3 ms·

I'm curious about their discussion of web forums. See the provided slides: https://www.documentcloud.org/documents/2116268-web-forum-exploitation-using-xks.htm

I'm curious about their discussion of web forums. See the provided slides: https://www.documentcloud.org/documents/2116268-web-forum-exploitation-using-xks.html#document/p2 https://www.documentcloud.org/documents/2116268-web-forum-ex... It says they have "full take for US web forum servers under FISA coverage", and "passive collection for OCONUS [outside continental US] web forum server traffic". What does "FISA coverage" mean? They have warrants for specific forums, or a general warrant giving them access to thousands of forums? I run a fairly large OCONUS message board. Are my visitors all in XKEYSCORE? I wish the release were more specific.

fossuser 11y ago
I'd guess 'under FISA coverage' means they're collecting all traffic, but can only access it with FISA court approval (i.e it's under the coverage of the FISA court). Traffic outside the US is collected, but probably doesn't need any approval to look at. I'd suspect that all your visitors are in XKEYSCORE.
jlgaddis 11y ago
Time to install an SSL certificate and force encryption on all visitors, eh?
- capnrefsmmat 11y ago
  That's hard for a web forum with BBCode -- posts can load external images on non-HTTPS domains. I suppose I can have the BBCode alter the URLs to point to my domain, and use nginx to proxy the image loads. I'd have to be careful to make sure users can't proxy malicious scripts and stuff into the page (because it'd be same-origin); is there a standard solution for this?