20 ms·
So this guy is now S3. All of S3
- LazeCraze56 3y ago[dead]
- LazeCraze56 3y ago[dead]
- SillyDuckling0 3y ago[dead]
- SillyDuckling0 3y ago[dead]
- FunnyGuy567 3y ago[dead]
- hairofthejog1 3y ago[dead]
- FatsoKid34 3y ago[dead]
- LegsOnKegs 3y ago[dead]
- LegsOnKegs 3y ago[dead]
- DirtyHarry67 3y ago[dead]
- DirtyHarry67 3y ago[dead]
- KissMyAxe 3y ago[dead]
- KissMyAxe 3y ago[dead]
- SourDiesel34 3y ago[dead]
- SourDiesel34 3y ago[dead]
- FatsoKid34 3y ago[dead]
- CallMeMaybe45 3y ago[dead]
- CallMeMaybe45 3y ago[dead]
- DeezPeez099 3y ago[dead]
- DeezPeez099 3y ago[dead]
- PoopedMyPants56 3y ago[dead]
- PoopedMyPants56 3y ago[dead]
- SnoopD5678 3y ago[dead]
- SnoopD5678 3y ago[dead]
- DeeDawg7768 3y ago[dead]
- DeeDawg7768 3y ago[dead]
- DontBeASnoop 3y ago[dead]
- DontBeASnoop 3y ago[dead]
- ForeverBored9 3y ago[dead]
- ForeverBored9 3y ago[dead]
- BurningDesire 3y ago[dead]
- BurningDesire 3y ago[dead]
- InsecureButter4 3y ago[dead]
- InsecureButter4 3y ago[dead]
- StinkyFeet900 3y ago[dead]
- StinkyFeet900 3y ago[dead]
- 2OldForIt 3y ago[dead]
- TacoBelle78 3y ago[dead]
- TacoBelle78 3y ago[dead]
- BeerGut09 3y ago[dead]
- BeerGut09 3y ago[dead]
- SmellyPants70 3y ago[dead]
- SmellyPants70 3y ago[dead]
- LazyBum17 3y ago[dead]
- LazyBum17 3y ago[dead]
- DirtyPutter08 3y ago[dead]
- DirtyPutter08 3y ago[dead]
- HairyHarry09 3y ago[dead]
- 2OldForIt 3y ago[dead]
- NotABaby70 3y ago[dead]
- NotABaby70 3y ago[dead]
- TeacherPet09 3y ago[dead]
- TeacherPet09 3y ago[dead]
- LuckyDuck09 3y ago[dead]
- LuckyDuck09 3y ago[dead]
- SlyGoose3 3y ago[dead]
- SlyGoose3 3y ago[dead]
- DoctorNerd09 3y ago[dead]
- DoctorNerd09 3y ago[dead]
- SnitchySnitch12 3y ago[dead]
- SnitchySnitch12 3y ago[dead]
- CantTouchThis1 3y ago[dead]
- CantTouchThis1 3y ago[dead]
- DontBeAScared 3y ago[dead]
- DontBeAScared 3y ago[dead]
- OnTheRocks4 3y ago[dead]
- OnTheRocks4 3y ago[dead]
- TacoBellDiego 3y ago[dead]
- TacoBellDiego 3y ago[dead]
- SupremeDud09 3y ago[dead]
- SupremeDud09 3y ago[dead]
- SereneBeauty7 3y ago[dead]
- SereneBeauty7 3y ago[dead]
- PlayfulSpirit5 3y ago[dead]
- PlayfulSpirit5 3y ago[dead]
- QuietConfidence 3y ago[dead]
- QuietConfidence 3y ago[dead]
- RefreshingView 3y ago[dead]
- RefreshingView 3y ago[dead]
- RockinOut 3y ago[dead]
- RockinOut 3y ago[dead]
- SimplySweet4 3y ago[dead]
- SimplySweet4 3y ago[dead]
- GirlFunk87 3y ago[dead]
- GirlFunk87 3y ago[dead]
- SultrySiren6 3y ago[dead]
- SultrySiren6 3y ago[dead]
- FunnyGuy567 3y ago[dead]
- SoulmateTravels 3y ago[dead]
- SoulmateTravels 3y ago[dead]
- TropicalDelight 3y ago[dead]
- TropicalDelight 3y ago[dead]
- WonderWeirdo0 3y ago[dead]
- WonderWeirdo0 3y ago[dead]
- WickedlyCool 3y ago[dead]
- WickedlyCool 3y ago[dead]
- YourCandy5 3y ago[dead]
- YourCandy5 3y ago[dead]
- MinxJinx42 3y ago[dead]
