So this guy is now S3. All of S3

#1

Post by aendruk » Thu, May 04, 2023, 6:54 PM UTC

So this guy is now S3. All of S3
chaos.social

Re: So this guy is now S3. All of S3

#2

Post by Pxtl » Thu, May 04, 2023, 7:01 PM UTC

I mean I think you could also do this on Mastodon but it would just show a "verified" highlight for amazon s3 in your profile, not that it would get verified as your username.

Re: So this guy is now S3. All of S3

#3

Post by sidmitra » Thu, May 04, 2023, 7:03 PM UTC

For those not getting the context(like me), this seems to be about the Bluesky Social(https://bsky.app/), a twitter alternative.

Re: So this guy is now S3. All of S3

#4

Post by [deleted] » Thu, May 04, 2023, 7:03 PM UTC

[deleted]

Re: So this guy is now S3. All of S3

#5

Post by Ciantic » Thu, May 04, 2023, 7:04 PM UTC

Solution is also on the works like use /.well-known/, so this is more like funny, rather than a big problem.

Key to trick was to have bucket named "xrpc" and store a file there: https://s3.amazonaws.com/xrpc/com.atproto.identity.resolveHa...

There is also another funny thing in the image, the user posting about is sending one from "retr0-id.translate.goog", which is odd. Somehow he has got https://retr0-id.translate.goog/xrpc/com.atproto.identity.re... to redirect to his page, and gotten that handle as well.

Re: So this guy is now S3. All of S3

#6

Post by ShamelessC » Thu, May 04, 2023, 7:04 PM UTC

[flagged]

Re: So this guy is now S3. All of S3

#7

Post by alexcroox » Thu, May 04, 2023, 7:05 PM UTC

Unless it's been recently updated their help article only lists TXT record for verification https://blueskyweb.xyz/blog/4-28-2023-domain-handle-tutorial

Re: So this guy is now S3. All of S3

#8

Post by arianvanp » Thu, May 04, 2023, 7:07 PM UTC

This is why mastodon , webfinger and ACME uss .well-known uri prefix. .well-known is reserved and you can't e.g. make a bucket named .well-known

It's funny the bluesky devs say they implemented "something like webfinger" but left out the only important part of webfinger that protects against these attacks in the first place. Weird oversight and something something don't come up with your own standards

Re: So this guy is now S3. All of S3

#9

Post by Nick87633 » Thu, May 04, 2023, 7:08 PM UTC

Seems like the crypto crowd is moving on to creating flaky decentralized twitter clones now

Re: So this guy is now S3. All of S3

#10

Post by grrdotcloud » Thu, May 04, 2023, 7:08 PM UTC

Without understanding all the context, why not just serve files directly from your smartphone? You can approve your own contact list and share keys.

Yes, of course bandwidth is a concern, but then again there should be our way to monetize, and that's entirely possible using direct payments which already exist.

A little bit of cashing, CDN, and your phone as the initial file server. Tag a photo or video has shared.

Really it's just an RSS feed and CDN.