zlacker

[parent] [thread] 15 comments
1. smcl+(OP)[view] [source] 2023-05-05 07:26:13
Last night I opened this, saw the HTTP 429 and figured "ah too many requests, I'll check the comments and try in the morning". The comments were all people swooning in shock about why some non-specific they (S3? Amazon? Someone else?) didn't use ".well-known" and others complaining about Mastodon and/or the fediverse. I had to read multiple comments to piece together the story, I swear it was like Elden Ring[0].

What this is actually about: BlueSky is Jack Dorsey's new Twitter clone, it is eventually intended to be some sort of fediverse thing but it's not there yet and it's not the source of the fediverse gripes here. You can authenticate your BlueSky user as the owner of a given domain or subdomain by placing a certain file with a given content somewhere under that domain/subdomain. However that "somewhere" was just a location one of the devs at BlueSky chose, rather than somewhere relatively standardised, like under the ".well-known" path (which you might recognise from things like OpenID Connect where the configuration doc is located @ example.com/.well-known/openid-configuration). So one user exploited this and became the "owner" of that Amazon S3 domain by setting up a storage account on Amazon S3 and following BlueSky's setup instructions. That is the main story here - some non-Amazon rando is now officially the Amazon S3 guy on Bluesky.

The next part is that someone posted about it on this https://chaos.social Mastodon instance, which got overwhelmed, the owners decided to save their server by electing to return a 429 response for that specific post if users don't belong to chaos.social, and that is why people are upset about Mastodon.

Interesting story, but I'm not interested in Dorsey's version of Twitter 2.0 unless it actually allows you to signup[1] and brings something compelling that Twitter didn't and Mastodon doesn't.

[0] - game with an intricate story that does its damndest to not actually tell you. If you want to know the story you have to piece it together yourself by picking up dozens of items scattered throughout the game and reading all their descriptions. Or you can do what I did - watch a video on YouTube.

[1] - they're doing an open beta and letting a little trickle of users on, who post about it on their Twitter/Mastodon/whatever. Feels a bit deliberate, like they're trying to build anticipation and frankly I detest little manipulative things like that so I'm out

replies(8): >>bjord+u >>t0mek+C1 >>cirodu+42 >>accoun+E4 >>skrebb+M5 >>neilal+97 >>bambax+sa >>dspill+Og
2. bjord+u[view] [source] 2023-05-05 07:31:33
>>smcl+(OP)
this is everything I wanted to know and more, all in one comment—thank you
3. t0mek+C1[view] [source] 2023-05-05 07:42:58
>>smcl+(OP)
Archived version of the original Mastodon post: https://archive.is/fM06z
4. cirodu+42[view] [source] 2023-05-05 07:46:53
>>smcl+(OP)
You should still follow Jonty (the poster at that Mastodon instance) wherever your socials are, because he's awesome, and posts about awesome things. He's also the organiser of EMFCamp (https://www.emfcamp.org/), which is a nerd/hacker camping festival.
replies(1): >>smcl+W2
◧◩
5. smcl+W2[view] [source] [discussion] 2023-05-05 07:53:51
>>cirodu+42
Thanks, will do! I'm always on the lookout for interesting people on Mastodon!
6. accoun+E4[view] [source] 2023-05-05 08:11:19
>>smcl+(OP)
> The next part is that someone posted about it on this https://chaos.social Mastodon instance, which got overwhelmed, the owners decided to save their server by electing to return a 429 response for that specific post if users don't belong to chaos.social, and that is why people are upset about Mastodon.

It's like all these newfangled webapps don't understand the concept of caching static pages for anonymous users. There is absolutely no reason that something like this should result in more than one request (plus a handful more for static resources) handled entirely by the frontent webserver's in-memory cache for each person linked from other sides. But instead its all dynamic and the page shoots off more API requests before being able to show anything.

replies(1): >>smcl+07
7. skrebb+M5[view] [source] 2023-05-05 08:23:08
>>smcl+(OP)
Just wanna share that I found your comment a lot of fun to read, even if I had already pieced the story together from other comments. Thanks!
◧◩
8. smcl+07[view] [source] [discussion] 2023-05-05 08:38:02
>>accoun+E4
So the thing is that in one respect they actually do get caching, almost to a fault. One of the complaints I've seen among some Mastodon instance operators is that they end up storing some pretty hefty amounts of data locally as their instance caches remote posts, images and profiles from other instances that its members follow. One source of problems, which may have been resolved, was that even though there's a job that cleans out this cache the banner images from external profiles stick around. I saw this a while back and it seems like an easy fix so I imagine it's been addressed.