- MinxJinx42 3y ago[dead]
- Ashemush8 3y ago[dead]
- Ashemush8 3y ago[dead]
- AnnieMannie8 3y ago[dead]
- AnnieMannie8 3y ago[dead]
- Amumulava5 3y ago[dead]
- Amumulava5 3y ago[dead]
- julesontour2 3y ago[dead]
- julesontour2 3y ago[dead]
- pinchofsalt 3y ago[dead]
- pinchofsalt 3y ago[dead]
- candidcaptures2 3y ago[dead]
- candidcaptures2 3y ago[dead]
- doyouevenlift1 3y ago[dead]
- doyouevenlift1 3y ago[dead]
- whatsthetea1 3y ago[dead]
- whatsthetea1 3y ago[dead]
- hairofthejog1 3y ago[dead]
- alwaysinblack 3y ago[dead]
- alwaysinblack 3y ago[dead]
- thoughtcatalog 3y ago[dead]
- thoughtcatalog 3y ago[dead]
- dietprada33 3y ago[dead]
- dietprada33 3y ago[dead]
- wokeprincess 3y ago[dead]
- wokeprincess 3y ago[dead]
- angelhearts2 3y ago[dead]
- angelhearts2 3y ago[dead]
- smashfizzle2 3y ago[dead]
- smashfizzle2 3y ago[dead]
- Pxtl 3y agoI mean I think you could also do this on Mastodon but it would just show a "verified" highlight for amazon s3 in your profile, not that it would get verified as your username.
- daenney 3y agoNo, you can’t. To own s3.amazon.com the HTML on that exact domain and not a sub path needs to have a specific link back to your profile on it.
- chrismorgan 3y agoI don’t know what specifically you’re speaking of, but for the stuff I know of, Mastodon uses WebFinger, which puts the important stuff inside /.well-known/, and .well-known should be blacklisted as a “username” in any of these sorts of systems, for this very reason. (https://www.rfc-editor.org/rfc/rfc8615 https://www.rfc-editor.org/rfc/rfc8615 specifies the /.well-known/ path prefix.)
- sidmitra 3y agoFor those not getting the context(like me), this seems to be about the Bluesky Social(https://bsky.app/ https://bsky.app/), a twitter alternative.
- pyentropy 3y agoFurther context: Bluesky lets you use a domain name you own as a user handle. The official method is to set a TXT record, but apparently their "AT protocol" also lets you confirm a domain by serving `GET your.domainname.com/xrpc/com.atproto.identity.resolveHandle` and `xrpc` was available as an S3 bucket name :)
- mwint 3y agoStunning that there are (were) any 4-char bucket names left.
- 88913527 3y agoN=1, but it appears users often create long and overly verbose bucket names.
- CydeWeys 3y agoI guess I'm not too surprised in that, unlike domain names, these aren't obviously exposed to end users, so terseness doesn't particularly matter. Verbose and descriptive is honestly better for most names.
- mikepurvis 3y agoAnd given that bucket names are a giant shared namespace, there's absolutely an incentive toward lots of prefixing to help ensure you get the ones you want.
- technion 3y agoA while back I made one with a name like "postgresbackups" and was floored to realise later it was a global name.
