6 ms·

> This blog is now STATELESS. The entire post is contained in the URL that you are visiting now. All my "blog" is now is a hard-coded main page that contains li

> This blog is now STATELESS. The entire post is contained in the URL that you are visiting now. All my "blog" is now is a hard-coded main page that contains links to posts I claim authorship of. Of course the entire post is contained in each of these links. https://joshcsimmons.com/post/H4sIAAAAAAAA%2F3xV227cRgx911cQMQLbgFe%2BtjDytnXtZNF1EmSdAEEQIJTE3WE9GqozlGX56wuOZCMtiu7LXmbEc%2BEhdw9WCpxgcKjA9rEsiveiQA8UR3UcdrCCIbKSXdtKnE4A%2B4Yp1FS%2BHEuAFsMIKh3X6Q0o1S6Il914BHXvtY90BFcuclLGwDoeASmgL4viE9USavaGpo4SQcOpw4hKczlIBkt%2BBM8ta4L2ZwpLBXWcoBMOegQauULPqTXKScBhbBYDR2qAgwosW4pcY3imBWrq1RFsI7ZGQrYggeytHYFSwjGZvuxSyzunUBFgAA5B6l76NNGEimppydiGhMoS0IO6KP3OQUVW2RCogWq0yrXErk8ZTR1F6PrKcz0DlkVxZ6IqLzsTEmSAzd3y7np9vdmUcOcIKChHgk5SbmItQZFDlpnlfP60nrSN0gNGggdOrEYjyFDC0ntj8coQXj1DcAKcHKuloQZa5AAd7maXZowEnsO9yc7oCVZQe%2BQWsFcnMTnuQLYlfNhCLX1M9vT%2F8yWsnTkx9T9XL4tiGeYQWrsqgh0Fslg04ChSCV%2BlNwDfWCwDOKs8Sh9BhjA5l1n3iXJkBqqSZRVNZKTQUKQIvM0GRULvRxgwWH2V0mYj9V0n0QKH8b6RIZRFsdr33shM7fIjRPKEyWi2ln%2Fx5ssz1YnG509ry6KEElYTnOFM9xSSYjRQwujHLG1%2FnsmdUI5eb1wX6mjhRJqyKE5LuKNHhS37HNRnU20YlUIJn1Of9SDcztTz3SOo%2BikQk28qmq9F6iIlCjpnsUHFxVZii5rML6VHLYuzEm4MkBO8feKuo6Y4L%2BE3TPTrBThMuYV2MvFqsaFp5tAcWFCYQpU0mlsHSWzpDBLvM0a%2BdFhclLCZLnQea2oAt0oRfpjE4x8WFgu2bOFPSa5O3LYSUllLWxR7e3DDobFnP%2BZcDqwOriya1CyWL%2BEsiuu8xrJrOSKrl4a8tPU%2FEg2eHyjBvC6%2BRRGdQmubhpW%2BHzjVLr05Pv43t8OXxtsgRsJMEv%2FBwOEDTag2EwoDew9e5B4839O843BH5SxOttCH%2B2Ct%2FYllroLwreE01YrPfFWyBvtoZb4fHGdL312k1XJ%2BvT67OV%2Ff%2FnX59HFz%2BmX1xK%2FPbt5vvrxbba4e1182u4eRh25Tn979cRtW65uvMl5d9id0ezU%2F%2B%2Frs5vL35dvIdH7i7bfDMjdlbVs7b8RUFNY9T2GnroRbfMzdnL5bb69clDYn7Ozk8hxqhxFrpZhgAWcnv1zMaTAnU1%2BpHWZFjeRVhaGBKL3mf6ZGwr6COQQU8hbGSnoFJwPU0lriE9tizwlUmcYsqRWxO9nxFrt8ZhOwmHnaDLFCImrzWWXLLQPYXyRCchJ1WuRl8TcAAAD%2F%2FwMA1onjg2UHAAA%3D https://joshcsimmons.com/post/H4sIAAAAAAAA%2F3xV227cRgx911cQ...

