Earlier quoted context omitted.
The thing where IP 10.20.30.40‡ is in the DNS for thing.mycorp.example and later nobody cares about thing.mycorp.example and they give up control without removing the DNS entry - is why you can't get Let's Encrypt certificates by just running a HTTPS web server and you need either plain HTTP, a custom TLS server (it can also do HTTPS but it needs to know about ACME as well) or else DNS. Lots of bulk hosts will let yo…
That’s not really what the issue with the tls-sni challenge was. How that challenge worked was that the CA would give you a certificate for a fictitious name (say, abc123.acme-challenge.invalid) and you had to present it from the host when asked for that name by the client (the CA) though SNI. Many hosts that share IPs between customers also let those customers upload their own certificates. The attack just involved…
A Gov.uk site dedicated to porn?
81–90 of 93 posts
Re: A Gov.uk site dedicated to porn?
#82Earlier quoted context omitted.
Only if power is free
and bandwidth. and physical space, and the ability to stay isolated from physical conditions like floods (natural or plumbing-related) or power outages caused by somebody trying to plug in a kettle. running a commercial VPS in a datacenter has a ton of advantages, but i'm guessing that the guy with a footer like this doesn't really care about them. running your website off a raspi in your living room is cool, wheher…
I almost hate myself for writing this - but any given AWS AZ has had more outages/ performance degradations/service interuptions over the past ~5years than my home internet/electricity... and with an unmetered connection with a 200mbps+ uplink, how much more do I really need for a personal page?
Maybe a raspberry pi behind my sofa isn't so stupid?
Of course you could use multi-cloud/multi-azs, but do you really WANT to for a personal website?
Re: A Gov.uk site dedicated to porn?
#83Earlier quoted context omitted.
and bandwidth. and physical space, and the ability to stay isolated from physical conditions like floods (natural or plumbing-related) or power outages caused by somebody trying to plug in a kettle. running a commercial VPS in a datacenter has a ton of advantages, but i'm guessing that the guy with a footer like this doesn't really care about them. running your website off a raspi in your living room is cool, wheher…
I almost hate myself for writing this - but any given AWS AZ has had more outages/ performance degradations/service interuptions over the past ~5years than my home internet/electricity... and with an unmetered connection with a 200mbps+ uplink, how much more do I really need for a personal page? Maybe a raspberry pi behind my sofa isn't so stupid? Of course you could use multi-cloud/multi-azs, but do you really WANT…
Maybe I'm just unlucky, but I live in a Canadian city with pretty stable internet and since I moved 6mo ago (we won't count moving-related downtime) I've had at least a 1hr power outage and 3hrs of internet-related downtime.
I can't remember the last time my little nano server in US-West-2 has been down.
Re: A Gov.uk site dedicated to porn?
#84Wow. I thought this was going to be about some sneaky exploit where they'd manage to get a gov.uk to forward links to porn or something. But no, it's really a whole subdomain just taken over by some sketchy porn site. I'm wondering if the porn site operators even know it's happening? Seems the most likely thing is the DfT had a site at that URL, hosted on AWS. And then they shut it down without removing the DNS recor…
I thought this was going to be about a new government website that all UK porn viewers are required to register with. I feel like I've seen a number of threads about that being imminent.
Re: A Gov.uk site dedicated to porn?
#85Earlier quoted context omitted.
> After 6 months your Rpi4 will be costing less than the VPS. No, $10 per year, not per month. That means the rPi payback is 5-6 years, and for inferior hardware and bandwidth.
You and I clearly have different expectations for "a decent VPS"... (I have a "One time cost access forever!" VPS, which varies me $9/year "maintenance fees", which I'm happy enough with for the money, but it's definitely "Useful for the price" rather than "decent".)
Have a look at some of the providers I mention below. I’m not sure who you’re referring to above, but as with all things, it’s a spectrum. Plenty of garbage at that price point, but also some gems.
Re: A Gov.uk site dedicated to porn?
#86Earlier quoted context omitted.
