Conversation

Notices

1.  (mint@ryona.agency)'s status on Saturday, 27-May-2023 05:13:40 JST 
   Homework for tonight: make a CSP for bloat.
   •  (mint@ryona.agency)'s status on Saturday, 27-May-2023 05:17:34 JST 

     in reply to
     This works, but there's a bunch of unsafe inlines in FSE/Agency's bloat that need to be taken care of, e.g. profile banners.
     default-src 'none'; frame-src 'self'; connect-src 'self'; img-src http: https:; media-src http: https:; style-src https://ybloat.ryona.agency/static/style.css; script-src https://ybloat.ryona.agency/static/fluoride.js
   •  (mint@ryona.agency)'s status on Saturday, 27-May-2023 06:27:16 JST 

     in reply to
     https://gitgud.io/mintplg/bloat/-/commit/0c2c9598913c138042426907fb6a99689ad09642
     Also removed the ability to insert custom CSS, since it interferes with CSP as well. Use Stylus or something.
   •  (mint@ryona.agency)'s status on Saturday, 27-May-2023 06:29:42 JST 

     in reply to

     • Tadano ❄️🎅
     @Tadano Nah, too much effort.
   • Tadano ❄️🎅 (tadano@amala.schwartzwelt.xyz)'s status on Saturday, 27-May-2023 06:29:43 JST Tadano ❄️🎅

     in reply to
     @mint also emoji reactions
   •  (mint@ryona.agency)'s status on Saturday, 27-May-2023 06:37:43 JST 

     in reply to

     • Moon
     • :blank:
     @i @Moon The initial patch for profile banners is a custom one backported from FSE's version, I think vanilla version doesn't have them, so you could skip the patching and just add the headers in nginx.
   • :blank: (i@declin.eu)'s status on Saturday, 27-May-2023 06:37:44 JST :blank:

     in reply to

     • Moon
     @mint cc @Moon since you said bloat was the only thing left todo
   •  (mint@ryona.agency)'s status on Saturday, 27-May-2023 07:27:29 JST 

     in reply to

     • CrunkLord420
     @crunklord420 No, it's just my bloat installation that I've finally got around to harden amidst the XSS craze.
   • CrunkLord420 (crunklord420@rdrama.cc)'s status on Saturday, 27-May-2023 07:27:30 JST CrunkLord420

     in reply to
     @mint so are people following up with that domain?
   • CrunkLord420 (crunklord420@rdrama.cc)'s status on Saturday, 27-May-2023 07:28:48 JST CrunkLord420

     in reply to
     @mint naw I mean anyone, no one is following up with the exfiltration domain?
      likes this.
   •  (mint@ryona.agency)'s status on Saturday, 27-May-2023 07:31:03 JST 

     in reply to

     • CrunkLord420
     @crunklord420 Ah. Doesn't seem to be active, connection is timing out right now. It might not have been an actual instance/relay to begin with, it's not in my peerlist and fedilist haven't detected it either.