molo 3y ago
If you're going to do that, you should at least generate shortened URLs as well.
- hk__2 3y ago
  But then it’s not stateless anymore.
  - Dylan16807 3y ago
    It's not stateless at all because of the main page, so this is more of a weird anti-optimization.
Quarrelsome 3y ago
doesn't this mean I could embed salacious material into a link and fool people into thinking the person who owned this website wrote it?
- bravetraveler 3y ago
  XSS as a feature, neat
- deleted 3y ago
  [deleted]
  - deleted 3y ago
    [deleted]
- generalizations 3y ago
  > Anything can be generated here. You could even host your own blog that uses my website as a renderer if you really wanted to. It supports markdown. > Every post that I want to publicly claim authorship of lives at the root of this site. If you are reading a post that I have claimed it will look like this page. Posts of unknown authorship have a disclaimer at the top of the page. https://joshcsimmons.com/post/H4sIAAAAAAAA%2F3xV227cRgx911cQMQLbgFe%2BtjDytnXtZNF1EmSdAEEQIJTE3WE9GqozlGX56wuOZCMtiu7LXmbEc%2BEhdw9WCpxgcKjA9rEsiveiQA8UR3UcdrCCIbKSXdtKnE4A%2B4Yp1FS%2BHEuAFsMIKh3X6Q0o1S6Il914BHXvtY90BFcuclLGwDoeASmgL4viE9USavaGpo4SQcOpw4hKczlIBkt%2BBM8ta4L2ZwpLBXWcoBMOegQauULPqTXKScBhbBYDR2qAgwosW4pcY3imBWrq1RFsI7ZGQrYggeytHYFSwjGZvuxSyzunUBFgAA5B6l76NNGEimppydiGhMoS0IO6KP3OQUVW2RCogWq0yrXErk8ZTR1F6PrKcz0DlkVxZ6IqLzsTEmSAzd3y7np9vdmUcOcIKChHgk5SbmItQZFDlpnlfP60nrSN0gNGggdOrEYjyFDC0ntj8coQXj1DcAKcHKuloQZa5AAd7maXZowEnsO9yc7oCVZQe%2BQWsFcnMTnuQLYlfNhCLX1M9vT%2F8yWsnTkx9T9XL4tiGeYQWrsqgh0Fslg04ChSCV%2BlNwDfWCwDOKs8Sh9BhjA5l1n3iXJkBqqSZRVNZKTQUKQIvM0GRULvRxgwWH2V0mYj9V0n0QKH8b6RIZRFsdr33shM7fIjRPKEyWi2ln%2Fx5ssz1YnG509ry6KEElYTnOFM9xSSYjRQwujHLG1%2FnsmdUI5eb1wX6mjhRJqyKE5LuKNHhS37HNRnU20YlUIJn1Of9SDcztTz3SOo%2BikQk28qmq9F6iIlCjpnsUHFxVZii5rML6VHLYuzEm4MkBO8feKuo6Y4L%2BE3TPTrBThMuYV2MvFqsaFp5tAcWFCYQpU0mlsHSWzpDBLvM0a%2BdFhclLCZLnQea2oAt0oRfpjE4x8WFgu2bOFPSa5O3LYSUllLWxR7e3DDobFnP%2BZcDqwOriya1CyWL%2BEsiuu8xrJrOSKrl4a8tPU%2FEg2eHyjBvC6%2BRRGdQmubhpW%2BHzjVLr05Pv43t8OXxtsgRsJMEv%2FBwOEDTag2EwoDew9e5B4839O843BH5SxOttCH%2B2Ct%2FYllroLwreE01YrPfFWyBvtoZb4fHGdL312k1XJ%2BvT67OV%2Ff%2FnX59HFz%2BmX1xK%2FPbt5vvrxbba4e1182u4eRh25Tn979cRtW65uvMl5d9id0ezU%2F%2B%2Frs5vL35dvIdH7i7bfDMjdlbVs7b8RUFNY9T2GnroRbfMzdnL5bb69clDYn7Ozk8hxqhxFrpZhgAWcnv1zMaTAnU1%2BpHWZFjeRVhaGBKL3mf6ZGwr6COQQU8hbGSnoFJwPU0lriE9tizwlUmcYsqRWxO9nxFrt8ZhOwmHnaDLFCImrzWWXLLQPYXyRCchJ1WuRl8TcAAAD%2F%2FwMA1onjg2UHAAA%3D https://joshcsimmons.com/post/H4sIAAAAAAAA%2F3xV227cRgx911cQ... (His permalinks are horrible, lol)
chatmasta 3y ago
hm... https://joshcsimmons.com/post/H4sIAA6yLmUA/wVAwQnFIAxd5ZGL7ckFandJ/Q8VrIHo7/xytbdgek4So8AG3c2TaKevI6zaJrL9+w9VP+IhB4rpmgynIN4bacCjlz8AAAA= https://joshcsimmons.com/post/H4sIAA6yLmUA/wVAwQnFIAxd5ZGL7c...
- bombcar 3y ago
  Yep, Josh has given everyone (apparent) write access to his site.