I don't think I am equipped to diagnose what the root cause was here. It's even possible that this instance wasn't intended to have viral posts (i.e. high profile posts that get would get shared to many external users) and they didn't want to invest in hardware/services to facilitate this.

replies(1): >>_heimd+Xr
9. neilal+97[view] [source] 2023-05-05 08:39:39
>>smcl+(OP)
> [1] - they're doing an open beta and letting a little trickle of users on, who post about it on their Twitter/Mastodon/whatever. Feels a bit deliberate, like they're trying to build anticipation and frankly I detest little manipulative things like that so I'm out

Frankly this cynicism feels unwarranted. Bluesky is not a finished product — it is still being built and, even with the small number of invited users so far, there have been problems that have needed attention. The moderation story is still being developed, the feeds are still being tweaked, the app still has bugs, federation still doesn't work yet. Having some users makes for a valuable feedback loop but the team would rapidly become inundated and burnt out (and the platform would possibly turn into a wild-west hellscape with irreversible reputational damage) if they were to open the floodgates entirely at this stage.

replies(1): >>smcl+s8
◧◩
10. smcl+s8[view] [source] [discussion] 2023-05-05 08:50:58
>>neilal+97
To clarify - it felt like this was an attempt to replicate the mid-00s play of building interest by restricting who can join and making it exclusive (Facebook did this by rolling it out uni-by-uni, Gmail was for a while invite-only and invites were highly valued) and therefore desirable.

Maybe that's in my head but layering this feeling on top of BlueSky being yet another microblogging service with a few other things that I don't love contributes to my impression of Bluesky being simply "meh". If it becomes the next thing that everyone uses, I'll inevitably have to check it out, I'm not going to be an early adopter though.

replies(1): >>cnity+FB
11. bambax+sa[view] [source] 2023-05-05 09:14:19
>>smcl+(OP)
Aaaah! Thanks! Great write up!!
12. dspill+Og[view] [source] 2023-05-05 10:18:00
>>smcl+(OP)
> However that "somewhere" was just a location one of the devs at BlueSky chose, rather than somewhere relatively standardised, like under the ".well-known" path

I've not looked into BlueSky's domain based identity thing in any detail so I might be missing a point somewhere, but… If someone can manipulate its special location what would there be to stop the same someone being able to manipulate content under .well-known?

Are we just relying on .well-known having some extra protection (in this case by Amazon having created a bucket called .well-known so no one else could)? If so then .well-known is little safer than any other arbitrary location in this respect (because you are relying on every domain owner who might be spoofed to take an action to protect against this, rather than the protocol failing safe if nothing is done by the domain owner) and perhaps using DNS would be better.

replies(1): >>manana+9p
◧◩
13. manana+9p[view] [source] [discussion] 2023-05-05 11:25:58
>>dspill+Og
> Are we just relying on .well-known having some extra protection [...] ? If so then .well-known is little safer than any other arbitrary location in this respect.

If .well-known had just been invented, that would be true. It's fairly well established at this point, though. For example, if someone can create arbitrary files in .well-known, they are also able to pass http-01 ACME challenges and thus issue TLS certs for your domain (modulo CAA) and MITM you. At this point, allowing users to modify .well-known is about as good an idea as allowing them to receive mail for postmaster@ or accepting incoming packets from 192.168.0.0/16 into your LAN.

Amazon S3 specifically would not be vulnerable because bucket names can’t have dots in them; same for every other service that doesn’t allow those. Neither would services that prefix usernames with ~ or @ or similar, nor services that already use http-01 ACME challenges to get certs thus are already using that path.

I’d be much happier if proving domain control were only done through DNS challenges, but that ship has sailed.

replies(1): >>dspill+kw3
◧◩◪
14. _heimd+Xr[view] [source] [discussion] 2023-05-05 11:47:39
>>smcl+07
I think the GP was referring to caching on the other end, caching static html that can be raised for all anonymous users.

The question is whether the server was having issues with a flood of new posts being sent in and stored, or a flood of anonymous users clicking a link and blogging down when the same html was getting rendered over and over.

Knowing Mastodon, I have a bunch of was the latter with the server coming out on all the new data it was trying to store locally

◧◩◪
15. cnity+FB[view] [source] [discussion] 2023-05-05 12:57:20
>>smcl+s8
Your feelings resonate with me too. My attitude these days is that if a platform wants to make me feel excluded (in order to induce FOMO), then I accept being excluded. They win, I guess?
◧◩◪
16. dspill+kw3[view] [source] [discussion] 2023-05-06 09:57:34
>>manana+9p
Good point with other common services like certificates via ACME.

Though MitM that way requires more steps than faking identity this way as you need to somehow get in the middle or redirect traffic towards you.

> I’d be much happier if proving domain control were only done through DNS challenges, but that ship has sailed.

Agreed.

[go to top]