Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

So this guy is now S3. All of S3

chaos.social

Post reply on HN
Print view View original

351–360 of 522 posts

Re: So this guy is now S3. All of S3

#351

Post by account42 »

mtae wrote: post #133
bisby wrote: post #115

Earlier quoted context omitted.

"We'll build our own validation instead of using one of the existing standards that make perfect sense." is not just "a single bug". It's a flaw in architecture. A PR of "Change external domain validation to use .well-known (or DNS01, etc)" is not a "bugfix"

okay so clearly you don't know what you're talking about because they do use existing standards/DNS as the primary way to validate domain ownership. It's free to not say anything and read the comments first before going off about something!

With any kind of authentication when you have an insecure method it does not mather whether you also have a more secure method - your authentication is only as good as the weakest alternative.

Re: So this guy is now S3. All of S3

#352

Post by ShadowBanThis01 »

runnerup wrote: post #75
olddustytrail wrote: post #65

Earlier quoted context omitted.

You got all that from a "429 Too Many Requests". That's an impressive level of deduction Holmes!

Hahahahah. Try https://media.discordapp.net/attachments/1043284184698994700... to see what the conversation is about!

Nah. The responses to your comment saved us the time.

Re: So this guy is now S3. All of S3

#353

Post by smcl »

lakomen wrote: post #346
smcl wrote: post #330

Last night I opened this, saw the HTTP 429 and figured "ah too many requests, I'll check the comments and try in the morning". The comments were all people swooning in shock about why some non-specific they (S3? Amazon? Someone else?) didn't use ".well-known" and others complaining about Mastodon and/or the fediverse. I had to read multiple comments to piece together the story, I swear it was like Elden Ring[0]. What…

[flagged]

Someone on one server trying to get a user on another server is maybe a bit much, but I don't know the content of the posts in question. For me it'd have to be something pretty extreme to take those actions, otherwise if I saw something that irritated me I'd just consider ignoring or blocking that person depending on the severity.

Remember though that the war is a pretty delicate subject and that a position that from your perspective seems perfectly peaceful could be seen differently by others. So to a German the message "no weapons to Ukraine!" could be seen as de-escalatory, but to a Ukrainian it could be seen as a betrayal or it may remind them of bad faith pro-Z/Putin trolling even if that doesn't describe you or your intent whatsoever.

Re: So this guy is now S3. All of S3

#354

Post by growt »

JdeBP wrote: post #189

Things to learn about the FediVerse from the 429 error: * The FediVerse is lots of WWW sites. Some are WWW-hosting companies showing off, with all of the acoutrements of high-end WWW sites, including CloudFlare protection and lots of tweaking of the back end stuff. Others are one-person sites where someone has just set up the vanilla Mastodon/Pleroma/Pixelfed/Friendica/whatever software on a cheap hosted VM somewhere…

Thank you for the explanation, that actually makes sense. But I still think that serving a 429 is some kind of backwards old-school sysop kind of response. "It's the right HTTP-Code! hohoho!". It's obviously running nginx and serving a static copy of that url or setting up caching would take the same amount of time as serving the 429. It's 2023, it's possible to serve some thousand requests to static content on pretty much everything now.

Re: So this guy is now S3. All of S3

#355

Post by bambax »

smcl wrote: post #330

Last night I opened this, saw the HTTP 429 and figured "ah too many requests, I'll check the comments and try in the morning". The comments were all people swooning in shock about why some non-specific they (S3? Amazon? Someone else?) didn't use ".well-known" and others complaining about Mastodon and/or the fediverse. I had to read multiple comments to piece together the story, I swear it was like Elden Ring[0]. What…

Aaaah! Thanks! Great write up!!

Re: So this guy is now S3. All of S3

#356

Post by mongol »

bradfitz wrote: post #211

Here's the original email where I proposed .well-known: https://mailarchive.ietf.org/arch/msg/apps-discuss/1_a06NU8z... > 1) I feel that /host-meta is too casual of a name and prone to collisions. It matches /^[\w\-]+$/, which I think is a subset of a fair number of sites' usernames." ... > i.e. put something ugly and weird in there, like a semicolon, to minimize the chance that it interferes with people's existing U…

This proposal made complete sense and the counter argument was of such a tiring kind. I see that from time to time in these old standards mail threads. I can't put my finger on it, but perhaps it is that they only saw the "now", not the future. Where the "now" was time when a webmaster were in charge of every website, and had complete personal control.

