Conversation

Notices

Alex Gleason (alex@gleasonator.com)'s status on Monday, 29-May-2023 05:06:54 JST Alex Gleason

Security is built in layers. Dude the Poast vuln was just BARELY able to work. It required a faulty CSP policy, a bad API, and a vulnerable web client (Pleroma FE). These things were all just BARELY faulty enough in just the right way to make this little spark connect and pwn the whole server.
In conversation Monday, 29-May-2023 05:06:54 JST from gleasonator.com permalink
Attachments
1. Untitled attachment
  https://media.gleasonator.com/aa47e46192c2dc9f69ccac6c1102043b9f79149012865cf9623275f62ba97d8c.png
- Alex Gleason (alex@gleasonator.com)'s status on Monday, 29-May-2023 05:06:53 JST Alex Gleason
  in reply to
  
  If you're using Soapbox on Pleroma exclusively and NOT using Pleroma FE, it appears that you're safe... but you're just barely hanging on by a thread!
  
  In conversation Monday, 29-May-2023 05:06:53 JST permalink
- (mint@ryona.agency)'s status on Monday, 29-May-2023 05:06:53 JST
  in reply to
  
  @alex Bloatchads stay winning.
  
  In conversation Monday, 29-May-2023 05:06:53 JST permalink
- bot :kiwi_dumbbell: (bot@seal.cafe)'s status on Monday, 29-May-2023 05:11:34 JST bot :kiwi_dumbbell:
  in reply to
  Is bloat unhackable?
  
  In conversation Monday, 29-May-2023 05:11:34 JST permalink
- (mint@ryona.agency)'s status on Monday, 29-May-2023 05:11:34 JST
  in reply to
  - bot :kiwi_dumbbell:
  @bot @alex Not exactly, it doesn't have CSP by default but it's farily easy to get one going. Small footprint plays a good role in that, there's exactly one optional script and one spreadsheet that need to be allowed.
  
  In conversation Monday, 29-May-2023 05:11:34 JST permalink
- ICScaryThings (icst@clubcyberia.co)'s status on Monday, 29-May-2023 05:35:06 JST ICScaryThings
  in reply to
  @i @alex @mint @bot Its main advantage is it can be run in a JS free web browser since it doesn't require JS to work. So if you run it with no JS you should be immune since it is impossible to exploit a browser with JS if it doesn't have a JS interpreter. You would still be at risk of media exploits though (e.g. pdfs, ect.), but those are bigger deals and the responsibility of the library developers to patch.
  
  PS: JS being allowed to be embedded directly into html is probably one of the dumbest mistakes ever made in the web standards. If it were even simply restricted to the <head> section of the document none of this bullshit would be possible for any website since user generated content is never present there.
  
  In conversation Monday, 29-May-2023 05:35:06 JST permalink
  
  likes this.
- :blank: (i@declin.eu)'s status on Monday, 29-May-2023 05:35:07 JST :blank:
  in reply to
  - bot :kiwi_dumbbell:
  @bot @alex @mint it has suffered xss fails too
  https://git.freesoftwareextremist.com/bloat/commit/?id=469f2d1d25f0b266abb15eab410131ebe1856aad
  In conversation Monday, 29-May-2023 05:35:07 JST permalink
  Attachments
  1. bloat - A web client for Mastadon Network
- :blank: (i@declin.eu)'s status on Monday, 29-May-2023 06:18:50 JST :blank:
  in reply to
  @MMS21 @icst @alex @mint @bot and totally off topic, javascript in SVG is a retardation of W3C, because you can have SVG in HTML5, they though it would be good to have HTML5 in SVG, which includes javascript
  
  normal uses would include animations and user interaction, including real time info in a vector graphic for funsies
  
  but the internet is not for funsies, it's srs bsnz!!!
  In conversation Monday, 29-May-2023 06:18:50 JST permalink
  Attachments
  1. Untitled attachment
    https://declin.eu/media/626781b8313ba49b5e6497d0eb964f35b50371628f0c1dc7836fe2f43def9578.png
  likes this.
- bot :kiwi_dumbbell: (bot@seal.cafe)'s status on Monday, 29-May-2023 06:18:51 JST bot :kiwi_dumbbell:
  in reply to
  Scripting what tho?
  
  In conversation Monday, 29-May-2023 06:18:51 JST permalink
- MMS21 :blinkot: (mms21@seal.cafe)'s status on Monday, 29-May-2023 06:18:51 JST MMS21 :blinkot:
  in reply to
  @bot @alex @i @icst @mint explanation seems p in depth https://www.phind.com/search?cache=e8759568-9829-49d8-98d4-12190f536a7d
  In conversation Monday, 29-May-2023 06:18:51 JST permalink
  Attachments
  1. Untitled attachment
- bot :kiwi_dumbbell: (bot@seal.cafe)'s status on Monday, 29-May-2023 06:18:52 JST bot :kiwi_dumbbell:
  in reply to
  Why do svgs even allow javascript in the first place?
  
  In conversation Monday, 29-May-2023 06:18:52 JST permalink
- MMS21 :blinkot: (mms21@seal.cafe)'s status on Monday, 29-May-2023 06:18:52 JST MMS21 :blinkot:
  in reply to
  @bot @icst @i @alex @mint from wikipedia "SVG uses CSS for styling and JavaScript for scripting." https://en.wikipedia.org/wiki/SVG (TIL)
  In conversation Monday, 29-May-2023 06:18:52 JST permalink
  Attachments
  1. SVG
    
    Scalable Vector Graphics (SVG) is an XML-based vector image format for defining two-dimensional graphics, having support for interactivity and animation. The SVG specification is an open standard developed by the World Wide Web Consortium since 1999. SVG images are defined in a vector graphics format and stored in XML text files. SVG images can thus be scaled in size without loss of quality, and SVG files can be searched, indexed, scripted, and compressed. The XML text files can be created and edited with text editors or vector graphics editors, and are rendered by the most-used web browsers. Early adoption was limited due to lack of support in older versions of Internet Explorer. However, as of 2011, all major desktop browsers began to support SVG. Native browser support offers various advantages, such as not requiring plugins, allowing SVG to be mixed with other content, and improving rendering and scripting reliability. Mobile support for SVG exists in various forms, with different devices and browsers supporting SVG Tiny 1.1 or 1.2. SVG can be produced using vector...

Public

Conversation

Notices

Feeds