- joshcsimmons 3y ago
  Awesome - and the first time I've actually had someone "post" on my site.
  - chatmasta 3y ago
    You're welcome. :D The client-side XSS is mostly harmless (assuming you don't have any other sensitive services running with cookies scoped to this domain), although it's technically a persistent XSS, which means it could be indexed by search engines. But is there a server-side component to this? I noticed that the "disclaimer" is added in the source returned by the server, so I assume there is some code that checks whether the post is present on the home page? If so, that could be dangerous, if there is a bug in that code such that a malicious payload in the URL could get RCE in your server process.
    - joshcsimmons 3y ago
      I've just added some defensive programming to the site. Sorry to say. Appreciate that you hacked it with your image onerror, pretty clever. TBH I haven't thought about most of these things. Nobody typically reads my blogs when I've made them before and this is likely the only interest it will get for quite a while.
      - chatmasta 3y ago
        lol :) nice fix Can't promise I won't circumvent it when I've got some time...
aosaigh 3y ago
I don't understand how this helps ownership of content? What situation is this trying to avoid? You already "own" your URL if you own your domain? EDIT: understand you are not the OP btw, just wondering out loud.
- dinkleberg 3y ago
  The only thing I can think of is if they want to share controversial posts while having the ability to deny that they wrote it (as long as they don’t actually create a link to it from their own site). It’s not a good use case IMO, but that is all I can think of lol
perlguy9 3y ago
Tranlsation: This guy is insufferable
deleted 3y ago
[deleted]
mortallywounded 3y ago
https://joshcsimmons.com/post/H4sIAAAAAAAAAyXMQQrCMBCF4b2neOBCBWn3nkAXegFxMTGjCW0yJTNp6e1t6%2B57PPj3uNPsGNEQNR8MUyD7r2a3u4ESshi0Fj7D1e1S5qToY8cgOPKIngkmKJw9ly3B4wKVxJIZQzVF4MJbspeR8bw%2BXsdgNuilbTNP2sxvSS5mMinNwhMsSP0GUPYLGR%2FpO121Zn7rWby7twAAAA%3D%3D https://joshcsimmons.com/post/H4sIAAAAAAAAAyXMQQrCMBCF4b2neO... Doesn't need to release tools... gzip, base64 and uri encode uh huh.
hk__2 3y ago
So if the author fix a small typo in the post, they break all the links to it. The blog is not "stateless", it’s just that its state is stored in the homepage. Having all posts on that page with anchor links would achieve the same thing with shorter links that don’t depend on the content.
- cbsks 3y ago
  It won’t break any existing links. It just means that existing links will still have the typo.
amatecha 3y ago
Huh, cool. I think it's a pretty terrible idea, but I'm glad people are still doing fun/creative things with websites. Keeping the spirit of the early web alive. haha :)
foxtrottbravo 3y ago
But how does it know whether it should print the pretext?

