Notices by Professor (professorpowerbottom@seal.cafe)

this one gets me because you really think anyone would pride themselves on being white this much and not be white?

Guide to remediating the pleroma/ copebox exploit

This is a file upload vulnerability that exploits an excessive trust relationship, it’s not XSS because nothing is injected with the use of parameters. OAUTH tokens are generated on the client side and validated on the server, so the script is just intercepting those OAUTH tokens. I’m not entirely sure on the full scope of what actually happened versus the narrative being pushed around but it seems to either be directly related to soapbox or pleroma. In the best case this is negligence independent from the fediverse software (press X to doubt).

• validate your file upload protections, js isn’t required so why are you allowing it? This should never be a valid upload type. Scan everything.
• have a content security policy set in place, is a defense in depth measure to explicitly state where javascript files can be run from.
• give your OAUTH tokens a shorter lifespan or purge them after being utilized. Yubi keys are handled this way, one time use only.

I have never once seen graf say anything about being contacted by federal agencies.

Alright maybe I’m mistaken but a while back some glowy behavior went on and pete and graf both stopped registrations because of it. they both talked about it.

Nigga what he GETS donations why would he be giving money away when he solicits donations for Poa.st himself?

Yes he gets donations but he also gives money to FSE and other big instances. For what reason? Maybe to get him to like them. But let’s be real poa.st would make the perfect honeypot for altright retards because of it’s size.