Conversation

Notices

1. FrailLeaf (frailleaf@ryona.agency)'s status on Sunday, 18-Feb-2024 06:16:19 JST FrailLeaf

   • Haelwenn /элвэн/ :triskell:
   > https://git.pleroma.social/pleroma/pleroma/-/issues/2540#note_83052
   > Pleroma and some other implementations tries to be compatible with JSON-LD but we don't actually use it (for a number of reasons, including security, look at nasty old XML namespace ones to get an idea), so expect some weird things in there regarding that.
   
   @lanodan can you elaborate on this security concern?
   •  likes this.
   •  (mint@ryona.agency)'s status on Sunday, 18-Feb-2024 06:17:03 JST 

     in reply to

     • Haelwenn /элвэн/ :triskell:
     @FrailLeaf @lanodan I think that's the whole point of litepub, so that you won't waste time resolving @context.
   • FrailLeaf (frailleaf@ryona.agency)'s status on Sunday, 18-Feb-2024 06:17:27 JST FrailLeaf

     in reply to

     • Haelwenn /элвэн/ :triskell:
     @lanodan oh okay, i guess i won't believe what he has to say
     image.png
      likes this.
   •  (mint@ryona.agency)'s status on Sunday, 18-Feb-2024 06:17:57 JST 

     in reply to

     • Haelwenn /элвэн/ :triskell:
     @FrailLeaf @lanodan Jimmies status: rustled.
   • FrailLeaf (frailleaf@ryona.agency)'s status on Sunday, 18-Feb-2024 06:19:25 JST FrailLeaf

     in reply to

     • Haelwenn /элвэн/ :triskell:
     @lanodan niggas be like "yeah its a security concern" and then do not elaborate whatsoever
      likes this.
   •  (mint@ryona.agency)'s status on Sunday, 18-Feb-2024 06:20:24 JST 

     in reply to

     • Haelwenn /элвэн/ :triskell:
     @FrailLeaf @lanodan le badness enumeration
     48099 - SoyBooru.png
   • :blank: (i@declin.eu)'s status on Sunday, 18-Feb-2024 07:07:37 JST :blank:

     in reply to

     • Haelwenn /элвэн/ :triskell:
     @FrailLeaf @lanodan for xml, see https://github.com/erlang/otp/issues/7539 on how preprocessing a document with remote/local data can go wrong
     
     for jsonld, hopefully you're not retarded enough to sign the message in itself and use that as a security layer
     https://nvd.nist.gov/vuln/detail/CVE-2022-24307
     
     or use a parser that's going to expand your document into billion laughs and set lp0 on fire after it tries to recursively fetch an infinite amount of other @contexts
      likes this.
   • FrailLeaf (frailleaf@ryona.agency)'s status on Sunday, 18-Feb-2024 18:14:33 JST FrailLeaf

     in reply to

     • 
     • Haelwenn /элвэн/ :triskell:
     @mint @lanodan huh i thought pleroma was mostly AP
      likes this.
   • FrailLeaf (frailleaf@ryona.agency)'s status on Sunday, 18-Feb-2024 18:15:27 JST FrailLeaf

     in reply to

     • Haelwenn /элвэн/ :triskell:
     • :blank:
     @i @lanodan Interesting, thanks
     
     >or use a parser that's going to expand your document into billion laughs and set lp0 on fire after it tries to recursively fetch an infinite amount of other @contexts
     that would be a little funny
      likes this.