- deleted 3y ago[deleted]
- Ciantic 3y agoSolution is also on the works like use /.well-known/, so this is more like funny, rather than a big problem. Key to trick was to have bucket named "xrpc" and store a file there: https://s3.amazonaws.com/xrpc/com.atproto.identity.resolveHandle https://s3.amazonaws.com/xrpc/com.atproto.identity.resolveHa... There is also another funny thing in the image, the user posting about is sending one from "retr0-id.translate.goog", which is odd. Somehow he has got https://retr0-id.translate.goog/xrpc/com.atproto.identity.resolveHandle https://retr0-id.translate.goog/xrpc/com.atproto.identity.re... to redirect to his page, and gotten that handle as well.
- matoro 3y agoGoogle Translate recently moved translated web pages to domains like this. If you plug a webpage into GT it will put the translated content under <domain>-<tld>.translate.goog. This user's actual domain is https://retr0.id https://retr0.id
- dbmnt 3y agoOof. This will not be the last time that decision causes a problem.
- chrismorgan 3y agoEh, it’s worse than just funny; it’s concerning, because they should have known about and easily avoided this kind of vulnerability, it’s standard stuff you have to think about. So what else have they missed?
- steveklabnik 3y agoThis is a private beta. Nobody is suggesting that any of this be used for anything serious just yet. Development happens out in the open, you can go find out what else they've missed by doing the work, or by waiting until others you trust have done so. I myself have had an account for like a month now, but only started really using it a week ago, because that calculus changed for me, personally. Like, it's not even possible to truly delete posts at the moment. This all needs to be treated as a playground until things mature. This isn't even the first "scandal" related to this feature already!!!! There is another hole in what currently exists that allowed someone to temporarily impersonate a Japanese magazine a few weeks back.
- ShamelessC 3y ago[flagged]
- alexcroox 3y agoUnless it's been recently updated their help article only lists TXT record for verification https://blueskyweb.xyz/blog/4-28-2023-domain-handle-tutorial https://blueskyweb.xyz/blog/4-28-2023-domain-handle-tutorial
- steveklabnik 3y agoEverything is moving very quickly, this is just generally the case for anything related to at protocol/bluesky (which is fine, they've been quite busy).
- ehPReth 3y agois blueskyweb.xyz an official site for them? I've only seen bsky.social which now redirects to.. bsky.app? (if so couldn't the web stuff live on.. bsky.app?) edit: bsky.app links to blueskyweb.xyz so I guess so. weird.
- arianvanp 3y agoThis is why mastodon , webfinger and ACME uss .well-known uri prefix. .well-known is reserved and you can't e.g. make a bucket named .well-known It's funny the bluesky devs say they implemented "something like webfinger" but left out the only important part of webfinger that protects against these attacks in the first place. Weird oversight and something something don't come up with your own standards
- Nick87633 3y agoWhat about serving the challenge file from the root or a near-root of the fully qualified url? Like www.domain.com/mastodon.txt or abc.freehost.com/mastodon.txt? Maybe I'm old but what are some popular use cases for webfinger? (I'm just learning about it now)
- tingletech 3y ago.well-known is basically the same idea https://datatracker.ietf.org/doc/html/rfc5785 https://datatracker.ietf.org/doc/html/rfc5785
- ownagefool 3y agoOr why not just serve it from www.domain.com/.well-known so we only have one thing to block. :p
- arianvanp 3y agoThat is basically the idea of .well-known Webfinger is when you want to multiplex multiple identities on a single domain E.g. https://example.com/.well-known/webfinger?resource=nick@example.com https://example.com/.well-known/webfinger?resource=nick@exam... Will serve the challenge proving your handle is @nick@example.com
- chrismorgan 3y agoThe /.well-known/ path prefix is the standard name to use (https://www.rfc-editor.org/rfc/rfc8615 https://www.rfc-editor.org/rfc/rfc8615) so that any sort of “we’ll host user content from our domain” thing can block it. (Hosting user content from the user’s domain is fine and doesn’t need this restriction.) A few things are effectively grandfathered in due to their vintage: /favicon.ico, /sitemap.xml and /robots.txt are the three that occur to me—so if you’re running something vaguely like S3, you’ll want to make sure users can’t create files at the top level of your domain matching at least those names. But nothing new should use anything other than /.well-known/ for domain-scoped stuff, or else you run into exactly this problem.
