4 ms·

Here is the content that is in the HTML but which the linked page refuses to actually show on the screen, instead opting for a "run javascript" message: <meta

Here is the content that is in the HTML but which the linked page refuses to actually show on the screen, instead opting for a "run javascript" message: <meta content='Our university deployed a mail filter that rewrites URLs in emails to redirect them via a service that checks for bad websites. Somebody clever worked out that PGP-signed emails are exempt from the rewrite rule, so now people are starting their emails with "BEGIN PGP MESSAGE" even though they haven't used PGP at all, just to fool the filter Anybody sending malware links has probably also worked out that trick by now, thereby rendering the entire filter pointless' name='description'>

cesarb 2y ago
A trick which works if you use Mastodon, since that page is a Mastodon post: Go to the Mastodon instance where you have an account, and paste the URL in the search box. It should load the post within your Mastodon instance (and allow you to boost/favorite/etc), without running any JavaScript from the post's instance. (It won't surprise me if someday a Firefox plugin is created to open these Mastodon post pages without running their JavaScript, by detecting it's Mastodon and going through the same protocol as federated instances to fetch the content. Of course, it would be better if the Mastodon server software didn't require JavaScript for simply showing a post page in the first place.)
- berkes 2y ago
  Not exactly the plugin you envision, but Graze¹ does this for interaction (boost, favorite, follow, reply etc) with posts on any instance. I guess the redirect and re-open on your own instance would be a feature for graze? IDK. ¹ https://addons.mozilla.org/en-US/firefox/addon/graze/ https://addons.mozilla.org/en-US/firefox/addon/graze/
cwillu 2y ago
Thank you.
ethbr1 2y ago
IMHO, there's definitely some security value is at least running a non-standard config. Moving from seeing all attacks (even if blocked) to only targeted attacks decreases the amount of noise a detection system/reviewer has to deal with. The important bit, though, is remembering only the above doesn't mean things that make it through are secure, which is usually where companies fall over. (I.e. implement dumb mail filter, then assume any mails that make it through are safe)
Isognoviastoma 2y ago
Thanks for sharing! A bit of css, and it's possible to read mastodon posts with a web browser! head {display:block; background:Canvas; color:CanvasText;} meta[content] {display:block; padding-bottom:1em;} meta[content]::after{content:attr(content); display:block;}
- o11c 2y ago
  Or just append /embed The disadvantage is that threads don't render.
  - superkuh 2y ago
    The fact that the mastodon devs put the content in the HTML but refuse to show the content tells me everything I need to know about mastodon. It may even be worse than twitter. Generally I will not go out of my way to use or view such links. I just close the tabs.
    - cesarb 2y ago
      In my experience, Mastodon (and other relatives from its family) is much better than current Twitter, at least for non-logged-in users. On Mastodon, as long as you enable JavaScript, you can see the whole thread for the post, while Twitter (which also needs JavaScript) only shows the initial post; and if you go to an account's page, Mastodon shows the whole timeline in reverse-chronological order (which is generally what you want), while Twitter shows old posts in a random order.
      - superkuh 2y ago
        I understand that POV and within it's context I agree. But to a non-JS user they are equivalent (Mastodon and Twitter) in functionality: blank pages telling you to execute random code. Very similar to phishing emails telling one to execute the random code attachment. Twitter has to be bad by virtue of being a corporation driven by profit motive and requiring JS to collect and sell user data. Mastodon doesn't have to be crap since it is not required to generate maximum profit. It just chooses to be as shown from the content being in the HTML but hidden. This makes Mastodon worse. Either it's malicious or, more likely, incompetent cargo culting of corporate practices. Devs unable to separate themselves from the use-cases they have to develop for at their paid jobs or lacking the knowledge to do so.

cesarb 2y ago

A trick which works if you use Mastodon, since that page is a Mastodon post: Go to the Mastodon instance where you have an account, and paste the URL in the search box. It should load the post within your Mastodon instance (and allow you to boost/favorite/etc), without running any JavaScript from the post's instance. (It won't surprise me if someday a Firefox plugin is created to open these Mastodon post pages without running their JavaScript, by detecting it's Mastodon and going through the same protocol as federated instances to fetch the content. Of course, it would be better if the Mastodon server software didn't require JavaScript for simply showing a post page in the first place.)

berkes 2y ago
Not exactly the plugin you envision, but Graze¹ does this for interaction (boost, favorite, follow, reply etc) with posts on any instance. I guess the redirect and re-open on your own instance would be a feature for graze? IDK. ¹ https://addons.mozilla.org/en-US/firefox/addon/graze/ https://addons.mozilla.org/en-US/firefox/addon/graze/

cwillu 2y ago

Thank you.

ethbr1 2y ago

IMHO, there's definitely some security value is at least running a non-standard config. Moving from seeing all attacks (even if blocked) to only targeted attacks decreases the amount of noise a detection system/reviewer has to deal with. The important bit, though, is remembering only the above doesn't mean things that make it through are secure, which is usually where companies fall over. (I.e. implement dumb mail filter, then assume any mails that make it through are safe)

Isognoviastoma 2y ago

Thanks for sharing! A bit of css, and it's possible to read mastodon posts with a web browser! head {display:block; background:Canvas; color:CanvasText;} meta[content] {display:block; padding-bottom:1em;} meta[content]::after{content:attr(content); display:block;}

o11c 2y ago
Or just append /embed The disadvantage is that threads don't render.
- superkuh 2y ago
  The fact that the mastodon devs put the content in the HTML but refuse to show the content tells me everything I need to know about mastodon. It may even be worse than twitter. Generally I will not go out of my way to use or view such links. I just close the tabs.
  - cesarb 2y ago
    In my experience, Mastodon (and other relatives from its family) is much better than current Twitter, at least for non-logged-in users. On Mastodon, as long as you enable JavaScript, you can see the whole thread for the post, while Twitter (which also needs JavaScript) only shows the initial post; and if you go to an account's page, Mastodon shows the whole timeline in reverse-chronological order (which is generally what you want), while Twitter shows old posts in a random order.
    - superkuh 2y ago
      I understand that POV and within it's context I agree. But to a non-JS user they are equivalent (Mastodon and Twitter) in functionality: blank pages telling you to execute random code. Very similar to phishing emails telling one to execute the random code attachment. Twitter has to be bad by virtue of being a corporation driven by profit motive and requiring JS to collect and sell user data. Mastodon doesn't have to be crap since it is not required to generate maximum profit. It just chooses to be as shown from the content being in the HTML but hidden. This makes Mastodon worse. Either it's malicious or, more likely, incompetent cargo culting of corporate practices. Devs unable to separate themselves from the use-cases they have to develop for at their paid jobs or lacking the knowledge to do so.