6 ms·

Hosting files is a feature. The bug is doing so on the same domain as an official government source. The fix is registering a non-gov domain like fccusercontent

Hosting files is a feature. The bug is doing so on the same domain as an official government source. The fix is registering a non-gov domain like fccusercontent.com and hosting files from there. (Also they should probably limit the API to only accept pdf's, txt, and other reasonable file types.)

evanb 9y ago
Or something like citizens-uploaded-content.gov
- equalunique 9y ago
  This is more realistic because I believe the US government is mostly restricted from using the .com TLD. That decision came from: "Digital Government: Building a 21st Century Platform to Better Serve the American People". United States Federal CIO Council. May 23, 2012.
  - gertef 9y ago
    The Federal goverment can authorize a contractor to host authorized content: annualcreditreport.com This is a bad idea, though, as it makes it easy and legal for non-authorized entities to impersonate the authorized ones: freecreditreport.com
SEJeff 9y ago
This is what github did with gist and github pages, for similar issues.
Alex3917 9y ago
It seems more appropriate just to add a ~ to the url, indicating that it's a user-uploaded file from an otherwise trusted domain. Browsers can then warn users about that however they want.
- inetknght 9y ago
  Is that an actual standard or... just common practice?
  - Alex3917 9y ago
    It's a unix standard, or at least more than just a design pattern. You know how in any unix shell, typing cd ~ takes you to your home directory? This is actually a shortcut for typing cd ~yourusername. So having xyz.tld/~username/... in a url path means that the file is hosted in userland, since ~username is the first part of the filepath hosted behind that URL. Websites have been using this pattern for 25+ years, so it's pretty universal by now.
    - gertef 9y ago
      It's not a security standard.
    - nucleardog 9y ago
      It's not even a standard. At best you could call it a convention. And a much more narrowly defined one than you seem to think. The `~` or `~username` is expanded by your shell (but not necessarily all shells) and has nothing to do with the operating system. If you pass a filename like `~myusername/test.txt` to any unix's open() syscall, it's going to either fail or open a file in a directory literally called `~myusername`. This means anywhere you're passing a filename into a program that isn't your shell does not generally support that syntax. A narrowly defined, poorly recognized convention is not a great thing to rely on for security purposes.
      - Alex3917 9y ago
        Fair enough. What's the process for submitting it as a proposed standard? I'll write it up.
        inetknght 9y ago
        It depends on where you want to make the proposal. I'd make a guess with the POSIX standard. At that point, I think you'd submit a proposal somewhere around http://www3.opengroup.org/content/posix® http://www3.opengroup.org/content/posix® Also, that ® at the end of posix is part of the URL, you will unfortunately get a 404 if you don't copy-paste it right. You might be better to search for "site:opengroup.org posix" Good luck, man
0x4a42 9y ago
How PDF is a reasonable file type?

evanb 9y ago

Or something like citizens-uploaded-content.gov

equalunique 9y ago
This is more realistic because I believe the US government is mostly restricted from using the .com TLD. That decision came from: "Digital Government: Building a 21st Century Platform to Better Serve the American People". United States Federal CIO Council. May 23, 2012.
- gertef 9y ago
  The Federal goverment can authorize a contractor to host authorized content: annualcreditreport.com This is a bad idea, though, as it makes it easy and legal for non-authorized entities to impersonate the authorized ones: freecreditreport.com

SEJeff 9y ago

This is what github did with gist and github pages, for similar issues.

Alex3917 9y ago

It seems more appropriate just to add a ~ to the url, indicating that it's a user-uploaded file from an otherwise trusted domain. Browsers can then warn users about that however they want.

inetknght 9y ago
Is that an actual standard or... just common practice?
- Alex3917 9y ago
  It's a unix standard, or at least more than just a design pattern. You know how in any unix shell, typing cd ~ takes you to your home directory? This is actually a shortcut for typing cd ~yourusername. So having xyz.tld/~username/... in a url path means that the file is hosted in userland, since ~username is the first part of the filepath hosted behind that URL. Websites have been using this pattern for 25+ years, so it's pretty universal by now.
  - gertef 9y ago
    It's not a security standard.
  - nucleardog 9y ago
    It's not even a standard. At best you could call it a convention. And a much more narrowly defined one than you seem to think. The `~` or `~username` is expanded by your shell (but not necessarily all shells) and has nothing to do with the operating system. If you pass a filename like `~myusername/test.txt` to any unix's open() syscall, it's going to either fail or open a file in a directory literally called `~myusername`. This means anywhere you're passing a filename into a program that isn't your shell does not generally support that syntax. A narrowly defined, poorly recognized convention is not a great thing to rely on for security purposes.
    - Alex3917 9y ago
      Fair enough. What's the process for submitting it as a proposed standard? I'll write it up.
      - inetknght 9y ago
        It depends on where you want to make the proposal. I'd make a guess with the POSIX standard. At that point, I think you'd submit a proposal somewhere around http://www3.opengroup.org/content/posix® http://www3.opengroup.org/content/posix® Also, that ® at the end of posix is part of the URL, you will unfortunately get a 404 if you don't copy-paste it right. You might be better to search for "site:opengroup.org posix" Good luck, man

0x4a42 9y ago

How PDF is a reasonable file type?