8 ms·
Anyone else feels like this will be abused for phishing and/or malware distribution?
by h4x0rr 2y ago
Anyone else feels like this will be abused for phishing and/or malware distribution?
- remram 2y agoI don't see how. This is a direct link to the author's bluesky server (PDS) so of course it is controlled by them.
- benatkin 2y agoLack of moderation combined with an offical-sounding domain name. This would have to get the user to follow a link or call a phone number or something though. These are plausible. It's too bad the content-security-policy can't prevent following links.
- extraduder_ire 2y agoBluesky seems to use a lot of totally different domain names for each part of their infrastructure, maybe for this reason. e.g. this one is bsky.network While they're nowhere close on volume, they're certainly beating microsoft in terms of the rate they're adding similar looking official URLs.
- deleted 2y ago[deleted]
- whywhywhywhy 2y ago> bsky.network Shortening your brand to 4 letters when your chosen TLD is the same length as your full brand name is such a weird choice.
- extraduder_ire 2y agoI think the linked blogpost is the first time I've seen that URL used anywhere user-facing. (other than the status page) bsky.<TLD> is already used for other user-facing URLs though.
- tomrod 2y agoThis is why you and I aren't in charge of marketing I reckon.
- wise_young_man 2y agoI guess bsky.net and bluesky.net were taken. What’s weird is why ICANN allowed .network TLD at all when .net already existed, was shorter, and meant for that.
- Symbiote 2y agoI can't be the only person who visited bluesky.com, assuming that was the thing everyone was talking about.
- anon7000 2y agoI mean, the way AT Proto is designed, moderation primarily happens on the app layer, not the protocol layer. So on an app like Bluesky, you can have a lot of moderation. But the protocol itself allows hosting arbitrary content in a distributed/decentralized way.
- ndjdjddjsjj 2y agoPhish could be this: $inane_marketing_trope ... Click here to Unsubscribe from Bluesky https://porcini.us-east.host.bsky.network/xrpc/com.atproto.sync.getBlob?did=did:plc:j22nebhg6aek3kt2mex5ng7e&cid=bafkreic5fmelmhqoqxfjz2siw5ey43ixwlzg5gvv2pkkz7o25ikepv4zeq https://porcini.us-east.host.bsky.network/xrpc/com.atproto.s... ... Redirects to bad site.
- remram 2y agoAs long as content is authored by the administrator of the server, I don't see where there is a security issue. It's like if you point to your own Apache server in your own domain where you host a scam page and say there's a security issue with Apache because you could do that. Or are you saying that you can make this person's server serve third-party content?
- ndjdjddjsjj 2y ago> Or are you saying that you can make this person's server serve third-party content? Http: yes see OP Email: not sure. Hopefully not. But spoofing happens.
- nicky0 2y agoThe link in question (linked from the the sumbitted link) is `porcini.us-east.host.bsky.network`. That's hosted by bsky, isn't it?
- lazystar 2y agois there any hosting site that isn't? feels like a computing law at this point; if you build a hosting site, someone will try to use it for malicious purposes.
- EGreg 2y agoCan’t you just make the hosting site features only be for real purposes? Like a link shortener which only forwards to a domain that matches the subdomain? Or only for watching videos and collecting metrics etc.
- internetter 2y agoAny file upload can be used for unintended purposes, eg encoding files into static to upload to youtube and all other sorts of tomfoolery: https://github.com/boehs/awesome-cloud-storage-abuse https://github.com/boehs/awesome-cloud-storage-abuse
- ineedaj0b 2y agohehehe. I pinned it to the top research ideas. I'll get back to you on this
- deleted 2y ago[deleted]
- bigfatkitten 2y agoIt'll take about 5 mins for that to happen and then for *.bsky.network to start getting blocked by Google Safe Browsing, Palo Alto, Bluecoat etc.
- kuschku 2y agoIt will be. We had the same issue with Matrix attachments.
- Arathorn 2y agogot fixed by https://github.com/matrix-org/matrix-spec-proposals/blob/main/proposals/3916-authentication-for-media.md https://github.com/matrix-org/matrix-spec-proposals/blob/mai... fwiw
- kuschku 2y agoI noticed^^ Tbh, I still haven't figured out how my IRC client is supposed to fetch avatars of bridged matrix users now. Previously I was able to special case bridged matrix users and access their avatars through /_matrix/client/r0/profile/{name}/avatar_url /_matrix/media/r0/thumbnail/{server}/{id}/ /_matrix/media/r0/download/{server}/{id}
- Arathorn 2y agoI believe the bridges should host a proxy (per-bridge) to expose content: https://github.com/matrix-org/matrix-appservice-irc/pull/1805/files#diff-d2418fdfd951cf34759253e176353052c65c5bd47b9f5b8a9d052fea79cc3037R613 https://github.com/matrix-org/matrix-appservice-irc/pull/180...