molo 3y ago

If you're going to do that, you should at least generate shortened URLs as well.

hk__2 3y ago
But then it’s not stateless anymore.
- Dylan16807 3y ago
  It's not stateless at all because of the main page, so this is more of a weird anti-optimization.

Quarrelsome 3y ago

doesn't this mean I could embed salacious material into a link and fool people into thinking the person who owned this website wrote it?

bravetraveler 3y ago
XSS as a feature, neat
deleted 3y ago
[deleted]
- deleted 3y ago
  [deleted]
generalizations 3y ago
> Anything can be generated here. You could even host your own blog that uses my website as a renderer if you really wanted to. It supports markdown. > Every post that I want to publicly claim authorship of lives at the root of this site. If you are reading a post that I have claimed it will look like this page. Posts of unknown authorship have a disclaimer at the top of the page. https://joshcsimmons.com/post/H4sIAAAAAAAA%2F3xV227cRgx911cQMQLbgFe%2BtjDytnXtZNF1EmSdAEEQIJTE3WE9GqozlGX56wuOZCMtiu7LXmbEc%2BEhdw9WCpxgcKjA9rEsiveiQA8UR3UcdrCCIbKSXdtKnE4A%2B4Yp1FS%2BHEuAFsMIKh3X6Q0o1S6Il914BHXvtY90BFcuclLGwDoeASmgL4viE9USavaGpo4SQcOpw4hKczlIBkt%2BBM8ta4L2ZwpLBXWcoBMOegQauULPqTXKScBhbBYDR2qAgwosW4pcY3imBWrq1RFsI7ZGQrYggeytHYFSwjGZvuxSyzunUBFgAA5B6l76NNGEimppydiGhMoS0IO6KP3OQUVW2RCogWq0yrXErk8ZTR1F6PrKcz0DlkVxZ6IqLzsTEmSAzd3y7np9vdmUcOcIKChHgk5SbmItQZFDlpnlfP60nrSN0gNGggdOrEYjyFDC0ntj8coQXj1DcAKcHKuloQZa5AAd7maXZowEnsO9yc7oCVZQe%2BQWsFcnMTnuQLYlfNhCLX1M9vT%2F8yWsnTkx9T9XL4tiGeYQWrsqgh0Fslg04ChSCV%2BlNwDfWCwDOKs8Sh9BhjA5l1n3iXJkBqqSZRVNZKTQUKQIvM0GRULvRxgwWH2V0mYj9V0n0QKH8b6RIZRFsdr33shM7fIjRPKEyWi2ln%2Fx5ssz1YnG509ry6KEElYTnOFM9xSSYjRQwujHLG1%2FnsmdUI5eb1wX6mjhRJqyKE5LuKNHhS37HNRnU20YlUIJn1Of9SDcztTz3SOo%2BikQk28qmq9F6iIlCjpnsUHFxVZii5rML6VHLYuzEm4MkBO8feKuo6Y4L%2BE3TPTrBThMuYV2MvFqsaFp5tAcWFCYQpU0mlsHSWzpDBLvM0a%2BdFhclLCZLnQea2oAt0oRfpjE4x8WFgu2bOFPSa5O3LYSUllLWxR7e3DDobFnP%2BZcDqwOriya1CyWL%2BEsiuu8xrJrOSKrl4a8tPU%2FEg2eHyjBvC6%2BRRGdQmubhpW%2BHzjVLr05Pv43t8OXxtsgRsJMEv%2FBwOEDTag2EwoDew9e5B4839O843BH5SxOttCH%2B2Ct%2FYllroLwreE01YrPfFWyBvtoZb4fHGdL312k1XJ%2BvT67OV%2Ff%2FnX59HFz%2BmX1xK%2FPbt5vvrxbba4e1182u4eRh25Tn979cRtW65uvMl5d9id0ezU%2F%2B%2Frs5vL35dvIdH7i7bfDMjdlbVs7b8RUFNY9T2GnroRbfMzdnL5bb69clDYn7Ozk8hxqhxFrpZhgAWcnv1zMaTAnU1%2BpHWZFjeRVhaGBKL3mf6ZGwr6COQQU8hbGSnoFJwPU0lriE9tizwlUmcYsqRWxO9nxFrt8ZhOwmHnaDLFCImrzWWXLLQPYXyRCchJ1WuRl8TcAAAD%2F%2FwMA1onjg2UHAAA%3D https://joshcsimmons.com/post/H4sIAAAAAAAA%2F3xV227cRgx911cQ... (His permalinks are horrible, lol)

