GNU social JP
  • FAQ
  • Login
GNU social JPは日本のGNU socialサーバーです。
Usage/ToS/admin/test/Pleroma FE

  • Public

    • Public
    • Network
    • Groups
    • Featured
    • Popular
    • People

Notices by silverwizard (silverwizard@convenient.email), page 7

  1. Embed this notice
    silverwizard (silverwizard@convenient.email)'s status on Wednesday, 23-Oct-2024 06:10:42 JST silverwizard silverwizard
    in reply to
    • hypolite
    @hypolite I think it's just that browser vendors are unwilling to support them properly, and generally there's a generic trust in the local source. It's also complex as browers are also a mess of JS and local user scripts are a very normal part of browsing these days, since most people are using extensions to their browser.
    In conversation about a month ago from convenient.email permalink
  2. Embed this notice
    silverwizard (silverwizard@convenient.email)'s status on Wednesday, 23-Oct-2024 05:07:06 JST silverwizard silverwizard
    in reply to
    • hypolite
    @hypolite Trying adding self to any of the sources could not cause the script to not execute.
    In conversation about a month ago from convenient.email permalink
  3. Embed this notice
    silverwizard (silverwizard@convenient.email)'s status on Wednesday, 23-Oct-2024 04:52:20 JST silverwizard silverwizard
    in reply to
    • hypolite
    @hypolite But it ran!
    In conversation about a month ago from convenient.email permalink
  4. Embed this notice
    silverwizard (silverwizard@convenient.email)'s status on Wednesday, 23-Oct-2024 04:37:19 JST silverwizard silverwizard
    in reply to
    • hypolite
    @hypolite Ran it in Chrome and Firefox as well. Also changed the CSP to default-src: 'none' script-src: 'none' and got the same results in LibreWolf.
    In conversation about a month ago from convenient.email permalink
  5. Embed this notice
    silverwizard (silverwizard@convenient.email)'s status on Wednesday, 23-Oct-2024 04:33:45 JST silverwizard silverwizard
    in reply to
    • hypolite

    @hypolite Ok - actually

    I ran
    cat test.txt | nc -l -p 2000
    with test.txt containing

    HTTP/1.0 200 OK Date: Tue, 22 Oct 2024 19:27:37 GMT Server: OpenBSD httpd Connection: close Content-Type: text/html Content-Length: 486 Location: localhost Content-Security-Policy: script-src: 'none' <html> <head>Hello</head> <body> <script>alert("OH NO");</script> </body> </html>

    (Ignore the fake content length)

    I then pointed my browser at it, and it saw these response headers:

    HTTP/1 200 OK Date: Tue, 22 Oct 2024 19:27:37 GMT Server: OpenBSD httpd Connection: close Content-Type: text/html Content-Length: 486 Location: localhost Content-Security-Policy: script-src: 'none'

    And it popped up a popup saying "OH NO"

    In conversation about a month ago from convenient.email permalink
  6. Embed this notice
    silverwizard (silverwizard@convenient.email)'s status on Wednesday, 23-Oct-2024 04:28:21 JST silverwizard silverwizard
    in reply to
    • hypolite

    @hypolite So if I send:
    Content-Security-Policy: script-src: 'none'

    <html>
    <script>alert("OH NO");</script>
    </html>

    With a valid Content-Length and junk

    Would that work?

    In conversation about a month ago from convenient.email permalink
  7. Embed this notice
    silverwizard (silverwizard@convenient.email)'s status on Wednesday, 23-Oct-2024 03:55:22 JST silverwizard silverwizard
    in reply to
    • Allen

    @allenstenhaus My uncle started going bald at 17, and the wisdom was I'd be bald by 20. So I decided to enjoy it while I could.

    I am 36 and I've managed to keep it!

    In conversation about a month ago from gnusocial.jp permalink
  8. Embed this notice
    silverwizard (silverwizard@convenient.email)'s status on Wednesday, 23-Oct-2024 03:52:04 JST silverwizard silverwizard
    in reply to
    It's true! They forgot to confiscate the jacket when they issued me my CISSP
    In conversation about a month ago from convenient.email permalink
  9. Embed this notice
    silverwizard (silverwizard@convenient.email)'s status on Wednesday, 23-Oct-2024 03:51:29 JST silverwizard silverwizard
    if you see this hacker at SECTor, you may tell me I owe you a drink. Prefacing it, "I'm from the fediverse" will make me slightly less confused. But, telling me I owe you a drink will cause me to buy you a drink, be it a fancy coffee, a boring coffee, a beer, a cocktail, a juice, or whatever else.
    In conversation about a month ago from convenient.email permalink

