Mastadon has no chance if every time something becomes a little bit viral it's instance dies over the traffic.
So this guy is now S3. All of S3
91–100 of 522 posts
Re: So this guy is now S3. All of S3
#92This is a terrible implementation of domain verification. dns-01 and http-01 are more or less standardized at this point. Use them, and don't roll your own. Reference: https://letsencrypt.org/docs/challenge-types/ .
I don't get http-based verification in general. If you want to really prove someone owns a domain, make them change an authoritative DNS record. Everything else feels like it is begging for edge cases to crop up. Why should my social media or SSL certificate vendor care about my web servers?
I worked on a product that required DNS changes to set up. Especially for business accounts, the level of friction was STUNNING. We had it take months to get set up because the contact had to submit a ticket to IT, write up the business justification, get director level approval, get security approval, and so on before it could get done. We had customers who couldn't even figure out which group in their company managed DNS. Yeah, you can argue that those companies are broken, but as an outsider I have no influence over that. The result was just that they couldn't use our product. On the flip side, we had consumer and small business customers who had purchased domains through simple webhosting things that didn't give them the required level of access to create a record (and/or they couldn't figure out how to do it). We eventually added an HTTP option and the success rate and time to success both improved hugely.
Re: So this guy is now S3. All of S3
#93> 429 Too Many Requests Aight, level with me: Is every mastodon server running on a Raspberry Pi?
No trouble viewing it from another Mastodon server: https://hachyderm.io/@jonty@chaos.social/110307532115312279 EDIT: Ah I guess if you're not logged into a hachyderm.io account, you get forwarded. So probably don't use the above link.
That just redirected me to too many requests.
Re: So this guy is now S3. All of S3
#94> 429 Too Many Requests Aight, level with me: Is every mastodon server running on a Raspberry Pi?
No trouble viewing it from another Mastodon server: https://hachyderm.io/@jonty@chaos.social/110307532115312279 EDIT: Ah I guess if you're not logged into a hachyderm.io account, you get forwarded. So probably don't use the above link.
[deleted]
Re: So this guy is now S3. All of S3
#95Earlier quoted context omitted.
I think this is not about using s3 to serve files, but someone having verified owning s3 on bsky by putting some challenge file in his bucket. My guess, also missing context.
That is correct. 1. Bluesky allows you to use a domain as a handle by creating a TXT record on an _atproto subdomain of the domain you wish to use (see https://mxtoolbox.com/SuperTool.aspx?action=txt%3a_atproto.s... for mine) 2. You can also serve up your DID by having the URL " /xprc/com.atproto.identity.resolveHandle" rel="nofollow">https:// /xprc/com.atproto.identity.resolveHandle " return the DID. 3. AWS buckets…
Sounds like Bluesky screwed up by not implementing the https://publicsuffix.org/ list
Re: So this guy is now S3. All of S3
#96Earlier quoted context omitted.
I don't get http-based verification in general. If you want to really prove someone owns a domain, make them change an authoritative DNS record. Everything else feels like it is begging for edge cases to crop up. Why should my social media or SSL certificate vendor care about my web servers?
I worked on a product that required DNS changes to set up. Especially for business accounts, the level of friction was STUNNING. We had it take months to get set up because the contact had to submit a ticket to IT, write up the business justification, get director level approval, get security approval, and so on before it could get done. We had customers who couldn't even figure out which group in their company manag…
Especially for business accounts, the level of friction was STUNNING.
Honestly, that's a feature, not a bug.
Re: So this guy is now S3. All of S3
#97bluesky dev here. whoops. as others mentioned, not a hard fix.
What is the easy fix? Use the .well-known/ standard instead of the current mechanisms, and roll back verification for anyone who’s already been verified with the flawed approach?
Re: So this guy is now S3. All of S3
#98Earlier quoted context omitted.
Maybe, but the admin commented it was intentional for that specific post, it was slowing down the entire site.
> slowing down the entire site This is mind-blowing. Last I checked, the front page of HN sends tens of requests per second to each link. There are humans who can pack envelopes faster than the typical mastodon server can answer GETs. I'd love to see someone benchmark the top servers for a few seconds to see what it takes to break a reasonable latency SLA.
It has been 20+ years since slashdotting with the requisite hardware and connection upgrades and still things fall over.
Re: So this guy is now S3. All of S3
#99Earlier quoted context omitted.
It is surely easy to cast stones at a single bug, but I don't think that's the right way to look at things.
I wouldn’t have made my remark if this would just be a bug, though. We’re looking at a bespoke domain ownership verification mechanism that doesn’t handle its primary usecase well, failing at something solved in lots of different ways over the past decades . I have written atrocious bugs over the years, so I’m definitely not in the stone casting business here. However, I can’t see this as simply a bug, rather than a…
> We’re looking at a bespoke domain ownership verification mechanism that doesn’t handle its primary usecase well
Okay this is exactly what I mean. How well do you know the AT Protocol? Because this comment seems to indicate you just learned about it from this link, yet you're still making grand claims like this.
This method of validating your identity isn't the primary one. It's not even documented! It was added two weeks ago, as an API endpoint to help serve moderation and administrative needs. Turns out the URL structure of the rest of the API is a bad call for this endpoint.
> and attempting to fill a sensitive niche,
If you want to criticize AT Protocol on privacy issues, there are far more important things that are closer to the fundamental aspect of the design to criticize.
Re: So this guy is now S3. All of S3
#100Earlier quoted context omitted.
Maybe, but the admin commented it was intentional for that specific post, it was slowing down the entire site.
> slowing down the entire site This is mind-blowing. Last I checked, the front page of HN sends tens of requests per second to each link. There are humans who can pack envelopes faster than the typical mastodon server can answer GETs. I'd love to see someone benchmark the top servers for a few seconds to see what it takes to break a reasonable latency SLA.
Clearly they're not microservicing hard enough.