chatmasta 3y ago

hm... https://joshcsimmons.com/post/H4sIAA6yLmUA/wVAwQnFIAxd5ZGL7ckFandJ/Q8VrIHo7/xytbdgek4So8AG3c2TaKevI6zaJrL9+w9VP+IhB4rpmgynIN4bacCjlz8AAAA= https://joshcsimmons.com/post/H4sIAA6yLmUA/wVAwQnFIAxd5ZGL7c...

bombcar 3y ago
Yep, Josh has given everyone (apparent) write access to his site.
joshcsimmons 3y ago
Awesome - and the first time I've actually had someone "post" on my site.
- chatmasta 3y ago
  You're welcome. :D The client-side XSS is mostly harmless (assuming you don't have any other sensitive services running with cookies scoped to this domain), although it's technically a persistent XSS, which means it could be indexed by search engines. But is there a server-side component to this? I noticed that the "disclaimer" is added in the source returned by the server, so I assume there is some code that checks whether the post is present on the home page? If so, that could be dangerous, if there is a bug in that code such that a malicious payload in the URL could get RCE in your server process.
  - joshcsimmons 3y ago
    I've just added some defensive programming to the site. Sorry to say. Appreciate that you hacked it with your image onerror, pretty clever. TBH I haven't thought about most of these things. Nobody typically reads my blogs when I've made them before and this is likely the only interest it will get for quite a while.
    - chatmasta 3y ago
      lol :) nice fix Can't promise I won't circumvent it when I've got some time...

aosaigh 3y ago

I don't understand how this helps ownership of content? What situation is this trying to avoid? You already "own" your URL if you own your domain? EDIT: understand you are not the OP btw, just wondering out loud.

dinkleberg 3y ago
The only thing I can think of is if they want to share controversial posts while having the ability to deny that they wrote it (as long as they don’t actually create a link to it from their own site). It’s not a good use case IMO, but that is all I can think of lol

perlguy9 3y ago

Tranlsation: This guy is insufferable

deleted 3y ago

[deleted]

mortallywounded 3y ago

https://joshcsimmons.com/post/H4sIAAAAAAAAAyXMQQrCMBCF4b2neOBCBWn3nkAXegFxMTGjCW0yJTNp6e1t6%2B57PPj3uNPsGNEQNR8MUyD7r2a3u4ESshi0Fj7D1e1S5qToY8cgOPKIngkmKJw9ly3B4wKVxJIZQzVF4MJbspeR8bw%2BXsdgNuilbTNP2sxvSS5mMinNwhMsSP0GUPYLGR%2FpO121Zn7rWby7twAAAA%3D%3D https://joshcsimmons.com/post/H4sIAAAAAAAAAyXMQQrCMBCF4b2neO... Doesn't need to release tools... gzip, base64 and uri encode uh huh.

hk__2 3y ago

So if the author fix a small typo in the post, they break all the links to it. The blog is not "stateless", it’s just that its state is stored in the homepage. Having all posts on that page with anchor links would achieve the same thing with shorter links that don’t depend on the content.

cbsks 3y ago
It won’t break any existing links. It just means that existing links will still have the typo.

amatecha 3y ago

Huh, cool. I think it's a pretty terrible idea, but I'm glad people are still doing fun/creative things with websites. Keeping the spirit of the early web alive. haha :)

foxtrottbravo 3y ago

But how does it know whether it should print the pretext?