I believe scenario #3 would be as follows: 1. gov.uk’s DNS server used to point charts.dft.gov.uk to something legitimate 2. Someone hacked gov.uk’s DNS server, and changed this one specific domain to CNAME charts.dft.gov.uk.s3-website-eu-west-1.amazonaws.com 3. That same someone set up their porn thing at AWS in a bucket that maps to charts.dft.gov.uk.s3-website-eu-west-1.amazonaws.com
But why such a specific bucket name? Perhaps the perpetrator did it because he knows how the gov.uk DNS is maintained, but then it would be an inside job. If only the process were as tight and clean as in peppa pig land!
I think it is required to name the bucket after the domain name if you want to use it to host static web content: https://docs.aws.amazon.com/AmazonS3/latest/userguide/websit...
Re: A Gov.uk site dedicated to porn?
#87Earlier quoted context omitted.
> I get the allure of hosting something in your home, but these days when you can get a decent VPS for $10/yr it doesn’t really make sense When you're hosting static content (like presumably this content is; it's down so I can't say for sure), you should distribute it on a CDN for $0/year. A single VPS can be overwhelmed by traffic just as your Raspberry Pi can.
Why doesn't it make sense? After 6 months your Rpi4 will be costing less than the VPS. Plus you get the fun of actually doing it. P.S. Getting weird RPi errors because of power supply makes you appreciate the value proposition of a good VPS :p
> Why doesn't it make sense? After 6 months your Rpi4 will be costing less than the VPS. Plus you get the fun of actually doing it.
It doesn't make sense because the Raspberry Pi will not be able to serve traffic that one time when your post hits top of HN, which is the one time you really need your hosting plan to work. Yes, it can serve traffic that 99% of time when almost nobody visits your website, but if we look at % of requests served over the timespan of a year, we will see that the website was down for like 95% of users because of that 1 day of downtime.
Re: A Gov.uk site dedicated to porn?
#88I’m only disappointed that the squatting site didn’t conform to GDS’s GOV.UK Design System.
Re: A Gov.uk site dedicated to porn?
#89Earlier quoted context omitted.
The thing where IP 10.20.30.40‡ is in the DNS for thing.mycorp.example and later nobody cares about thing.mycorp.example and they give up control without removing the DNS entry - is why you can't get Let's Encrypt certificates by just running a HTTPS web server and you need either plain HTTP, a custom TLS server (it can also do HTTPS but it needs to know about ACME as well) or else DNS. Lots of bulk hosts will let yo…
That’s not really what the issue with the tls-sni challenge was. How that challenge worked was that the CA would give you a certificate for a fictitious name (say, abc123.acme-challenge.invalid) and you had to present it from the host when asked for that name by the client (the CA) though SNI. Many hosts that share IPs between customers also let those customers upload their own certificates. The attack just involved…
Two things, firstly I wasn't (though I can see why you'd think so) talking about tls-sni-01 but about the original intent to deploy http-01 challenges for HTTPS.
Secondly it requires not merely a misconfiguration but a bug, a bug which is so widespread it was pointless to pretend it would get fixed in the foreseeable future. When you receive SNI for foo.bar.example and you understand SNI but don't have a foo.bar.example TLS provides an explicit error case for that. Servers like Apache httpd don't (or at least didn't) bother implementing this, and instead give you a default site and this enables the hijack. You should still be able to find when this was discovered in the ACME list.
Re: A Gov.uk site dedicated to porn?
#90The site in question is charts.dft.gov.uk (VERY NSFW). It resolves to the CNAME charts.dft.gov.uk.s3-website-eu-west-1.amazonaws.com, which is quite clearly hosting a porn site of some kind. I suppose there's a few possible explanations here: (1) the original site was hosted on S3, and at some point the bucket was dropped and someone else picked it up, (2) it was originally hosted on S3 and the bucket got hacked, (3)…
I followed few links there and it’s not even a porn site, it just a shallow catalogue of {img-ahref -> img-ahref} which tricks you into “/dating.html” which redirects to some “dating” site. Probably just a SEO bs.