bonifartius 𒂼𒄄 @bonifartius@social.cleverlibre.org

Cola is an adult beverage, similar to coffee.

why is there no "don't return nontechnical results" checkbox on search engines? why do pages not have a "how technical is this" metric?

I have literally never once been looking for a "7 most common ..." "top 10 reasons ..." "what are the 14 signs that a page is BLOGSPAM?" THAT PAGE IS FUCKING BLOG SPAM OMG IT'S FUCKING BLOGSPAM WHY ARE SEARCH RESULTS ALWAYS SO FULL OF THIS SHIT I DON'T UNDERSTAND

the modern internet sucks
f6e913e3a9302e27f5a8791a00270e77.png

germans after the experiences of the third reich and the socialist gdr: We need state media for information we can trust.

PLEROMA ADMINS READ THIS, AKKOMA TOO

Another important pleroma security post: @alex and @graf found ANOTHER injection bug, and this one was probably used for the attack. I think that single user instances are probably not affected, but I wouldn't want to risk it. Move your media and proxy to a subdomain as alex initially recommended, it's not complicated and takes 15 minutes, and eliminates this whole class of bugs.

Fix is being worked on, but just do the media/proxy thing now so you'll never have to worry about this again.

https://webb.spiderden.org/2023/05/26/pleroma-mitigation/

@Yetimon believe nothing. Know or do not know. Believing brings COVID vaccinations, lockdowns and relegating your safety to the State.

Humans!

Please don't send us any more unsolicited nude pics with instructions on how to get to your house.
It's creepy.

Sincerely,

The Aliens.

@trinsec I do have passion on programing, but not the one those enterprises need. I write posts for my blog monthly, mainly about some random stuff I did in the last month, like writing a simple read-only FUSE in Kotlin, dig into how email system prevents spam, record how I implemented a P2P chat system in Minecraft, etc. I do enjoy them, I did that for about 5 or 6 years, and I still want to keep doing that.

I generally hope I can turn my passion for programming into a job, which I don't suffer from. But based on situation, where I know the enterprise doesn't need a SpringBoot and MySQL master to build a product, and the enterprise knows that too, but they still want to hire a person who mastered those things and pay him/her an entry level salary, I don't think the job is the one I want. A Java programmer who masters the SpringBoot, database, cloud, knows how SpringBoot and MySQL work internally, knows how to design cloud-native applications, works 12 hours a day, and gets paid less than 2K USD per month? I would call it greedy.

While other people have workarounds, I don't like it. They simply repeat those Q&As and pretend to know everything about those things but in fact they rarely understood them. I think programing is about doing something and learning from it, not memory something and don't know how to use it.

image.png

image.png

image.png

image.png

@gabriel

I started to earn my own money when I was 12, so I don't really see a problem....maybe the "need" is worrisome. No 14 year should "need a job", but maybe "want a job".

@disarray

@lain ap is for publishing shit to the world why would u put private stuff

:hacker_f::hacker_s::hacker_e:
And the Case of the Missing Auth Token :hackerman2:

I'm late to this party and did not make any kind of writeup (aside from arguing in a thread) because I am on an impromptu trip to visit my grandfather in the hospital, whose kidneys seem to have shut down. But I should probably say a few things about this and how it relates to FSE. If you are unfamiliar, an admin token for graf was exfiltrated through a malicious embed. There has been a confirmed pair of bugs in Pleroma's embedding code for the "rich media" (Twitter cards, link previews) and a fix is on the way. There is also a mitigation: just disable rich media, and ensure you have proper CSP set up for both /media and the /proxy endpoint unless you have disabled media proxying. FSE was never vulnerable to this bug, which will be explained below.

What was leaked were a large number of chats, and then media associated with them. The chats were called "DMs" in the alogs.space thread. The same thing happened to bae.st, probably an opportunistic token grab through the media proxy. The same code worked for both because of this line:

> JSON.parse(localStorage.getItem('localforage/vuex-lz'));

(I don't know how likely it is that this happens or is practical, but future problems could be mitigated by making instance-specific names for the key in the local storage.)

Eventually, the script gets around to exfiltrating the token by sending it to mostr.fedirelay.xyz. The script appeared on Poast on the 20th (concurrent with the mass-spamming, which may or may not be a coincidence ), and the dump hit alogs.space on the 25th. The naming conventions and the presentation of the dump make it look like, once the token was grabbed, the same tool that was used to extract the chudbuds.lol dump was used for this one. The chudbuds.lol vector was different (admin's desktop was compromised) and it was a much bigger breach; this was just the admin token for the web interface rather than login credentials for a shell on the server, etc. It may be worth noting, the chudbuds.lol thread mentioned graf/Gleason a few times near the top, and there have been some minor (very recent) attempts at a DDoS of poa.st and poast.tv. Timing for the chudbuds.lol leak seemed much tighter and better coordinated, but this was a little sloppier (a DDoS of Poast starting when the dump landed on alogs.space would have been an obvious thing to do as a distraction; they coordinated the chudbuds.lol dump with the beginning or one of the admin's Twitch streams, and tossed a couple of kids in to spam the chat).

Since admins can see chats, they were able to extract all of the chats. It might have been possible to exfiltrate almost anything. Poast uses in-DB config, so compromising an admin's account means you can alter instance-blocks, etc.

FSE is immune for a few reasons:

FSE does not use the media proxy feature.
CSP settings on /media are paranoid.
:bwksmug: FSE does not use the rich media feature.
FSE has no admin accounts, so my account has no special permissions.
FSE's aggressive rate-limiting makes attempts at any mass-dump more time-consuming.
I cannot die, nor can I ever be killed.

(We can go ahead and start the timer on the next ImageMagick exploit that punches a hole in the server: the last one was a big one. Incidentally, the last big one was really big: https://imagetragick.com/ . FSE also does not mangle your uploads, so when the next one hits, we'll be immune to that, also.)

Here's a test I did some time in 2020, if timestamps are to be believed: https://freespeechextremist.com/media/3ead00eb-ae12-4737-adc8-2c92d5e86a4f/test.html . That link is safe, the JS doesn't execute (and is innocuous anyway).

Finally, I would like to tap the sign again. Do not trust admins: any of them could be malicious. An admin that is not malicious might be incompetent. An admin that is competent can still screw up. An admin that doesn't screw up can still install software that has a bug in it, get their servers seized by the gubbamint, any number of external forces could conspire to fuck it all up. A million things can go wrong and the second a piece of data leaves your computer, you no longer control it. Don't let it leave your computer if it would be a disaster for you to lose control of it.

Here's lain talking about the fix: https://lain.com/objects/02a7a6ad-2514-4055-a1d4-a774bc3f5ea4
Here's graf's announcement: https://poa.st/objects/23a2d8aa-c72d-488d-b9dd-21d3f3b05521

And, aside from sending annoying guys on Poast their own dick pics in lieu of a retort, this is the impact of the hack:
nothing.gif