[deleted]
A Gov.uk site dedicated to porn?
61–70 of 93 posts
Re: A Gov.uk site dedicated to porn?
#62Sub-domain takeover attack. The sub-domain was CNAME'ed to a S3 bucket and the S3 bucket had likely been deleted. The porn purveyor, re-created a new S3 bucket with pr0n.
A scanner that would have caught the vulnerability: https://tech.ovoenergy.com/how-we-prevented-subdomain-takeov...
Or a grey hat scanner for finding sub-domains vulnerable to takeover: https://github.com/m4ll0k/takeover
Re: A Gov.uk site dedicated to porn?
#63> This site is hosted on a Raspberry Pi 4B in the author's living room (behind the couch). Holding up quite well despite HN frontpage. I love what a bit of caching can do. EDIT: appears I jinxed it. I get the allure of hosting something in your home, but these days when you can get a decent VPS for $10/yr it doesn’t really make sense.
> I get the allure of hosting something in your home, but these days when you can get a decent VPS for $10/yr it doesn’t really make sense When you're hosting static content (like presumably this content is; it's down so I can't say for sure), you should distribute it on a CDN for $0/year. A single VPS can be overwhelmed by traffic just as your Raspberry Pi can.
Why doesn't it make sense?
After 6 months your Rpi4 will be costing less than the VPS.
Plus you get the fun of actually doing it.
P.S. Getting weird RPi errors because of power supply makes you appreciate the value proposition of a good VPS :p
Re: A Gov.uk site dedicated to porn?
#64Earlier quoted context omitted.
I don't think it was #3: Amazon owns and resolves it for amazonaws.com. If you could hack that, you could do much more serious damage. I'm assuming it's #1. Bucket names are global.
I believe scenario #3 would be as follows: 1. gov.uk’s DNS server used to point charts.dft.gov.uk to something legitimate 2. Someone hacked gov.uk’s DNS server, and changed this one specific domain to CNAME charts.dft.gov.uk.s3-website-eu-west-1.amazonaws.com 3. That same someone set up their porn thing at AWS in a bucket that maps to charts.dft.gov.uk.s3-website-eu-west-1.amazonaws.com
But why such a specific bucket name? Perhaps the perpetrator did it because he knows how the gov.uk DNS is maintained, but then it would be an inside job. If only the process were as tight and clean as in peppa pig land!
Re: A Gov.uk site dedicated to porn?
#65British Government Porn? That the one where we all get screwed by Rishi in the budget?
I've seen that one, it's a bit too sadomasochistic for my taste.
Re: A Gov.uk site dedicated to porn?
#66Earlier quoted context omitted.
> I get the allure of hosting something in your home, but these days when you can get a decent VPS for $10/yr it doesn’t really make sense When you're hosting static content (like presumably this content is; it's down so I can't say for sure), you should distribute it on a CDN for $0/year. A single VPS can be overwhelmed by traffic just as your Raspberry Pi can.
Why doesn't it make sense? After 6 months your Rpi4 will be costing less than the VPS. Plus you get the fun of actually doing it. P.S. Getting weird RPi errors because of power supply makes you appreciate the value proposition of a good VPS :p
Only if power is free
Re: A Gov.uk site dedicated to porn?
#67Re: A Gov.uk site dedicated to porn?
#68Earlier quoted context omitted.
The thing where IP 10.20.30.40‡ is in the DNS for thing.mycorp.example and later nobody cares about thing.mycorp.example and they give up control without removing the DNS entry - is why you can't get Let's Encrypt certificates by just running a HTTPS web server and you need either plain HTTP, a custom TLS server (it can also do HTTPS but it needs to know about ACME as well) or else DNS. Lots of bulk hosts will let yo…
> ‡ 10.20.30.40 isn't a real public address it's just for example purposes here There’s an RFC for that :) https://datatracker.ietf.org/doc/html/rfc5737
They’re not particularly memorable. I have already forgotten 2/3 just aftee closing the rfc.
Re: A Gov.uk site dedicated to porn?
#69Earlier quoted context omitted.
> I get the allure of hosting something in your home, but these days when you can get a decent VPS for $10/yr it doesn’t really make sense When you're hosting static content (like presumably this content is; it's down so I can't say for sure), you should distribute it on a CDN for $0/year. A single VPS can be overwhelmed by traffic just as your Raspberry Pi can.
Why doesn't it make sense? After 6 months your Rpi4 will be costing less than the VPS. Plus you get the fun of actually doing it. P.S. Getting weird RPi errors because of power supply makes you appreciate the value proposition of a good VPS :p
> After 6 months your Rpi4 will be costing less than the VPS.
No, $10 per year, not per month. That means the rPi payback is 5-6 years, and for inferior hardware and bandwidth.
Re: A Gov.uk site dedicated to porn?
#70Earlier quoted context omitted.
> I get the allure of hosting something in your home, but these days when you can get a decent VPS for $10/yr it doesn’t really make sense When you're hosting static content (like presumably this content is; it's down so I can't say for sure), you should distribute it on a CDN for $0/year. A single VPS can be overwhelmed by traffic just as your Raspberry Pi can.
Why doesn't it make sense? After 6 months your Rpi4 will be costing less than the VPS. Plus you get the fun of actually doing it. P.S. Getting weird RPi errors because of power supply makes you appreciate the value proposition of a good VPS :p
BuyVM, RamNode, FDC, Virmach (probably in that order).