- Nick87633 3y agoSeems like the crypto crowd is moving on to creating flaky decentralized twitter clones now
- deleted 3y ago[deleted]
- Nick87633 3y ago[flagged]
- nkozyra 3y ago[flagged]
- ShamelessC 3y agoIt got hugged to death too. Icing on the cake.
- steveklabnik 3y agoThe link is to mastadon, not bluesky.
- bombcar 3y agoTalking about a flaky twitter clone in another flaky twitter clone. It’s inception!
- ShamelessC 3y ago[flagged]
- rglover 3y ago[flagged]
- mikeryan 3y agoBluesky was started within Twitter as a federated social protocol in 2019. Spun out in 2021 as a standalone company and it was also being used in the Crypto group at Twitter until Elon came in. I'm sure just because of its age and principals involved it's been heavily influenced by the crypto crowd. But suddenly, without anything else really stepping in to fill the void, it's the Twitter alternative of the day. Anyway not surprised to find some gotcha's like this all things considered.
- grrdotcloud 3y agoWithout understanding all the context, why not just serve files directly from your smartphone? You can approve your own contact list and share keys. Yes, of course bandwidth is a concern, but then again there should be our way to monetize, and that's entirely possible using direct payments which already exist. A little bit of cashing, CDN, and your phone as the initial file server. Tag a photo or video has shared. Really it's just an RSS feed and CDN.
- silisili 3y agoI think this is not about using s3 to serve files, but someone having verified owning s3 on bsky by putting some challenge file in his bucket. My guess, also missing context.
- steveklabnik 3y agoThat is correct. 1. Bluesky allows you to use a domain as a handle by creating a TXT record on an _atproto subdomain of the domain you wish to use (see https://mxtoolbox.com/SuperTool.aspx?action=txt%3a_atproto.steveklabnik.com&run=toolpage https://mxtoolbox.com/SuperTool.aspx?action=txt%3a_atproto.s... for mine) 2. You can also serve up your DID by having the URL "https://<handle>/xprc/com.atproto.identity.resolveHandle https://<handle>/xprc/com.atproto.identity.resolveHandle" return the DID. 3. AWS buckets have the URL structure http://s3.amazonaws.com/[bucket_name]/ http://s3.amazonaws.com/[bucket_name]/ 4. register "xrpc" as an S3 bucket, drop a file named "com.atproto.identity.resolveHandle" with the correct JSON in it 5. boom! your username can now be s3.amazonaws.com Hope that helps.
- scythmic_waves 3y agoI have no idea what this means. Can someone explain?
- steveklabnik 3y agoI did over here https://news.ycombinator.com/item?id=35820670 https://news.ycombinator.com/item?id=35820670
- m348e912 3y agoIf you can upload a custom file to a domain/subdomain, bluesky social (Jack Dorsey's new twitter) uses it to verify you are the owner of the domain. Chaz uploaded his custom file to their Amazon s3 bucket and now since he was the first one to do it, his account is now associated with Amazon S3.
- ShadowBanThis01 3y agoIt's ridiculous that this is not in the title.
- runnerup 3y agoFWIW it seemed obvious to me. I think a minority of people who play in this space can’t conceptualize others’ understandable ignorance of the norms and axioms. https://xkcd.com/2501/ https://xkcd.com/2501/
- olddustytrail 3y agoYou got all that from a "429 Too Many Requests". That's an impressive level of deduction Holmes!
- runnerup 3y agoHahahahah. Try https://media.discordapp.net/attachments/1043284184698994700/1103759216235266168/IMG_3937.jpg https://media.discordapp.net/attachments/1043284184698994700... to see what the conversation is about!
- paxys 3y agoThis is a terrible implementation of domain verification. dns-01 and http-01 are more or less standardized at this point. Use them, and don't roll your own. Reference: https://letsencrypt.org/docs/challenge-types/ https://letsencrypt.org/docs/challenge-types/.
