goog", which is odd. Somehow he has got https://retr0-id.translate.…

Eh, it’s worse than just funny; it’s concerning, because they should have known about and easily avoided this kind of vulnerability, it’s standard stuff you have to think about. So what else have they missed?

For me, the worst thing about it is that they didn't just use webfinger. So webfinger isn't perfect, but it's there and in use. When they choose to invent new mechanisms for things there are perfectly serviceable options for, it makes me instantly sceptical of the rest.

Re: So this guy is now S3. All of S3

#323

Post by mariusor »

steveklabnik wrote: post #192
armchairhacker wrote: post #183

Earlier quoted context omitted.

How does Bluesky compare to Mastodon? (Other than letting you register S3 as your user handle)

Here's how I think about it: * ActivityPub -> AT Protocol ( https://atproto.com/ ) * Mastadon -> Bluesky ( https://blueskyweb.xyz/ ) Right now, federation is not turned on for the Bluesky instance. There are differences in both, however. I'm not going to speak about my impressions of the Mastadon vs Bluesky teams because frankly, Mastadon never really caught on with me, so they're probably biased. ('they' being my im…

Steve, it's "Mastodon" like the animal and like the band. It hurts to read 4 paragraphs of good relevant text and cringe every time you misspell the name. :(

Re: So this guy is now S3. All of S3

#324

Post by swexbe »

mal-2 wrote: post #165
shawabawa3 wrote: post #158

Earlier quoted context omitted.

> It looks like these links auto-redirect when I access them from here, but when you access them from the homeserver they are served without redirect "Works on my machine" isn't going to cut it for running a popular social network Nobodies going to go around searching for mirrors, they'll just leave and go back to twitter

[flagged]

If fediverse was going to succeed anywhere it would be on places like HN. The average user doesn't even know what "federation" means.

Re: So this guy is now S3. All of S3

#325

Post by mariusor »

linuxdude314 wrote: post #320
YtvwlD wrote: post #38

Earlier quoted context omitted.

Okay, yes, but this indicates that they didn't read the ActivityPub before developing their own new shiny protocol.

Paul has lots of experience designing protocols. He designed SSB. ActivityPub does a lot of things wrong from first principals. The whole point was to start from scratch.

> ActivityPub does a lot of things wrong from first principals

I'd be curious to learn about those.

Re: So this guy is now S3. All of S3

#326

Post by vidarh »

Aeolun wrote: post #267
jeroenhd wrote: post #59

Earlier quoted context omitted.

The server itself seems to work fine. It only seems to be this specific post that's being 429'd. I'm guessing it's some kind of anti-DDoS setup kicking in. Mastodon is also quite heavy to host, my single user instance will easily gobble up several gigabytes of memory if you let it. There are more efficient ActivityPub servers but specifically Mastodon seems to be written for running efficiently on huge servers.

Or running efficiently never maybe?

It will definitely "never" (barring fairly significant changes) run efficiently, you're right. It's extremely unnecessarily heavy in all kinds of ways that are made in ways that makes it run overall better on a large setup, though. All the instructions are also there to front it by proper caching, but setting it up in a proper resilient way is more effort.

Re: So this guy is now S3. All of S3

#327

Post by mook »

seba_dos1 wrote: post #248
xdennis wrote: post #247

Earlier quoted context omitted.

Okay, I guess I'm not getting it either, but how is it federated/decentralized if they all redirect to the original server which throws a 429?

They redirect you if you aren't logged in so you can't use them as an anonymous proxy. If you're logged in on your homeserver, you'll get that server's view of the post.

Could you expand on why being an anonymous proxy would be an issue in this case? I can't think of anything interesting off the top of my head.

You can't post (because you're not logged in), so there's no issues with moderation. The toot is already federated publically, so there's no issues with unintentional read access. It doesn't need to contact the original server, so there shouldn't be any load/DDoS issues. I must be missing something…

Re: So this guy is now S3. All of S3

#329

Post by berkes »

shawabawa3 wrote: post #154
weglasern wrote: post #81

Earlier quoted context omitted.

Not really: h https://leah.is/posts/scaling-the-mastodon/ They just got 6 times the normal requests: https://chaos.social/@ordnung/110312089838674624

unfortunately this is exactly why mastodon won't work I already don't trust mastodon links because 9 times out of 10 they simply don't work. Everyone's tiny hobby server falls over when one post gets big, and obviously not everyone is going to scale their servers to support the load of a viral post that might happen once every 6 months and will be 100x their base load

When someone finds an annoyance, often even anecdotal, that is no evidence of why "Mastodon (or the fediverse) won't work".

It's an annoyance, often anecdotal at most. Not the foundation of why a platform cannot ever "work".

Re: So this guy is now S3. All of S3

#330

Post by smcl »

Last night I opened this, saw the HTTP 429 and figured "ah too many requests, I'll check the comments and try in the morning". The comments were all people swooning in shock about why some non-specific they (S3? Amazon? Someone else?) didn't use ".well-known" and others complaining about Mastodon and/or the fediverse. I had to read multiple comments to piece together the story, I swear it was like Elden Ring[0].

What this is actually about: BlueSky is Jack Dorsey's new Twitter clone, it is eventually intended to be some sort of fediverse thing but it's not there yet and it's not the source of the fediverse gripes here. You can authenticate your BlueSky user as the owner of a given domain or subdomain by placing a certain file with a given content somewhere under that domain/subdomain. However that "somewhere" was just a location one of the devs at BlueSky chose, rather than somewhere relatively standardised, like under the ".well-known" path (which you might recognise from things like OpenID Connect where the configuration doc is located @ example.com/.well-known/openid-configuration). So one user exploited this and became the "owner" of that Amazon S3 domain by setting up a storage account on Amazon S3 and following BlueSky's setup instructions. That is the main story here - some non-Amazon rando is now officially the Amazon S3 guy on Bluesky.

The next part is that someone posted about it on this https://chaos.social Mastodon instance, which got overwhelmed, the owners decided to save their server by electing to return a 429 response for that specific post if users don't belong to chaos.social, and that is why people are upset about Mastodon.

Interesting story, but I'm not interested in Dorsey's version of Twitter 2.0 unless it actually allows you to signup[1] and brings something compelling that Twitter didn't and Mastodon doesn't.

[0] - game with an intricate story that does its damndest to not actually tell you. If you want to know the story you have to piece it together yourself by picking up dozens of items scattered throughout the game and reading all their descriptions. Or you can do what I did - watch a video on YouTube.

[1] - they're doing an open beta and letting a little trickle of users on, who post about it on their Twitter/Mastodon/whatever. Feels a bit deliberate, like they're trying to build anticipation and frankly I detest little manipulative things like that so I'm out

Post reply on HN