    Attachments


    1. https://convenient.email/photo/17633201736717f3afdc29c983469518-0.jpg
  10. Embed this notice
    silverwizard (silverwizard@convenient.email)'s status on Wednesday, 23-Oct-2024 02:38:37 JST silverwizard silverwizard
    in reply to
    • hypolite
    @hypolite Does that block local scripts? I thought it didn't? I don't have a spare webserver I feel safe rewriting headers on right now.
    In conversation about a month ago from convenient.email permalink
  11. Embed this notice
    silverwizard (silverwizard@convenient.email)'s status on Wednesday, 23-Oct-2024 02:04:03 JST silverwizard silverwizard
    in reply to
    • Patch Arcana
    @patcharcana Also - if I'm listening to music all day - my headphones are gonna run down hard, and if I need two $200 headphones, or a charger and cable always around, it's not gonna happen.
    In conversation about a month ago from convenient.email permalink
  12. Embed this notice
    silverwizard (silverwizard@convenient.email)'s status on Wednesday, 23-Oct-2024 02:00:12 JST silverwizard silverwizard
    Question - is the rise of people listening to music aloud related to the headphone jack dying?
    In conversation about a month ago from convenient.email permalink
  13. Embed this notice
    silverwizard (silverwizard@convenient.email)'s status on Wednesday, 23-Oct-2024 01:14:00 JST silverwizard silverwizard
    in reply to
    • hypolite

    @hypolite developer.mozilla.org/en-US/do…

    Is there a way to say default-src: none? Or just set no valid sources? not as I recall

    In conversation about a month ago from convenient.email permalink

    Attachments


  14. Embed this notice
    silverwizard (silverwizard@convenient.email)'s status on Wednesday, 23-Oct-2024 00:45:52 JST silverwizard silverwizard
    in reply to
    • Sconient
    @Sconient Oh yeah - JS existed ;)
    In conversation about a month ago from convenient.email permalink
  15. Embed this notice
    silverwizard (silverwizard@convenient.email)'s status on Tuesday, 22-Oct-2024 23:45:39 JST silverwizard silverwizard
    in reply to
    • Éric Paquette
    • Diotima
    @ericmpaq @tieflingdio That's valid. 3e gave them all slight differences, and I think some minor tweaks exist to sell books.
    In conversation about a month ago from convenient.email permalink
  16. Embed this notice
    silverwizard (silverwizard@convenient.email)'s status on Tuesday, 22-Oct-2024 23:32:13 JST silverwizard silverwizard
    in reply to
    • Éric Paquette
    • Diotima

    @ericmpaq @tieflingdio Wait, Standard D&D Elves is a weird idea.

    The High/Grey/Valley/Wood elves of Greyhawk are what I think of as "standard", whereas the Sun and Moon of Faerun are typically slightly off model?

    In conversation about a month ago from convenient.email permalink
  17. Embed this notice
    silverwizard (silverwizard@convenient.email)'s status on Tuesday, 22-Oct-2024 22:50:32 JST silverwizard silverwizard
    in reply to
    • hypolite
    • Frost, Wolffucker 🐺:therian:
    @hypolite @IceWolf Does CSP let you reject javascript from the local domain?
    In conversation about a month ago from convenient.email permalink
  18. Embed this notice
    silverwizard (silverwizard@convenient.email)'s status on Tuesday, 22-Oct-2024 22:09:37 JST silverwizard silverwizard
    in reply to
    • hypolite
    • Frost, Wolffucker 🐺:therian:

    @hypolite @IceWolf CORS allows you to limit cross domain resources. But I can mine bitcoin on your CPU without any cross domain anything. Hell, in theory,I might be able to send spam that way! I can definitely steal your credit card number.

    But if I could just add a X-No-Dynamism header that would say "this HTTP session does not send JS or WASM", I could keep everything on my site safe.

    I could let users write pretty unfiltered HTML, and most of the tricks would be contained in a frame.

    In conversation about a month ago from convenient.email permalink
  19. Embed this notice
    silverwizard (silverwizard@convenient.email)'s status on Tuesday, 22-Oct-2024 20:05:23 JST silverwizard silverwizard
    @valk I personally think JavaScript is underhated. I think people don't think enough about the ways the Browser is now a platform. People feel safe with browsers, and that's not a good idea imo.
    In conversation about a month ago from convenient.email permalink
  20. Embed this notice
    silverwizard (silverwizard@convenient.email)'s status on Tuesday, 22-Oct-2024 11:26:25 JST silverwizard silverwizard
    in reply to
    • lifts
    @lifts @valk right, CSS has grown to madness
    In conversation about a month ago from convenient.email permalink
  • After
  • Before

User actions

    silverwizard

    silverwizard

    Father first and foremostRPG player/hacker for fun and explicitly not profitInfoSec for ProfitFeral Child of Unix and RFC 2324

    Tags
    • (None)

    Following 3

    • Linux Walt (@lnxw37j1) {3EB165E0-5BB1-45D2-9E7D-93B31821F864}
    • Alexandre Oliva
    • ぐぬ管 (GNU social JP管理人)

    Followers 2

    • Alexandre Oliva
    • GNU Too

    Groups 0

      Statistics

      User ID
      22153
      Member since
      10 Nov 2022
      Notices
      3000
      Daily average
      4

      Feeds

      • Atom
      • Help
      • About
      • FAQ
      • TOS
      • Privacy
      • Source
      • Version
      • Contact

      GNU social JP is a social network, courtesy of GNU social JP管理人. It runs on GNU social, version 2.0.2-dev, available under the GNU Affero General Public License.

      Creative Commons Attribution 3.0 All GNU social JP content and data are available under the Creative Commons Attribution 3.0 license.