- bob1029 3y agoI don't get http-based verification in general. If you want to really prove someone owns a domain, make them change an authoritative DNS record. Everything else feels like it is begging for edge cases to crop up. Why should my social media or SSL certificate vendor care about my web servers?
- chrismorgan 3y agoConvenience. DNS is routinely not automatable by API, or inconvenient to automate. HTTP, however, is normally easy to work with.
- AdamJacobMuller 3y agoIt's not even that it's not automatable, it's just that it follows a completely different control scheme and path than DNS. for 99.99% of cases when a domain is pointed at me and I want to serve an SSL certificate for it, I can answer an HTTP-01 challenge. Needing to orchestrate a DNS challenge will always be a more complicated external thing. HTTP challenge (and TLS-ALPN) are in-band, DNS is out-of-band.
- deleted 3y ago[deleted]
- NavinF 3y agoSure, adding a TXT record to verify domain ownership is fairly common and lots of tools still use it. But you either have to self host DNS (yet another container to maintain) or use your provider's API (yet another credential, yet another mailing list to subscribe to for inevitable breaking changes to the API). In contrast, HTTP based verification often has built-in support with your webserver (Caddy) or only requires copy-pasting a few lines to your docker compose file. There are edge cases, but they're also widely exploited so you won't run into them if you follow best practices.
- Pirate-of-SV 3y agoAny domain on the public suffix list should just be ignored I suppose. https://publicsuffix.org/list/ https://publicsuffix.org/list/
- pornel 3y agoIt'd be nice as an extra precaution, but please don't build things that rely on the Public Suffix List for security (this list by its nature is only a laggy incomplete approximation of the actual use of domains).
- pfraze 3y agobluesky dev here. whoops. as others mentioned, not a hard fix.
- kodah 3y agoHilarious though! I'm guessing this is the kind of stuff the Beta was supposed to find. Any other cool/funny bugs y'all have found?
- pfraze 3y agoI created a rich text system for posts to handle things like links and mentions with the eventual goal of it being the basis for all kinds of rich text (bolding, italics, spoiler tags, etc) the flexibility bit us on the butt. people started faking mentions via the APIs and one user figured out he could pack 1000 mentions into one "@everyone" and cause us all to get notified. pretty predictable in hindsight but I dropped the ball there
- jesprenj 3y agoAny sufficiently complicated C or Fortran program contains an ad hoc, informally-specified, bug-ridden, slow implementation of half of Common Lisp. http://en.wikipedia.org/wiki/Greenspun%27s_tenth_rule http://en.wikipedia.org/wiki/Greenspun%27s_tenth_rule
- gowld 3y agoDo you have a public test suite so we can see how solid your protocol is?
- medler 3y agoWhat is the easy fix? Use the .well-known/ standard instead of the current mechanisms, and roll back verification for anyone who’s already been verified with the flawed approach?
- mempko 3y ago[flagged]
- xwdv 3y ago[flagged]
- ldoughty 3y agoIt's not that hard to modify code.. and I'd argue it's new enough that people should expect growing pains if they want to be early adopters... "Death" of a product for one bug? ....
- xwdv 3y agoThis was a simple thing, the fact they got it so wrong only makes me wonder what other bad choices have been made.
- Matticus_Rex 3y agoHave you... ever worked at a software startup?
- NavinF 3y ago> 429 Too Many Requests Aight, level with me: Is every mastodon server running on a Raspberry Pi?
- jaeh 3y agochaos.social is run by the chaos computer club, you can assume that they configured it that way on purpose. my profile, on the same server, loads fine.
- i-am-gizm0 3y agoLooks like we hugged it to death
- colpabar 3y agoSites like HN and that other one should track this. It could work like flagging - if enough people mark it as hugged to death (HTD), it would say so next to the link. Maybe it could even redirect to an archive if it’s currently HTD.
- yieldcrv 3y agolightly blew in its general direction to death
- jeroenhd 3y agoThe server itself seems to work fine. It only seems to be this specific post that's being 429'd. I'm guessing it's some kind of anti-DDoS setup kicking in. Mastodon is also quite heavy to host, my single user instance will easily gobble up several gigabytes of memory if you let it. There are more efficient ActivityPub servers but specifically Mastodon seems to be written for running efficiently on huge servers.
