5 ms·
Would be nice to note that it sends hostnames of the sites you visit in plaintext, no SSL/TLS, across the internet to: http://api.corpwatch.org/companies h
by dylz 10y ago
Would be nice to note that it sends hostnames of the sites you visit in plaintext, no SSL/TLS, across the internet to:
http://api.corpwatch.org/companies
http://104.236.253.171:9119
- kaolti 10y agoIs that really stupid?
- jsmthrowaway 10y agoYes.
- kaolti 10y agoLearned something then! Is it take it off the store stupid or just regular?
- jsmthrowaway 10y agoI can't make that decision for you but generally things that transmit address bar input from a browser to other locations are enough for me to ban something from a network, whether it's encrypted in flight or not. Your personal DigitalOcean server being on the other end of the entire install base's queries (a) gives me pause, given the logging opportunities and (b) will fall over if you get some installation footprint. Your decision not to encrypt means that the threat vector expands from solely you to you as well as any adversaries in between the browser and you, so it's sort of an extra bummer on top of some bummers. A screen shot extension for Chrome did this without telling people and it became headlines. There's a reason one popular tool for finding stuff that does this is called Little Snitch.
- kaolti 10y agoI see, thanks for letting me know. Seems like for now the best is to republish with encryption and have a note about it so that people know.
- jsmthrowaway 10y agoNice catch. 104.236/16 is DigitalOcean, so best guess would be some kind of server belonging to the author.
- kaolti 10y agoIt is mine, yea.
- scottydelta 10y agoI think it is better if you mask your server ip using some service like CloudFlare and assign it a domain name when making public apps with links to your server.