@Dirk@lemmy.ml
@Dirk@lemmy.ml avatar

Dirk

@Dirk@lemmy.ml

Somewhere between Linux woes, gaming, open source, 3D printing, recreational coding, and occasional ranting.

🔗 Me, but elsewhere

🇬🇧 / 🇩🇪

This profile is from a federated server and may be incomplete. Browse more on the original instance.

Dirk,
@Dirk@lemmy.ml avatar

Mmmh, not sure. Problably Outlaw.

Dirk,
@Dirk@lemmy.ml avatar

That’s the good thing with federation. You can participate in communities without visiting the instance even once.

Dirk,
@Dirk@lemmy.ml avatar

Also, strict CSP would prevent it entirely.

Dirk,
@Dirk@lemmy.ml avatar

Another reason to block this TLD in the firewall solution.

Dirk,
@Dirk@lemmy.ml avatar

To prevent execution of scripts not referenced with the correct nonce:

<pre style="background-color:#ffffff;">
<span style="color:#323232;">script-src 'self' 'nonce-$RANDOM'
</span>

To make it super strict, this set could be used:

<pre style="background-color:#ffffff;">
<span style="color:#323232;">default-src 'self';
</span><span style="color:#323232;">script-src 'nonce-$RANDOM'
</span><span style="color:#323232;">object-src 'none';
</span><span style="color:#323232;">base-uri 'none';
</span><span style="color:#323232;">form-action 'none';
</span><span style="color:#323232;">frame-ancestors 'none';
</span><span style="color:#323232;">frame-src 'none';
</span><span style="color:#323232;">require-trusted-types-for 'script'
</span>

Especially the last one might cause the most work, because the “modern web development environment” simply cannot provide this. Also: form-action ‘none’; should be validated. It should be set to self if forms are actually used to send data to the server and not handled by Javascript.

The MDN has a good overview: developer.mozilla.org/…/Content-Security-Policy

Dirk,
@Dirk@lemmy.ml avatar

Because .zip is a commonly used file extension.

Dirk,
@Dirk@lemmy.ml avatar

They can and they do. Using a commonly known and used file extension to “hide” a malicious URL is just easier.

www.youtube.com/watch?v=GCVJsz7EODA

Dirk,
@Dirk@lemmy.ml avatar

but in general, threat actors hope to confuse people into thinking this “.zip” TLDs are only referencing local files instead of web addresses. right?

Exactly!

Dirk,
@Dirk@lemmy.ml avatar

It can even be found in unborn babies!

Dirk,
@Dirk@lemmy.ml avatar

DuckDuckGo clearly censors results based on IP.

Dirk,
@Dirk@lemmy.ml avatar

I use selfhost.de (they register domains via united-domains for you) who are specialized on self-hosting in Germany and offer a wide variety of options on how to connect a domain using dynamic DNS.

Dirk,
@Dirk@lemmy.ml avatar

the lemmy.world guy had to upgrade servers at least twice during the boom

It’s their fault, though. You could either throw money at it to gain more and more power over users, or you embrace the federation and disable new registration at a certain amount of users.

Dirk,
@Dirk@lemmy.ml avatar

Came here to say this.

Dirk,
@Dirk@lemmy.ml avatar

Exactly. If they’re bots but not registered as such, just report them.

Dirk,
@Dirk@lemmy.ml avatar

You can hide bot accounts in the settings.

Dirk,
@Dirk@lemmy.ml avatar

It’s literally the first in the list of meaning.

Why’s it called Lemmy?

  • Lead singer from Motörhead.
  • The old school video game.
  • The Koopa from Super Mario.
  • The furry rodents.

github.com/LemmyNet/lemmy/tree/main#whys-it-calle…

Dirk,
@Dirk@lemmy.ml avatar

That is a vulnerability, albeit a small one.

“Small one” is very wrong here. This is by far the largest gaping security hole in the whole specification.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • localhost
  • All magazines
    •
    Loading…
    Loading the web debug toolbar…
    Attempt #