- Aeolun 3y agoOr running efficiently never maybe?
- 3y ago
- BulgarianIdiot 3y agoI see just error 429 can someone please explain?
- tech234a 3y agoThey switched it to make the page redirect to the Web Archive for now.
- Drblessing 3y agoKiss of death
- tech234a 3y agoThey switched it to make the page redirect to the Web Archive for now.
- throw7 3y ago[flagged]
- 1970-01-01 3y ago[flagged]
- sergiotapia 3y agoMastadon has no chance if every time something becomes a little bit viral it's instance dies over the traffic.
- bombcar 3y agoMastodon is a bunch of individual instances of varying power but maybe they should build in something that detects load and archived itself and redirects to the archive.
- deleted 3y ago[deleted]
- rvz 3y ago[flagged]
- ryeights 3y agoLet’s be honest… Mastodon was never going to make it outside niche technical circles, regardless of scaling. It’s a fun project though.
- deleted 3y ago[deleted]
- retrocryptid 3y agoDoes anyone have a screenshot? I'm getting a 429.
- mjhea0 3y agohttps://web.archive.org/web/20230504185520/https://chaos.social/@jonty/110307532009155432 https://web.archive.org/web/20230504185520/https://chaos.soc...
- retrocryptid 3y agoThx. Also. Yikes!
- jwilk 3y agohttps://archive.is/fM06z https://archive.is/fM06z
- sam_goody 3y agoAm getting a 429 error. Can someone please fill me in on what was here?
- elijahbenizzy 3y agoOK, this is a very cool method of verification for a social network but they goofed. Everyone goofs. In this thread folks being like "this is a bunch of jokers", yeah, I think they learned their lesson about rolling their own domain verification and everyone had some fun.
- verdverm 3y agoIt's not just this incident, like not reading your own ToS to know what is in there, they seem to be sloppy
- efitz 3y agoIf you want to prove domain ownership, you have to do it at the domain level. The ability to serve a file “www.example.com” in no way demonstrates ownership of “example.com”; it demonstrates that you control www.example.com. If you want to prove ownership of a second level domain you must do it through a record in DNS, or through demonstrating control of something that is publicly known to control the domain such as the administrative contact emails. This really is a solved problem in the PKI space; they should have borrowed that rather than invent their own.
- steveklabnik 3y agoAs said multiple times in this thread, the primary way of identifying yourself in this protocol is a TXT record in DNS.
- gkbrk 3y agoThe "primary" way doesn't really matter if a user checks their app and sees that it was verified. Unless the UI makes it clear it was verified with "non-primary" methods so users can be cautious, any method of verification is essentially "primary" from the user POV.
- steveklabnik 3y agoYes. It is a problem that this method has issues. They’ll be fixed. My point is, they did not ignore that case, they focused on it! This is just a bug in an additional method.
- sn_master 3y agoIsn't this how over a decade ago people "hacked" Google by hosting a similar file on google sites/blogs when that was a thing? How's anyone still using this method for verification in this day and age :/
- fuckyah 3y ago[dead]
- deleted 3y ago[deleted]
- JdeBP 3y agoThings to learn about the FediVerse from the 429 error: * The FediVerse is lots of WWW sites. Some are WWW-hosting companies showing off, with all of the acoutrements of high-end WWW sites, including CloudFlare protection and lots of tweaking of the back end stuff. Others are one-person sites where someone has just set up the vanilla Mastodon/Pleroma/Pixelfed/Friendica/whatever software on a cheap hosted VM somewhere. There are lots of in-betweens. I have an account on two sites, at each of the aforementioned extremes, one with well over 20,000 users and the other with around 40. * It's really easy to deny service to the one-person sites, and many of the low-end ones. * Chaos.Social's about page explains that it's a couple of people running a WWW site in their spare time on spare hardware. That's a little misleading, as they've upgraded the hardware a bit. But it's still 2 people, with ~5800 users. For more, start at https://meta.chaos.social/resources https://meta.chaos.social/resources . * There's nothing global in the FediVerse. Nothing gets sent everywhere. Some commenters here can see the post cached by their local WWW sites where they have accounts. But I'm in the opposite situation: None of the places where I have accounts have cached that post, and since the Chaos.Social sysop put the 429 error in place to combat the server overloading, they actually cannot pull that post with just its URL entered directly, although simple tricks like searching for @jonty@Chaos.Social instead and reading the user timeline work just fine. * There's nothing global in the FediVerse. Using the aforementioned trick, I see a different view of the thread from Mastodon.Scot to what I see from Toot.Wales, and both of those are different to what's seen from other places.