Re: So this guy is now S3. All of S3

#357

Post by ohgodplsno »

hayleox wrote: post #294
pyentropy wrote: post #26

Earlier quoted context omitted.

Further context: Bluesky lets you use a domain name you own as a user handle. The official method is to set a TXT record, but apparently their "AT protocol" also lets you confirm a domain by serving `GET your.domainname.com/xrpc/com.atproto.identity.resolveHandle` and `xrpc` was available as an S3 bucket name :)

Yikes, why didn't they use a /.well-known/ address instead of inventing a new directory? This is entirely on Bluesky, not AWS.

Because tech bros always believe they have a better solution than battle tested standards.

Re: So this guy is now S3. All of S3

#358

Post by dspillett »

lakomen wrote: post #346
smcl wrote: post #330

Last night I opened this, saw the HTTP 429 and figured "ah too many requests, I'll check the comments and try in the morning". The comments were all people swooning in shock about why some non-specific they (S3? Amazon? Someone else?) didn't use ".well-known" and others complaining about Mastodon and/or the fediverse. I had to read multiple comments to piece together the story, I swear it was like Elden Ring[0]. What…

[flagged]

> They should've picked a proper language that's able to perform and handle those requests like Go or Rust. Building a social network, especially distributed, and using a low performance language... what were they thinking?

Even if a Go or Rust variant of exactly the same implementation would have been two or three times faster, it would not have survived the same onslaught. The way to survive that sort of accidental DDoS is not to change language but to improve algorithm choices where possible (where that makes a difference in order, not just a small difference in scale), make sure you are scaling efficiently over the CPU cores (possible in all those languages in various ways) available per node without busting memory limits, and by scaling out once that becomes a limiting factor.

This was effectively a DDoS situation (not an attack, but from the server's PoV there is no difference between a malicious DDoS and a hug-of-death from a mass of interested parties) and using Go or Rust instead of Ruby would likely have made no difference what so ever.

(the rest of your post is not discussing technical matters pertaining to the rest of the thread so I'll not encourage the off-topic-mess by responding in any detail, other than to say that sort of complaint wrt handling potentially contentious issues is common on social networks and not Mastodon specific)

Re: So this guy is now S3. All of S3

#359

Post by dspillett »

smcl wrote: post #330

Last night I opened this, saw the HTTP 429 and figured "ah too many requests, I'll check the comments and try in the morning". The comments were all people swooning in shock about why some non-specific they (S3? Amazon? Someone else?) didn't use ".well-known" and others complaining about Mastodon and/or the fediverse. I had to read multiple comments to piece together the story, I swear it was like Elden Ring[0]. What…

> However that "somewhere" was just a location one of the devs at BlueSky chose, rather than somewhere relatively standardised, like under the ".well-known" path

I've not looked into BlueSky's domain based identity thing in any detail so I might be missing a point somewhere, but… If someone can manipulate its special location what would there be to stop the same someone being able to manipulate content under .well-known?

Are we just relying on .well-known having some extra protection (in this case by Amazon having created a bucket called .well-known so no one else could)? If so then .well-known is little safer than any other arbitrary location in this respect (because you are relying on every domain owner who might be spoofed to take an action to protect against this, rather than the protocol failing safe if nothing is done by the domain owner) and perhaps using DNS would be better.

Re: So this guy is now S3. All of S3

#360

Post by mal-2 »

mook wrote: post #327
seba_dos1 wrote: post #248

Earlier quoted context omitted.

They redirect you if you aren't logged in so you can't use them as an anonymous proxy. If you're logged in on your homeserver, you'll get that server's view of the post.

Could you expand on why being an anonymous proxy would be an issue in this case? I can't think of anything interesting off the top of my head. You can't post (because you're not logged in), so there's no issues with moderation. The toot is already federated publically, so there's no issues with unintentional read access. It doesn't need to contact the original server, so there shouldn't be any load/DDoS issues. I mus…

I produced those links by finding the post on each server so I was also surprised that they redirect when accessed directly. I mean it showed me the post without being logged in, and then I copied what was in the URL bar. Given how much browsing is available without being logged in I agree this should be fine if it loaded normally.
Post reply on HN