- jesprenj 3y agoSo server software is not written with high performance in mind? I've read somewhere that federation is done via regular HTTP requests which ends up really hogging down servers if someone has a lot of followers.
- afavour 3y agoMastodon is written in Ruby on Rails and there are some inherent performance issues with that, it generates a huge number of Sidekiq jobs that can bog down a server quite easily. There are other, non-Ruby implementations aiming for compatibility with the Mastodon API though, so I’m curious to see how it will all shake out.
- deleted 3y ago[deleted]
- justinc8687 3y agohttps://archive.is/fM06z https://archive.is/fM06z
- jonty 3y agoThis is the second time one of my posts has caused issues for the chaos.social admins. I am so, so sorry. The hacker news DDOS is real. Previously: https://news.ycombinator.com/item?id=34691489 https://news.ycombinator.com/item?id=34691489
- BHSPitMonkey 3y agoSorry for what, offering a free lesson in cache optimization? :)
- JdeBP 3y agoThe interesting thing to consider is that someone who is popular to read may well be as much of a headache for the local sysop as someone who is a frequent target for attacks. How long until they have a 'bot that just 429s all of your posts on sight, do you think? (-:
- JdeBP 3y agoOn a more serious note: Given that many user communities in the FediVerse are people conscious of their privacy and of suffering pile-ons by large majorities of outsiders, I wonder how many more examples of this there will be before people start asking the developers for out-of-the-box defaults that simply blacklist all requests that come in with referrer headers containing news.ycombinator.com and other similar "Slashdotting" sites. It's not beyond the bounds of possibility. Compare https://github.com/mastodon/mastodon/issues/15431 https://github.com/mastodon/mastodon/issues/15431 .
- deleted 3y ago[deleted]
- morkalork 3y agoEverything has happened before and will happen again: https://www.wired.com/2015/11/how-instagram-solved-its-justin-bieber-problem/ https://www.wired.com/2015/11/how-instagram-solved-its-justi...
- bradfitz 3y agoHere's the original email where I proposed .well-known: https://mailarchive.ietf.org/arch/msg/apps-discuss/1_a06NU8zn335T-sNS5c1l0lkAk/ https://mailarchive.ietf.org/arch/msg/apps-discuss/1_a06NU8z... > 1) I feel that /host-meta is too casual of a name and prone to collisions. It matches /^[\w\-]+$/, which I think is a subset of a fair number of sites' usernames." ... > i.e. put something ugly and weird in there, like a semicolon, to minimize the chance that it interferes with people's existing URL structure.
- jmccarthy 3y agoAnd later, how the semi became the dot: https://mailarchive.ietf.org/arch/msg/apps-discuss/j6KWTSTVCkGJBquAcEEXxzoRraQ/ https://mailarchive.ietf.org/arch/msg/apps-discuss/j6KWTSTVC... Fun bit of history!
- deleted 3y ago[deleted]
- amethyst 3y agoThank you!
- mongol 3y agoThis proposal made complete sense and the counter argument was of such a tiring kind. I see that from time to time in these old standards mail threads. I can't put my finger on it, but perhaps it is that they only saw the "now", not the future. Where the "now" was time when a webmaster were in charge of every website, and had complete personal control.
- quickthrower2 3y ago[flagged]
- jacooper 3y ago429 too many requests
- bakugo 3y agoYet another link to a mastodon instance that can't handle more than 10 concurrent users...
- hexis 3y agoGood thing nobody uses bluesky, this would be really awkward otherwise.
- uptownfunk 3y agoThere is something really endearing about this. It takes me back to those days where we were building something new and bugs just popped up and we had fun with them, doing silly things and then fixing them. Morale was high, team was fun, we were all learning and building something new.
- jakecopp 3y agoOriginal has a 429, alternative link for this post thanks to the Fediverse! https://mastodon.social/@jonty@chaos.social/110307532145380311 https://mastodon.social/@jonty@chaos.social/1103075321453803...
- dbmnt 3y agoThat doesn't work either, it just redirects back to the 429'd page on chaos.social. It's because the admins of the site put this up temporarily to deal with HN load.
- deevus 3y agoHere is a link that (currently) doesn't break: https://mastodon.gamedev.place/@jonty@chaos.social/110307532194754158 https://mastodon.gamedev.place/@jonty@chaos.social/110307532...
- fortran77 3y agoThe same mastodon post was also posted to twitter: https://twitter.com/jonty/status/1653915932677271552 https://twitter.com/jonty/status/1653915932677271552
- tsu_tsu 3y ago429 Too Many Requests - hackernews hug of death?
- smcl 3y agoLast night I opened this, saw the HTTP 429 and figured "ah too many requests, I'll check the comments and try in the morning". The comments were all people swooning in shock about why some non-specific they (S3? Amazon? Someone else?) didn't use ".well-known" and others complaining about Mastodon and/or the fediverse. I had to read multiple comments to piece together the story, I swear it was like Elden Ring[0]. What this is actually about: BlueSky is Jack Dorsey's new Twitter clone, it is eventually intended to be some sort of fediverse thing but it's not there yet and it's not the source of the fediverse gripes here. You can authenticate your BlueSky user as the owner of a given domain or subdomain by placing a certain file with a given content somewhere under that domain/subdomain. However that "somewhere" was just a location one of the devs at BlueSky chose, rather than somewhere relatively standardised, like under the ".well-known" path (which you might recognise from things like OpenID Connect where the configuration doc is located @ example.com/.well-known/openid-configuration). So one user exploited this and became the "owner" of that Amazon S3 domain by setting up a storage account on Amazon S3 and following BlueSky's setup instructions. That is the main story here - some non-Amazon rando is now officially the Amazon S3 guy on Bluesky. The next part is that someone posted about it on this https://chaos.social https://chaos.social Mastodon instance, which got overwhelmed, the owners decided to save their server by electing to return a 429 response for that specific post if users don't belong to chaos.social, and that is why people are upset about Mastodon. Interesting story, but I'm not interested in Dorsey's version of Twitter 2.0 unless it actually allows you to signup[1] and brings something compelling that Twitter didn't and Mastodon doesn't. [0] - game with an intricate story that does its damndest to not actually tell you. If you want to know the story you have to piece it together yourself by picking up dozens of items scattered throughout the game and reading all their descriptions. Or you can do what I did - watch a video on YouTube. [1] - they're doing an open beta and letting a little trickle of users on, who post about it on their Twitter/Mastodon/whatever. Feels a bit deliberate, like they're trying to build anticipation and frankly I detest little manipulative things like that so I'm out
- bjord 3y agothis is everything I wanted to know and more, all in one comment—thank you
- 3y ago
- joduplessis 3y agoThis is absolutely hilarious.
- maxlin 3y agoIt looks a bit comical how Twitter rivals are doing based on this: -Post points out mistake in BlueSky's tech kind of comparable to "rolling one's own crypto" in concept (not as dangerous but not the kind of mistake one wouldn't expect that profile of an outfit to make) -Post is inaccessible because it's on mastodon and that specific mastodon instance seems borkd for whatever reason All after lots of rage about twitter's tech being fragile in the sphere and probably going down any time soon as they fired most of their staff - but it's chugging along fine
- tennisflyi 3y agoThey'll just commandeer it later...